BIMI checker: a valid record is not the same as a logo in the inbox.
A BIMI record is a TXT record at default._bimi.yourdomain.com that points to your logo and, for Gmail and Apple Mail, to a mark certificate. Mailbox providers show the logo only when DMARC is at quarantine or reject and the logo and certificate check out. This checks the record, and then those conditions.
It is a reward for finishing, not a way to start.
BIMI requires DMARC at quarantine or reject before any provider will display a logo. If you are at p=none — which most domains are — then BIMI is not your next project, whatever a vendor told you. Getting to enforcement is, and BIMI becomes available as a side effect.
The second cost is the Verified Mark Certificate. Gmail and Apple Mail both require one, it is issued against a registered trademark, and it is the slow and expensive part of the project. Budget for it before you commit to a date.
Frequently asked questions.
Not for every mailbox provider, but Gmail and Apple Mail require one before they display your logo. The checker reports only whether your BIMI record references a VMC, not whether that certificate itself is valid or currently active.
The logo must be an SVG in the restricted SVG Tiny Portable/Secure (SVG Tiny P/S) profile, not a standard SVG, PNG, or JPG export. The checker fetches your logo over HTTPS and validates it against that profile; file size should stay under 64 KB.
Both must be served over HTTPS at the URL your BIMI record references, kept available indefinitely. Managed hosting on the Growth plan and above serves the logo and certificate for you; otherwise you need your own HTTPS hosting.
Yes. Your DMARC policy must be at p=quarantine or p=reject, not p=none, before mailbox providers will display a BIMI logo. Check your DMARC policy first if the logo is not displaying.
For the full walkthrough, see the BIMI setup guide.
DMARC Report Analyzer
Paste or upload a DMARC aggregate (RUA) report and see total volume, pass/fail rates, and which senders are failing. Runs in your browser.
DMARC Record Generator
Create a valid DMARC record for your domain. Configure policy, reporting emails, and advanced options.
SPF Record Generator
Build an SPF record to authorize your email senders. Includes common services and DNS lookup counter.
DKIM Key and Record Generator
Generate a DKIM key pair in your browser and get the TXT record to publish. The private key never leaves your device.
MTA-STS Record and Policy Generator
Build the _mta-sts TXT record and the mta-sts.txt policy file together, with MX patterns and max_age checked.
TLS-RPT Record Generator
Build the _smtp._tls record that asks senders to report failed TLS connections, with email and https destinations checked.
SPF Checker
Look up a domain's SPF record, walk every include, and count DNS lookups against the limit of 10.
Domain Checker
Check your domain's email authentication setup. See your SPF, DKIM, DMARC, and MTA-STS configuration.
DMARC Checker
Look up any domain's DMARC record and get every tag explained — policy, alignment, reporting, and coverage.
DKIM Checker
Check a domain's DKIM record by selector. See the key type, size, and each tag, with quick-picks for common providers.
MTA-STS & TLS-RPT Checker
Check a domain's MTA-STS policy record and TLS-RPT reporting — the pair that forces inbound mail over TLS.
Enforcement first. The logo follows.
If your DMARC record is at p=none, that is the thing standing between you and a logo — and fixing it is worth doing whether or not you ever publish BIMI. Getting to enforcement starts with reading the reports, and Monitor collects them free for 2 domains.