How BIMI decides whether a logo appears
A domain publishes a TXT record at default._bimi.example.com such as v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem. The l= tag points to the logo and a= to a certificate that vouches for it. When mail from that domain arrives and passes DMARC, a participating mailbox provider fetches the record, validates both files and may show the logo where the sender's initials would otherwise be.
The last step is the provider's decision. BIMI is a request, and receivers also weigh sender reputation and their own rules. The checker answers a narrower question: is everything you control published correctly? A Ready result removes the technical causes of a missing logo. It cannot promise that a given inbox will display it.
The record lookup and the selector
The checker queries selector._bimi.yourdomain, using default when the selector box is empty, and keeps only TXT values that begin with v=BIMI1. If a subdomain has no record it tries the organizational domain, so mail.example.com falls back to example.com, and says so in the findings. No record at either name gives a Not set up status, and two BIMI records at one name is a failure.
A selector other than default only matters if your mail carries a BIMI-Selector header naming it. The record found is printed in full with a Copy button. An l= tag that is present but empty is read as a deliberate opt-out and reported as information. A missing l= tag is a failure, and both l= and a= must be https:// URLs.
Logo checks against SVG Tiny PS
BIMI logos use a restricted profile called SVG Tiny Portable/Secure. The checker downloads the file and confirms that the root element declares baseProfile="tiny-ps" and version="1.2", that a non-empty title element is present and that the file is 32 KB or smaller. It fails the logo for script elements, event-handler attributes, animation, foreignObject, embedded image elements and links to external URLs.
Three things are warnings only: a missing or non-square viewBox, a missing xmlns declaration, and a Content-Type other than image/svg+xml. If the URL returns anything but HTTP 200 or does not answer within eight seconds, the Logo tile reads Invalid and gives the reason. To test a file before you upload it, paste it into the BIMI Generator, which runs the same checks in your browser.
What the certificate inspection covers
When a= is present, the checker downloads the PEM file and reads the first certificate in it. It shows the type, issuer, organization and validity dates, then tests four things: the certificate has not expired, it carries the BIMI extended key usage, it contains an embedded logotype, and its subject alternative names include your domain or its organizational domain. The type comes from the mark named in the subject: Registered Mark or Government Mark means a VMC, Prior Use Mark or Modified Registered Mark a CMC.
The inspection stops at the certificate's own fields. It does not build the chain to a trusted root, and it does not compare the logo embedded in the certificate with the file at l=. A provider may refuse a certificate whose embedded logo differs from the published one, so keep the two identical.
Common failures and the limits of the check
Fix DMARC first, because nothing else matters until it is enforced. Move the policy to quarantine or reject at pct=100 once every legitimate source passes. The DMARC Checker shows the current record. SVG failures usually mean editing the root element of the file by hand.
Lookups use public resolvers and responses may be cached for up to five minutes, so a change made a moment ago may not show yet. The checker never sees your mail and cannot confirm that messages pass DMARC with alignment. Paste a delivered message into the Email Header Analyzer for that.
- No record found: publish the TXT at default._bimi, not at the domain root.
- Logo URL returns 404: the file must be public and served over HTTPS.
- Certificate names do not include the domain: have it reissued for the sending domain.
- Certificate expired: renew it and replace the file at the a= URL.