BIMI logo, record and certificate checks

1. BIMI Record overview

This row in your DNSprobe report shows the detected BIMI TXT record, basic information about the logo file and a summary of the main checks that were performed.

Why BIMI matters

BIMI does not directly affect deliverability, but it can significantly improve brand visibility and user trust when recipients see your verified logo in their inbox.

How to read this block

Check that the v=BIMI1 tag is present, that the l= URL points to the logo you expect and that any a= entry references a valid certificate location. The surrounding checks indicate whether the logo and certificate meet BIMI requirements.

Best practices at a glance

• Publish exactly one BIMI record at default._bimi for each domain you want to use with BIMI.
• Keep the logo URL stable and under a domain you control, ideally the same one used for your website.
• Align BIMI deployment with your DMARC strategy so that you meet policy requirements before investing in certificates.

2. Logo Delivery Checks (HTTPS, accessibility, size)

These checks verify that your BIMI logo can be downloaded reliably over HTTPS and that it falls within the recommended size limits.

Why logo delivery is important

Mailbox providers must be able to fetch your logo quickly and securely. If the URL is broken, returns an error or serves a very large file, your BIMI logo may not be displayed.

How DNSprobe tests logo delivery

DNSprobe performs an HTTPS request to the l= URL, checks that it returns HTTP 200, records the file size and flags any obvious delivery problems such as redirects to HTTP or unreachable hosts.

Best practices for hosting the BIMI logo

• Serve the logo over HTTPS from a stable, well-performing web server.
• Keep the SVG file reasonably small (for example under 32 KB) to minimise load times.
• Avoid complex redirects or geo-routing rules that could prevent some providers from fetching the logo.

3. BIMI Record and SVG Image Format

The BIMI TXT record ties your domain to a specific SVG logo file and optionally to a Verified Mark Certificate.

Why the BIMI record and SVG format matter

Mailbox providers will ignore BIMI if the record is missing, malformed or if the SVG logo does not comply with the strict SVG Tiny 1.2 profile required by the standard.

How DNSprobe validates the BIMI record

DNSprobe parses the BIMI TXT string, checks the v= value, extracts the l= logo URL and verifies that the SVG is of the correct MIME type, version and baseProfile (Tiny 1.2). Any mismatch is reported in the BIMI section.

Best practices for BIMI TXT and SVG

• Use v=BIMI1 and ensure the logo is an SVG Tiny 1.2 file with a simple, square design that scales well at small sizes.
• Avoid embedded raster images, scripts or unnecessary metadata inside the SVG.
• Test your BIMI record after each change to confirm the logo still passes all format checks.

4. BIMI Certificate and DMARC requirements

Many mailbox providers require both a strong DMARC policy and a Verified Mark Certificate (VMC) or Certified Mark Certificate (CMC) before they will display your BIMI logo.

Why certificates and DMARC enforcement are required

The certificate proves that you are legally entitled to use the logo for the brand in question, while DMARC enforcement protects recipients from spoofed messages using your domain.

How DNSprobe checks BIMI certificate and DMARC

DNSprobe verifies that a DMARC record exists with a policy of quarantine or reject and, if your BIMI record references a certificate in the a= tag, attempts to download and parse it to confirm that it looks like a valid PEM-encoded certificate.

Best practices for BIMI certificates

• Work with an approved CA that issues VMC/CMC certificates for BIMI and follow their identity verification process.
• Ensure your DMARC policy is set to at least quarantine (and ideally reject) at 100% before deploying BIMI.
• Keep your certificate renewed and update the a= URL promptly if you move it to a new location.

5. Logo Preview and BIMI Evaluation Score

At the bottom of the BIMI section, DNSprobe shows a small preview of your logo, a BIMI Evaluation Score and actionable suggestions to improve your configuration.

What the BIMI score tells you

The score summarises whether your logo is reachable, correctly formatted, protected by DMARC and backed by a valid certificate where required.

How DNSprobe computes the BIMI score

DNSprobe combines the results of delivery checks, SVG validation, BIMI record syntax, DMARC policy and certificate status to assign a score and list the key issues preventing full BIMI compliance.

How to use the BIMI score

• Use the score and the detailed messages as a checklist when working with your brand and security teams.
• Address SVG format and delivery problems first, then focus on DMARC and certificate requirements.
• Re-run DNSprobe after each change until your BIMI score reflects the level of deployment you are aiming for.

6. BIMI tags and possible values

This reference table summarises the tags used in a BIMI TXT record and explains what each of them controls.

Some mailbox providers may ignore BIMI records that do not include a certificate or an enforcement DMARC policy, even if the logo itself is valid.

A basic BIMI record without certificate might look like:
v=BIMI1; l=https://example.com/bimi/logo.svg

A BIMI record using a Verified Mark Certificate (VMC) might look like:
v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem

7. Test BIMI records and logo delivery manually from your own terminal

The BIMI section in DNSprobe checks whether a BIMI TXT record is published, verifies logo delivery over HTTPS, inspects the SVG file and, if present, validates the BIMI certificate. You can reproduce the basic TXT lookups and logo delivery checks yourself from a terminal.

Linux: using dig and curl

On most Linux distributions, the dig and curl tools are available in the default repositories. The commands below query the BIMI TXT record (usually default._bimi.example.com), then test whether the logo URL returned in the l= tag is reachable over HTTPS and can be downloaded:

                dig default._bimi.example.com TXT
                dig default._bimi.example.com TXT +short
    
                # Copy the l= URL from the TXT record output; this should point to your BIMI SVG logo over HTTPS    
                curl -I https://example.com/path/to/logo.svg
    
                # First check that the logo URL returns HTTP 200 over HTTPS, then download the file locally for further inspection (size, SVG Tiny 1.2, etc.)    
                curl -L -o logo.svg https://example.com/path/to/logo.svg
        

macOS: using dig and curl from the built-in tools

macOS ships with dig and curl as part of its standard command-line tools. Open Terminal and run the same commands as on Linux to retrieve the BIMI TXT record and test HTTPS delivery of the SVG logo referenced by the l= tag:

                dig default._bimi.example.com TXT
                dig default._bimi.example.com TXT +short
    
                # Copy the l= URL from the TXT record output; this should point to your BIMI SVG logo over HTTPS    
                curl -I https://example.com/path/to/logo.svg
    
                # First check that the logo URL returns HTTP 200 over HTTPS, then download the file locally for further inspection (size, SVG Tiny 1.2, etc.)    
                curl -L -o logo.svg https://example.com/path/to/logo.svg
        

Windows: using nslookup and curl

On Windows, the legacy nslookup tool can query TXT records, and modern versions of Windows 10/11 include curl. From a Command Prompt or PowerShell window, you can retrieve the BIMI TXT record and test the HTTPS logo URL from the l= tag:

                nslookup -type=TXT default._bimi.example.com
    
                REM Note the l= URL from the TXT record; it should reference your BIMI SVG logo over HTTPS    
                curl -I https://example.com/path/to/logo.svg
    
                REM Use curl to verify that the logo URL returns HTTP 200 over HTTPS, then download the SVG file so you can review its size and format    
                curl -L -o logo.svg https://example.com/path/to/logo.svg
        

Important: only query BIMI records and download logos for domains that you own or are authorised to analyse. Repeated automated checks against third-party domains without permission may be treated as abusive traffic by some providers.