Is Your BIMI Record Actually Valid?

Check your BIMI record

Enter a domain below. The checker reads the live TXT record at default._bimi + your domain over encrypted DNS and tells you whether it parses as a valid BIMI record.

Record broken or missing? Have a specialist double-check it — the $49 Email Domain Trust Audit is a fixed-output report with risk notes and prioritized next steps.

What the checker looks for

1. A TXT record at default._bimi + your domain (for example default._bimi.example.com) — not at the domain root.
2. The v=BIMI1 version tag — a record that doesn't start with it is ignored by mailbox providers.
3. The l= logo tag — must be an https:// address for your SVG logo; HTTP fails the check.
4. The a= VMC tag — reported as a note: Gmail requires a Verified Mark Certificate for logo display, other providers may not.

No record found?

Build one in seconds with the Free BIMI Record Generator — your HTTPS SVG logo, optional VMC, and copy-ready record published at default._bimi + your domain. Re-run this checker after DNS propagates.

BIMI sits on top of the full authentication stack — it only displays once SPF, DKIM, and an enforced DMARC are all in place. Run the Free Email Domain Trust Checker to confirm your domain reads enforced before you wait on the logo.

Verify the rest of the set

BIMI is the fourth leg. Generate or verify the rest of the authentication set, free, in your browser:

• Free SPF Record Generator
• Free DKIM Record Generator
• Free DKIM Record Checker
• Free DMARC Record Generator
• Free DMARC Record Checker
• Free MTA-STS Record Generator
• Free MX Record Checker
• Free Email Domain Trust Checker
• Free Email Header Analyzer

Prefer done-for-you?

If you'd rather hand this to a specialist, submit your domain for the Email Domain Trust Audit — a fixed-output report with risk notes and prioritized next steps. When records are broken and you want them fixed, the 99 Mailbox Rescue gets them fixed within 48 hours, zero tech touch.

Frequently asked questions

What does the BIMI checker look up? The checker queries the live TXT record at default._bimi.yourdomain over DNS (via encrypted DNS-over-HTTPS), then parses the v=BIMI1 record it finds. It reports whether the record exists, whether the version tag is correct, whether the l= logo URL is a valid HTTPS address, and whether an a= Verified Mark Certificate tag is present.

Why does the checker mention DMARC enforcement? BIMI is gated on DMARC enforcement: mailbox providers only display your logo once your DMARC policy is p=quarantine or p=reject with SPF and DKIM aligned and passing. A perfectly valid BIMI record at p=none (monitoring only) will not display a logo anywhere.

My logo URL is HTTP, not HTTPS — does it matter? Yes — BIMI requires the l= tag to point at an HTTPS URL serving the logo SVG. An http:// logo URL fails the check and mailbox providers will not fetch it. Move the logo to HTTPS and update the record.

Do I need a VMC to pass the check? No — the record is valid without one. The a= tag (Verified Mark Certificate) is reported as a note, not a failure: Gmail requires a VMC before it displays your logo, while other mailbox providers may display it without one. You can publish without a VMC and add the certificate later.

No record found — what do I do? Publish one: use the free BIMI record generator to build a v=BIMI1 TXT record from your HTTPS SVG logo URL, publish it as a TXT record at default._bimi.yourdomain, and re-run the checker after DNS propagates (minutes to hours).