BIMI checker: will inboxes show your logo?

What BIMI needs

1. DMARC at enforcement. p=quarantine or p=reject, at 100 percent, for the domain and its organizational domain, with sp not set to none. This is the hard part: get there without blocking your own invoices and password resets.
2. A logo in SVG Tiny PS. A strict SVG profile (draft-svg-tiny-ps): version 1.2, baseProfile “tiny-ps”, a title, no scripts, raster images or external references. Square, solid background, under 32 KB (Gmail, BIMI Group).
3. HTTPS hosting. The file served with HTTP 200 and image/svg+xml, without redirects and without bot challenges that stop inbox fetchers.
4. The BIMI record. A TXT record at default._bimi.yourdomain: v=BIMI1; l=logo URL; a=certificate URL (BIMI draft).
5. A mark certificate. Gmail shows logos only with a VMC or CMC, Apple Mail with a VMC. Yahoo needs no certificate but shows logos only for bulk senders with good reputation.

VMC or CMC?

A Verified Mark Certificate (VMC) requires a registered trademark and brings Gmail’s blue checkmark. A Common Mark Certificate (CMC) needs no trademark: the logo must have been shown on your website for at least 12 months, proven through a web archive. Gmail shows logos with both, Apple Mail only with a VMC. Certificates come from a few issuers (list by the BIMI Group), and the logo embedded in the certificate must be the same file you serve at l=.

Less-known BIMI quirks

• Your logo can override personal photos. The avp tag sets what wins when a sender has their own profile photo. Without it the record counts as avp=brand, so the company logo wins. With avp=personal the inbox should show the person’s photo and fall back to the logo when there is none (BIMI Group). Useful for sales teams. No major inbox documents support for it yet, so test before you rely on it.
• Different logos per mailbox, one domain. The lps tag lists address prefixes, for example lps=support,billing. Mail from support@ gets a second lookup at support._bimi.yourdomain and can show its own logo. The inbox drops a +suffix, turns dots and underscores into hyphens and ignores case. No matching prefix or no record there means the main record applies (BIMI Group, BIMI draft). Inboxes that do not support lps ignore it.
• Opting out is not the same as having no record. A record with empty l= and empty a= is an explicit refusal. Inboxes record bimi=declined and show no logo. Without any record, a subdomain inherits the logo of its organizational domain, so an empty record is how you switch BIMI off for one subdomain, such as a test or partner mail host (BIMI draft).
• Subdomains inherit, policies too. With no record at mail.yourdomain, inboxes look up the same selector at yourdomain. The DMARC side works the same way: sp=none on the organizational domain, or p=quarantine with pct below 100, blocks the logo on every subdomain.
• Two records cancel each other. Two TXT records at the same name, often left after a DNS migration or a second vendor, do not mean “pick one”. BIMI processing stops and no logo is shown.
• A custom selector needs a signed header. Any selector other than default comes from the BIMI-Selector header in the message. That header must be covered by the DMARC-aligned DKIM signature, or inboxes ignore it and use default (BIMI draft). Senders must not add BIMI-Location or BIMI-Indicator: inboxes strip them and add their own.
• The logo can live only in the certificate. Google’s own example publishes l= empty and only a= with the certificate, because the VMC or CMC carries the logo. Gmail accepts that, but the draft and inboxes without certificate checks, such as Yahoo, need the logo URL. Publishing both is the safe choice, and this checker validates the certificate logo when l= is empty.
• BIMI is still a draft. BIMI is an individual Internet-Draft, not an RFC: version 14 dated 1 May 2026 (BIMI draft). Gmail, Apple Mail and Yahoo implement it, but each adds its own rules, so their documentation beats the draft when they differ.

What this checker validates

• Record: exactly one, v=BIMI1 first, HTTPS l= and a=, logo only in the certificate, avp, lps, unknown tags, organizational-domain fallback, opt-out records.
• DMARC: policy, pct, sp and the organizational domain.
• Hosting: HTTP status, Content-Type, redirects, different answers to browsers and bots, speed.
• SVG Tiny PS: XML, profile and version, title and desc, forbidden elements (script, image, style, animation, links), event attributes, external references, root x/y, fixed-value attributes, preserveAspectRatio, size, square viewBox, minimum size, colors, background, text instead of outlines.
• Rendered in your browser: transparent corners and artwork outside the circle crop.
• Certificate: PEM, dates, domain, BIMI key usage, embedded logo and whether it matches l=, SCTs, CRL, chain order, VMC or CMC, mark type and issuer.

How I found Cloudflare’s broken BIMI

In September 2026 a BIMI check in a product I work on flagged cloudflare.com. The logo file was 44,212 bytes, well over the 32 KB limit; the bloat came from an Adobe Illustrator export. Looking closer, it was not a Tiny PS file at all: version 1.1, no baseProfile, a CSS style block and a viewBox of 199.98 × 90.58, nowhere near square.

As of 17 October 2026 this checker still sees the same file. The twist: Cloudflare’s VMC itself embeds a correct 200 × 200 Tiny PS logo of 1,377 bytes. Serving that exact file at l= would fix it. Run the check below and you can download that logo from the certificate yourself.

Check cloudflare.com

Questions

Does BIMI improve deliverability?

Not by itself. What helps is what BIMI requires: DMARC at enforcement with aligned SPF and DKIM. The logo is the visible reward and makes spoofed mail easier to spot. Clean the list before a campaign with List Desk.

Everything passes, but Gmail shows no logo. Why?

Gmail needs a VMC or CMC and may take up to 48 hours to pick up changes. Your mail must pass DMARC on the actual message, and very low volume or poor reputation can keep logos hidden.

Can I use my PNG logo?

No. BIMI accepts only SVG Tiny PS. A PNG has to be redrawn as vector shapes, then checked against the profile. Automatic tracing usually needs a human pass.

Why must the logo be square with a solid background?

Inboxes show it in a circle or a rounded square at small sizes. A wide logo gets shrunk to a sliver, and a transparent one picks up the inbox color, which breaks in dark mode.

Do you store domains or files?

No. The worker reads public DNS and downloads the logo and certificate the same way an inbox would, then returns the result. Uploaded files never leave your browser. Analytics count checks, not domains.

Which inboxes support BIMI?

Gmail, Apple Mail, and Yahoo with AOL are the big ones, plus some regional providers. Microsoft Outlook does not, according to email vendors.

Will BIMI replace my salespeople’s profile photos?

It can. Without the avp tag the record counts as avp=brand, so the company logo wins over a personal photo where the inbox supports both. Add avp=personal to ask inboxes to keep personal photos and show the logo only when there is none ([BIMI Group](https://bimigroup.org/understanding-the-avp-tag-in-bimi-records/)). Support is not documented by Gmail, Apple or Yahoo yet, so check with a real message.

Can support, billing and newsletters show different logos?

Yes, two ways. Send each stream from its own subdomain with its own record, which every BIMI inbox understands. Or add lps=support,billing to the main record and publish support._bimi and billing._bimi records, which only inboxes that implement lps follow. Each logo still needs its own certificate for Gmail.

How do I switch BIMI off for one subdomain?

Publish v=BIMI1; l=; a=; at default._bimi.that-subdomain. Deleting the record is not enough, because subdomains without one inherit the organizational domain’s logo.

Do I need a separate record for every subdomain?

No. Inboxes fall back to the record at the organizational domain. The certificate must cover the sending domain, and DMARC must enforce on subdomains too, so no sp=none.

Is BIMI an official standard?

Not yet. It is an individual Internet-Draft, version 14 from May 2026, not an RFC ([BIMI draft](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/)). The big inboxes implement it anyway, each with its own extra rules, such as Gmail’s certificate requirement.