# BIMI logo checker: check and interpret your BIMI record > BIMI logo checker guide: check a domain's BIMI record, interpret Palisade results, repair DMARC enforcement or record issues, and retest now. A BIMI logo checker checks the BIMI configuration published for a domain. Enter the sending domain in the [Palisade BIMI Checker](/tools/bimi), then use the result to separate a missing BIMI DNS record from a certificate, logo, or DMARC-enforcement issue. The result is useful public evidence, but it cannot prove that a mailbox provider will display a logo for every future message. ## Quick takeaways - Palisade's BIMI Checker accepts a domain, not an uploaded logo file or SVG URL. - BIMI policy is normally published as a DNS TXT record at `default._bimi.yourdomain.com`. - A BIMI `l=` tag points to the brand indicator file over HTTPS. - BIMI participation requires DMARC enforcement with `p=quarantine` at `pct=100` or `p=reject`. - A BIMI record can exist while its logo or VMC certificate still needs attention. If the logo itself fails validation, see [Getting your logo BIMI-ready](#getting-your-logo-bimi-ready). - A public check does not prove the production sending path, delivered-message authentication result, continuous state, or a provider's private display decision. ## What this tool checks The [Palisade BIMI Checker](/tools/bimi) is a domain-level check for "Brand Display and Verified Checkmark (BIMI)." It normalizes a submitted domain, queries the public BIMI configuration, and can fetch and validate the referenced logo and certificate chain. It does not accept a logo file, SVG markup, or a standalone logo URL. BIMI belongs in the broader set of [sender-domain infrastructure controls](/learning/infrastructure) that depend on DNS and message authentication. The checker can return a public configuration result with a `pass`, `warn`, or `fail` status. Its defined result headlines are: - "Brand display and verified checkmark (BIMI) are certified" - "Brand display and verified checkmark (BIMI) are missing" - "Brand display and verified checkmark (BIMI) failed" - "Brand display and verified checkmark (BIMI) requirements are not met" - "Brand display and verified checkmark (BIMI) are not certified" - "VMC certificate expired" The checker can show the BIMI record, the `l=` logo location, the `a=` VMC location, and, when a logo URL is available, the certificate-validity date. A successful public result can also confirm that the logo was fetched and valid, the VMC chain was trusted, the logo matched the certificate, and the certificate covered the domain. That is still bounded evidence. The logo-validation response does not identify the exact SVG profile rule that failed. It also cannot prove that the application which sends production mail is using the intended From domain, that a receiver authenticated a delivered message, or that a particular provider will render the logo or verified checkmark. ![Palisade BIMI checker product overview](/images/editorial/bimi-logo-checker/bimi-logo-checker-shot-1.webp "1600x900") *Source: Palisade.* ## How to run the check ### 1. Start with the visible From domain Use the domain after `@` in the address recipients see in the From header. If different teams or systems send from different visible domains, check each domain separately. BIMI and DMARC decisions are tied to domains, so a parent company name or a sending platform hostname is not a substitute for the actual From domain. ### 2. Run the BIMI check Open the [Palisade BIMI Checker](/tools/bimi) and submit the domain. The checker accepts a domain even if you paste a URL or email address because it normalizes the value before scanning. Use the final domain value as your test record. You can independently query the public BIMI policy owner with this illustrative lookup: ```bash dig +short TXT default._bimi.yourdomain.com ``` The BIMI Internet-Draft specifies that domain-owner preferences are DNS TXT records beneath `_bimi`, with the default selector published at `default._bimi.example.com`. This is a public lookup only. It does not test a sent email. ![BIMI record components used by a domain-level checker](/images/editorial/bimi-logo-checker/bimi-logo-checker-records.webp "1200x533") *Source: Palisade.* ### 3. Preserve the result before changing DNS Copy the displayed headline, status, returned BIMI record, and technical-detail errors into the change ticket. If the card says "No BIMI record found," capture that fact with the domain and time of the lookup. If it displays `l=` and `a=`, retain those URLs as evidence without copying another organization's values into your own DNS. > Do not replace a BIMI record with an example from another domain. The logo URL, certificate URL, and certificate-domain relationship are account-specific. ## How to interpret the results ### Brand display and verified checkmark (BIMI) are certified This is the checker’s passing headline. A live check of `palisade.email` returned a BIMI record with both `l=` and `a=` values, a fetched valid logo, and a complete trusted VMC chain where the logo matched the certificate and the certificate covered the domain. Treat this as a strong public configuration result. Send a real message through the same production source and inspect its authentication evidence before claiming the full path is ready. [Email authentication](/learning/email-authentication) controls still determine whether the message can meet DMARC requirements. ### Brand display and verified checkmark (BIMI) are missing This is the headline for a missing BIMI record. Live checks of `google.com` and `example.com` returned this state, with no BIMI value, location, or assertion and the `bimi-no-record` error. Confirm the exact From domain first. Then query `default._bimi.yourdomain.com` directly and compare the result with the authoritative DNS zone. The checker’s technical guidance for this error says: "Create a BIMI record with a valid, trademarked SVG (version 1.2) logo and a VMC to display your logo in your client’s inbox and increase your brand’s visibility." The public result establishes that no BIMI record was found in that run. It does not establish why the record is absent or whether a DNS change has been approved. ### Brand display and verified checkmark (BIMI) failed This headline maps to the `bimi-invalid` state. It means the checker identified a BIMI configuration but did not validate it as required for a passing result. Review the raw record, `l=` value, `a=` value, and the technical details before changing anything. The BIMI Internet-Draft requires an `l=` tag containing one HTTPS URI for the Brand Indicator file. It marks the `a=` certificate URI optional. Keep that protocol rule separate from display expectations. An `a=` value can be absent under the draft, while the checker may present a self-assertion warning about the absence of a VMC. ### Brand display and verified checkmark (BIMI) requirements are not met This headline maps to `bimi-requirements-not-met`. One defined assessment is `bimi-requires-dmarc-enforcement`: "BIMI record requires DMARC enforcement. This means DMARC must have a reject (any pct value) or quarantine (pct=100%) policy." Repair DMARC enforcement before treating logo or certificate work as the next protocol threshold. The current BIMI Internet-Draft requires a strong DMARC policy on the organizational domain and the message's RFC5322.From domain. It says BIMI processing MUST NOT occur when either relevant DMARC policy is `p=none`. [RFC 9989's DMARC policy definition](https://www.rfc-editor.org/rfc/rfc9989.html) defines the available `p=` values as `none`, `quarantine`, and `reject`. ### Brand display and verified checkmark (BIMI) are not certified This headline maps to `bimi-uncertified`. The BIMI record may be present, but the result does not establish certification. Inspect whether the output provides a logo value without an `a=` value or identifies a certificate-related condition. Do not infer which mailbox providers will display a logo from this state alone because provider display behavior is outside the evidence returned by a public configuration check. ### VMC certificate expired This headline maps to `bimi-vmc-expired`. Check the VMC URL shown as `a=` and the date presented by the checker. A certificate replacement must be generated and approved through the responsible certificate and DNS workflow. Recheck the public record after the replacement is published, then validate an actual message path separately. ## How to act on the result Start with the earliest failed prerequisite shown by the evidence. - For a missing record, confirm the visible From domain, inspect `default._bimi.yourdomain.com`, and obtain the domain-specific record values from the organization responsible for the logo and certificate. - For an enforcement requirement, repair DMARC policy only after reviewing aggregate-report evidence and the sending sources that would be affected. DMARC enforcement can change delivery outcomes for unauthenticated mail. - For a logo validation issue, review the actual file at `l=`. [RFC 6170's certificate-image profile](https://www.rfc-editor.org/rfc/rfc6170.html) requires SVG Tiny 1.2 behavior, prohibits `script` elements, and prohibits external IRI references to information outside the image for specified content types. The checker may report that a logo is invalid without identifying the particular failed rule. - For a certificate condition, use the VMC owner’s current process to examine the `a=` resource and the domain relationship. Do not copy a certificate-chain URL from another tenant. - For a passing result, proceed to a delivered-message check and later aggregate-report review. A valid DNS and HTTPS configuration does not prove that every sender using the domain authenticates correctly. If the work is specifically about preparing an eligible SVG and its trademark relationship, use [the logo and trademark guidance below](#getting-your-logo-bimi-ready). For protocol context before a change, see [what BIMI is and how its record works](/learning/what-is-bimi). ## Getting your logo BIMI-ready A failed logo validation usually traces back to the file itself. BIMI accepts only a constrained SVG profile, and most exported logos need conversion, a trademark decision, and a stable hosting location before the record can pass. ### Convert the logo to SVG Tiny P/S BIMI requires SVG Tiny 1.2 restricted to the Portable/Secure profile. The root `` element must declare `baseProfile="tiny-ps"` and `version="1.2"`. The file must be square with a solid, opaque background, contain no scripts, hyperlinks, external references, or animation, include a `` element describing the logo, and stay small, well under 32 KB. Three conversion routes work: - [Palisade's BIMI SVG converter](/tools/bimi-svg-converter) converts an uploaded logo to the Tiny P/S profile directly. - In Adobe Illustrator, or the free Inkscape, convert text to outlines, center the mark on a square artboard with padding, add a solid background rectangle, and save as SVG using the SVG Tiny 1.2 profile. Then open the file in a text editor, remove metadata and any scripts or external references, add the `` element, and set `baseProfile` to `tiny-ps`. - Other web-based converters can transform simple logos directly in the browser, but they can mishandle gradients, fine detail, or text. Inspect the result and clean it up in a vector editor if needed. The BIMI Group also publishes [conversion tools](https://bimigroup.org/svg-conversion-tools-released/) for turning an SVG 1.2 file into the P/S profile. ![Five steps to convert a logo to SVG in Adobe Illustrator, from opening the file to saving as SVG.](/images/figures/how-to-convert-your-company-logo-to-svg-understanding-sv-fig1.webp "1200x800") *Source: Palisade.* ### Meet the trademark requirement A VMC is issued only against a registered trademark. Check the [WIPO Global Brand Database](https://www.wipo.int/branddb/en/) to confirm whether the logo is already registered, and search for conflicting marks before filing. Submit the application through the trademark office of your country, and confirm that country is recognized by the major VMC issuers before applying. Expect real cost and lead time. US filing runs $350 per class of goods or services since January 2025, roughly £200 in the UK, and about $250 AUD in Australia, with separate fees for each class. Registration typically takes roughly 12 months or more in the US, around 4 months in the UK, 5 to 6 months in the EU, and up to 18 to 24 months in India. Respond promptly if the trademark office contacts you, or the application can be abandoned. ### VMC or CMC? A Verified Mark Certificate requires the registered trademark and adds Gmail's blue verified checkmark beside the logo. Since September 2024, Gmail also accepts a Common Mark Certificate, which displays the logo without the checkmark and requires proof that the logo has been in public use for at least 12 months instead of a trademark. Choose based on whether you own a registered trademark and whether the checkmark matters to you. ### Host the file Host the finished SVG at a public HTTPS URL you control. A path on your own domain or CDN is ideal, so the file cannot be changed out from under you. The record's `l=` tag points to that URL, and `a=` points to the certificate. ### Common logo failures - The SVG validates in a browser but fails BIMI: a browser renders full SVG, while BIMI accepts only the Tiny P/S profile. The usual culprits are a missing `baseProfile="tiny-ps"`, a transparent background, an embedded raster image, or a stray script or hyperlink. - The converted file looks blurry or jagged: the converter embedded the raster image inside an SVG wrapper instead of tracing it into vector paths. Re-trace the logo with Illustrator's Image Trace or Inkscape's Trace Bitmap. - The file is far larger than expected: automated tracers can generate thousands of unnecessary anchor points. Simplify paths and remove hidden or off-canvas elements before exporting. - Text renders wrong on other systems: a missing font gets substituted. Convert text to outlines so the letterforms travel with the file as shapes. - The logo appears cropped or off-center: providers crop BIMI logos to a circle. Center the mark on a square canvas with even padding on all sides. - The logo stopped showing after it worked: certificates are typically valid for one year. When the certificate at `a=` lapses, the logo stops displaying, so set a renewal reminder well before expiry. ![Checklist of the requirements a BIMI SVG logo must meet before it is uploaded.](/images/figures/how-to-make-your-company-logo-bimi-compatible-fig2.webp "1200x639") *Source: Palisade.* ## How to retest Run the same domain through the BIMI Checker after the authoritative DNS answer and referenced HTTPS resources have changed. The expected result depends on the repair: - A missing record should change from "Brand display and verified checkmark (BIMI) are missing" to a result that shows the published record. - A corrected logo should produce a successful logo fetch and validation if the file meets the required profile. - A corrected certificate should update the displayed VMC validity information when the checker can validate the chain. - A DMARC repair should remove the enforcement prerequisite only after the relevant domains publish a qualifying policy. Then send a new message through the exact application, sender identity, gateway, and recipient path that matters. Inspect the delivered message's authentication results, and use DMARC aggregate reports once they have accumulated. Public DNS and certificate checks cannot replace either layer. ## Check the BIMI record before changing the logo If the evidence points to a missing record, expired VMC, or failed public validation, run the domain through the BIMI Checker and compare the returned `l=` and `a=` values with the approved domain configuration. [Check the BIMI domain configuration](/tools/bimi) The check can inspect public BIMI DNS, the referenced logo, and certificate-chain evidence. It does not repair DNS, identify every SVG-profile violation, monitor future changes, prove the production sending path, or guarantee inbox logo display. ## Sources and further reading - [Palisade BIMI Checker](/tools/bimi) - [Brand Indicators for Message Identification, draft-14](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/) - [BIMI Internet-Draft text, sections 4.3 and 7.1](https://www.ietf.org/archive/id/draft-brand-indicators-for-message-identification-14.txt) - [RFC 6170: Internet X.509 Public Key Infrastructure - Certificate Image](https://www.rfc-editor.org/rfc/rfc6170.html) - [RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance](https://www.rfc-editor.org/rfc/rfc9989.html) ## Frequently asked questions ### Does a BIMI logo checker accept an SVG file? No. The Palisade BIMI Checker accepts a domain and checks the public BIMI configuration associated with that domain. It can fetch the logo referenced by the record, but it does not provide a logo-file upload or SVG paste field. ### Is a VMC required in every BIMI record? No. The current BIMI Internet-Draft marks the `a=` certificate URI as optional. The `l=` URI for the Brand Indicator file is required. A missing VMC can still affect the checker’s certification result and any provider-specific display outcome. ### Does BIMI require DMARC enforcement? Yes. The BIMI Internet-Draft requires a strong DMARC policy, either `p=quarantine` with `pct=100` or `p=reject`, on the organizational domain and the message's RFC5322.From domain. BIMI processing MUST NOT occur if the relevant policy is `p=none`. ### Can a valid BIMI result prove my logo will appear in every inbox? No. A valid result proves public configuration evidence such as the BIMI record, logo fetch, and certificate validation where available. It cannot prove a mailbox provider's private display decision, the production sending path, or future message authentication. ### Where is the BIMI DNS record published? The default BIMI record is published as a TXT record at `default._bimi.yourdomain.com`. The domain-specific record must contain the correct values generated for that domain's logo and certificate arrangement.