Skip to content
Inspect My DNS

Mail authentication

BIMI

mailauth.bimi

Informational — BIMI affects how mail is displayed, not whether it is delivered.

What this check measures

BIMI publishes a TXT record — normally at default._bimi.<domain> — pointing at a logo, and supporting mailbox providers show that logo beside authenticated mail from your domain. This check reports the record where one is present. It is display metadata: it has no effect on whether anything is delivered.

It is strictly downstream of DMARC. A BIMI record does nothing unless the domain publishes a DMARC policy of quarantine or reject with enforcement actually applied, because the entire premise is that the logo is a visual claim about a message that has already been authenticated. BIMI over p=none is a record no client will act on.

The remaining requirements are where the cost sits. The logo has to be SVG in the Tiny Portable/Secure profile — a deliberately restricted subset, not whatever a designer exports — and most of the large mailbox providers additionally require a Verified Mark Certificate, an annual paid credential attesting that you hold the trademark on the mark. A Common Mark Certificate is the cheaper variant for logos without a registered trademark, accepted by a smaller set of providers.

How to fix it

Get DMARC to enforcement first and leave it there long enough to be confident. Everything else here is wasted effort until that is true, and moving to enforcement is the part with real deliverability consequences.

Convert the logo to SVG Tiny P/S and validate it rather than assuming: square aspect ratio, no external references, no scripting. The profile rejects most exports, and the failure mode is a record that parses perfectly and a logo that never appears.

Decide whether a VMC is worth it before starting. The certificate is the slow, expensive part and it requires a registered trademark; without one, a CMC reaches a subset of providers. Neither improves delivery — this is a brand decision, not a deliverability one.

References

Run this check on a domain

BIMI is one of 56 checks in every report, alongside delegation, mail authentication, TLS and registration.