Free email-authentication toolkit
Enter a domain to fetch its BIMI record over DNS-over-HTTPS and see whether the logo will actually be displayed — not just whether the record parses. The DMARC policy (p=quarantine or p=reject) and whether a certificate is declared are both checked. No signup, no backend: everything runs right here in your browser.
Enter a domain to look up its BIMI record. Leave Selector blank to use the standard default selector.
Checked at exactly this name — there is no organisational-domain fallback, so a subdomain is reported on its own.
The basics, briefly
BIMI (Brand Indicators for Message Identification) lets a domain publish a logo that supporting mailbox providers display next to authenticated email. The record is a DNS TXT record at selector._bimi.yourdomain.com pointing to an https:// SVG logo, and optionally a certificate that proves ownership of the mark.
BIMI requires DMARC to be enforced — p=quarantine or p=reject — at the domain the mail is sent from. A record published under a monitoring-only p=none policy will never trigger a logo, no matter how well-formed it is. Gmail and Apple Mail also require a certificate in the a= tag — for Gmail, a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). Other mailbox providers set their own rules.
It checks that the record parses, that the required v= and l= tags are present and well-formed, that the DMARC policy is p=quarantine or p=reject, and whether an a= certificate address is declared. It does not read the DMARC pct= tag, which Gmail requires to be 100. It cannot verify that a certificate is valid or that the logo meets the SVG Tiny Portable/Secure profile mailbox providers require — neither can be checked from a browser. Your certificate issuer confirms both.