Check a BIMI record, its logo and certificate links, and whether DMARC is strict enough
Runs in your browser. Only the lookup you start is sent to cloudflare-dns.com or dns.google; nothing else leaves your device. Updated on 24 Oct 2026.A BIMI lookup reads the TXT record at default._bimi followed by a domain, which points mail programs at the brand's SVG logo and its certificate. BIMI works only when DMARC is at quarantine or reject, with pct at 100 and no sp=none, on both the domain and its organisational domain.
Type the domain in Domain and press Check BIMI.
Read the record at default._bimi, with its Logo (l=) and Certificate (a=) links.
Read DMARC record used to see whether its policy is strict enough for BIMI.
Open the logo link to view it in a new tab; it is not loaded into this page.
BIMI, Brand Indicators for Message Identification, lets a domain show its logo next to its mail in the inbox. The domain publishes a TXT record at default._bimi. followed by its name, with v=BIMI1, an l= address for the logo and an optional a= address for a certificate, called a VMC or CMC, that proves the logo belongs to the brand.
Type a domain and the page asks a public DNS-over-HTTPS resolver for that record and reads its tags. An empty l= and a= is shown as what it is: the domain declining to show a logo. An address that is not https://, or more than one address in a tag, is flagged, because mail programs will not fetch it.
BIMI depends on DMARC, so the page also reads the domain's DMARC record and checks the conditions the BIMI draft sets: a policy of quarantine or reject at the domain and at its organisational domain, no pct below 100 with quarantine, and no sp=none. A t=y test-mode tag is treated as short of enforcement, because RFC 9989 asks receivers to apply one step less while it is set. Missing enforcement is the most common reason a logo never appears.
The logo and certificate are shown as links you can open, not loaded into this page. An SVG chosen by someone else is not something to run inside a tool page, and opening it in its own tab is enough to see it.
BIMI is still an Internet-Draft at the IETF, draft-brand-indicators-for-message-identification-14 of May 2026, not an RFC. The BIMI Group at bimigroup.org keeps the implementation guide and the list of mailbox providers that show logos. Several of them, Gmail among them, show a logo only with a certificate.
What it does not do: it does not validate the SVG profile or the certificate chain.
The domain you type is sent to the resolver you pick, because a lookup needs it. Nothing else leaves your device.
The usual causes, in order: DMARC is at p=none or has pct below 100, so BIMI is not allowed; the mailbox provider needs a VMC or CMC certificate in the a= tag and there is none; or the SVG is not in the SVG Tiny PS profile. This page checks the first two.
Either quarantine or reject is enough. The BIMI draft requires an enforcing DMARC policy on both the sending domain and its organisational domain, with no pct below 100 on a quarantine policy and no sp=none. A domain still at p=none cannot show a logo.
A Verified Mark Certificate is issued by a certificate authority after checking that the logo is a registered trademark of the domain owner. A Common Mark Certificate is a lighter version. Several large providers, Gmail among them, show a BIMI logo only when one of these is published in the a= tag.
An SVG file can contain scripts and links, and the logo address is chosen by whoever owns the domain. Loading it into a tool page would mean running someone else's file here. Opening the link shows the same logo in its own tab, which is safer.
The domain goes to the public DNS resolver you pick, Cloudflare or Google, so it can look up the BIMI and DMARC records. The resolver sees the names asked and your IP address. The logo is not fetched, nothing else leaves your device, and nothing is stored on this site.
Still stuck? Ask about BIMI Lookup and anybody who knows can answer. No account needed.
Same job, other tools: DMARC Record Generator – Build a DMARC record step by step, from p=none reporting to p=reject · SPF Record Generator – Write an SPF record for your mail providers and see how many lookups it uses.
On the related tools: Find the Sender IP of an Email – Paste the headers of an email to find the IP address of the server that sent it.