How do I validate BIMI records and fix common errors?
Updated on 22 Jul 2026: We updated this guide with current CMC support, stricter hosting checks, complete PEM chain validation, and clearer custom-selector guidance.
Validate BIMI by checking each dependency in order: enforced DMARC, the BIMI TXT record at the correct selector and domain, publicly reachable BIMI assets over HTTPS, a compliant SVG, and a matching VMC or CMC when the mailbox provider requires a certificate. Email headers are not the source of truth. Headers can show a receiver's BIMI result after delivery, but DNS, hosting, the SVG file, and the certificate should be validated first.
The shortest practical answer is this: if the visible From address is news@example.com, test the BIMI record for example.com. If the visible From address is offers@mail.example.com, test mail.example.com. The default DNS lookup is default._bimi under that From domain unless the message selects another published BIMI record.
BIMI depends on authentication quality, so start in Suped's product with DMARC monitoring before changing the logo. Suped shows whether legitimate sources pass DMARC through SPF or DKIM, then turns failures into concrete fix steps. A perfect BIMI TXT record still will not display a logo if DMARC is weak or legitimate mail fails authentication.
Validate in the right order
Treat BIMI validation as a dependency chain. Each layer must pass before the next layer tells you anything useful. A certificate error, for example, is easy to misread when the real issue is that the asset URL redirects, the server sends the wrong content type, or DMARC is still set to monitoring only.
- DMARC: Confirm that the From domain has a valid DMARC record with p=quarantine or p=reject, with pct=100.
- Domain: Validate the domain in the visible From address, not the hostname in the SVG URL.
- Record: Look up the selected record, usually default._bimi, and confirm that it has only one BIMI TXT value.
- Hosting: Fetch each referenced asset directly over HTTPS without authentication, access restrictions, or an invalid TLS chain.
- Logo: Validate the image as BIMI SVG Tiny Portable/Secure.
- Certificate: If the record has an a= tag, confirm the VMC or CMC is reachable, valid, complete, and tied to the domain and logo.
BIMI validation flow showing DMARC, DNS, SVG, certificate, and mailbox display checks.
For a quick authentication scan, use Suped's domain health checker to catch DMARC problems involving SPF or DKIM before spending time on the BIMI file itself.
Where the BIMI record lives
The BIMI TXT record lives at a selector under the domain used in the message's visible From header. Most senders use the default selector, so the DNS name is default._bimi.example.com for mail sent from example.com. If the actual From domain is a subdomain, validate the subdomain. Do not enter the BIMI hostname as the domain unless the validator explicitly asks for the full DNS name.
The input that validators expect
Most validators ask for the sending domain, then construct the default._bimi lookup themselves. If mail is sent from a client subdomain, enter that subdomain. If mail is sent from the root domain, enter the root domain.
A custom selector such as brand._bimi.example.com also needs the outgoing message to select it with BIMI-Selector: v=BIMI1; s=brand;. Without a valid selector header, receivers query the default record. Confirm that the header is covered by the message's DKIM signature so it cannot be changed in transit.
BIMI TXT exampledns
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; l=https://example.com/bimi.svg; " "a=https://example.com/vmc.pem" )
|
|
|
|---|---|---|
Root From | example.com | default |
Subdomain From | mail.example.com | default |
Custom selector | example.com | brand |
Use the domain in the visible From address when deciding what to validate.
Fixing DNS record errors
A valid BIMI record starts with v=BIMI1 and normally has an l= tag for the logo URL. The a= tag points to a VMC or CMC PEM file when used. Keep the DNS record simple: one TXT record, no extra BIMI versions, HTTPS URLs only, and no tracking or login redirects in the asset path.
Minimal BIMI recorddns
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; l=https://example.com/bimi.svg" )
BIMI record with certificatedns
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; l=https://example.com/bimi.svg; " "a=https://example.com/vmc.pem" )
Valid record
- Version: It starts with a single v=BIMI1 value.
- Logo: The l= URL uses HTTPS and returns the SVG directly.
- Certificate: The a= URL points to the final public PEM file when a VMC or CMC is used.
Broken record
- Duplicates: Two BIMI TXT records exist at the same DNS name.
- Redirects: An asset URL points through tracking, login, or unstable redirects.
- Syntax: The TXT value has copied punctuation, hidden characters, malformed tags, or incorrect version capitalization.
If DMARC itself is failing or unclear, check the From domain with the Suped DMARC checker before changing the BIMI record. BIMI troubleshooting goes faster when the authentication baseline is already clean.
Fixing DMARC policy blockers
BIMI requires DMARC enforcement. A domain at p=none is useful for reporting, but it is not enough for BIMI display. Use p=quarantine or p=reject with pct=100. Confirm that the organizational domain and any applicable subdomain policy are also enforcing rather than relying on a weaker inherited policy.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
Do not force DMARC too early
Move to enforcement after identifying which services send mail for the domain and confirming that SPF or DKIM matches the visible From domain. Suped's product groups legitimate senders, flags unverified sources, and shows the next fix instead of leaving the team with raw aggregate XML.
For teams that want BIMI without repeated DNS edits, Hosted DMARC in Suped can simplify policy staging. It keeps the DMARC rollout controlled while the BIMI project waits for the authentication layer to become eligible.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Once the DMARC record validates, compare the checker result with real aggregate data in Suped. A syntactically valid record is only the starting point; BIMI readiness also depends on legitimate mail passing after the policy is enforced.
Fixing SVG validation errors
The most common BIMI logo mistake is taking a PNG, placing it inside an SVG wrapper, and expecting it to pass. BIMI needs a true SVG file, not an embedded bitmap wearing an SVG extension. The file also needs the right profile, a square viewBox, a title element, no scripts, and no external references.
For a deeper logo checklist, compare the file against the BIMI SVG requirements before requesting or renewing a certificate. Fixing the logo after the certificate is issued often creates mismatch errors.
- Profile: Use SVG Tiny Portable/Secure requirements for BIMI, including version="1.2" and baseProfile="tiny-ps".
- Shape: Use a square canvas and square viewBox so receivers can fit the mark cleanly.
- Dimensions: For Gmail, specify absolute pixel width and height of at least 96 by 96 pixels.
- Vectors: Convert artwork to vector paths and remove embedded raster image data.
- Safety: Remove JavaScript, animation, remote fonts, external images, and unsupported elements.
Simple SVG starting pointxml
<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" width="512" height="512" viewBox="0 0 512 512"> <title>Example brand</title> <rect width="512" height="512" fill="#ffffff"/> <path d="M128 128h256v256H128z" fill="#222222"/> </svg>
The PNG wrapper failure
If a validator says the SVG did not pass the BIMI SVG specification, inspect the file source. A base64 image inside an SVG file is still a bitmap. Recreate the logo as vector art, then export a clean BIMI-specific SVG.
Fixing HTTPS hosting and fetch errors
A valid DNS record still fails when a mailbox provider cannot retrieve the referenced file. Test the exact l= and a= URLs as an unauthenticated visitor. Each URL should open over HTTPS with a trusted TLS certificate and return the intended file, not an HTML error page, login screen, or access challenge.
- Access: Remove authentication, bot challenges, hotlink protection, and geographic or IP restrictions.
- Response: Return a successful HTTP response and the file itself at the published URL, with no unstable redirect chain.
- Type: Send the SVG as image/svg+xml and publish the mark certificate as a PEM file rather than an HTML download page.
- TLS: Use a valid server certificate with a trusted chain and TLS 1.2 or later.
- Cache: When replacing a certificate, publish it at a new HTTPS URL and update a= so receivers do not keep an expired cached file.
Browser access does not prove receiver access
A file can load in a signed-in browser while failing for a mailbox provider. Retest without cookies and review server or CDN logs for blocked fetches after each BIMI validation attempt.
Fixing certificate errors
Certificate errors usually mean the PEM file is unreachable, the certificate is expired or revoked, the issuance chain is incomplete, the covered domain or selector does not match the BIMI record, or the certificate's embedded logo does not match the live SVG. A small logo edit after certificate issuance can cause the last failure.
Gmail accepts a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) for BIMI logo display. A VMC covers an eligible registered trademark or government mark and can produce Gmail's verification checkmark. A CMC provides a certificate path for an eligible logo without that trademark basis, but Gmail does not show the checkmark for CMC-backed mail. For the Google-specific path, read the VMC for Gmail guidance before assuming a self-asserted DNS record is enough.
Publish one PEM bundle in this order: the entity VMC or CMC first, followed by each intermediate certificate, with the root certificate optional. A PEM that omits an intermediate certificate can fail even when the entity certificate itself is current.
|
|
|
|---|---|---|
Invalid chain | Missing or misordered intermediate | Publish complete PEM chain |
Expired or revoked | Certificate no longer valid | Renew and use a new URL |
Logo mismatch | Hosted SVG changed | Restore certified SVG |
Domain mismatch | Domain or selector not covered | Check certificate evidence |
Fetch failure | HTTPS or access blocked | Fix public hosting |
Certificate errors are easiest to fix when each message is mapped to one failing layer.
Logo lock rule
Treat the certified SVG as locked. If the logo changes, validate the new SVG first, then update the certificate and BIMI TXT record together. Do not swap the hosted logo file behind the same URL after certification.
Validate with a real email
After DNS, DMARC, hosting, SVG, and certificate checks pass, send a real message to the mailbox provider you care about. BIMI is receiver-enforced, so a generic DNS pass does not guarantee logo display everywhere. Receivers cache results, apply their own trust checks, and decide whether the sender's reputation is good enough to show the logo.
Headers can help, but they are not consistent across providers. Some authentication results include a BIMI result. Others omit BIMI details even when the DNS record exists. When a header shows a BIMI failure, use it as a clue. When it shows nothing, go back to the validation chain instead of assuming BIMI is absent.
Live test checklist
- Recipient: Test with the mailbox provider where the logo needs to appear.
- Message: Send normal production-style mail, not a stripped-down test message.
- Headers: Inspect authentication results, DMARC pass status, the evaluated From domain, and any BIMI selector.
- Cache: Allow receiver caching time after DNS, SVG, or certificate changes.
Common errors and fixes
When BIMI fails, the error message usually points at the layer, not the exact repair. Map the message to DNS, DMARC, SVG, hosting, or certificate evidence, then fix only that layer and retest. Changing several things at once makes it harder to know which fix worked.
|
|
|
|---|---|---|
No record | DNS | Check domain and selector |
Fetch failed | Hosting | Fix HTTPS access |
Bad SVG | Logo | Export clean SVG |
Not square | Logo | Fix dimensions and viewBox |
Logo mismatch | Certificate | Match certified file |
DMARC weak | Policy | Enforce at 100 percent |
Use this table to move from validator message to likely repair.
How Suped fits into a BIMI rollout
Suped is our DMARC reporting and email authentication platform. It handles the authentication work that BIMI depends on. BIMI itself is a DNS, SVG, hosting, and certificate project, but the project succeeds only when the domain has reliable email authentication and a controlled path to enforcement.
What BIMI needs
- Policy: Enforced DMARC on the visible From domain.
- Sources: Legitimate senders passing DMARC through SPF or DKIM.
- Stability: Fewer surprise authentication failures after enforcement.
What Suped adds
- Detection: Automated authentication issue detection with fix steps.
- Alerts: Notifications when authentication failures cross a threshold.
- Scale: Multi-tenant views for agencies and managed service providers.
For a BIMI rollout, Suped can verify DMARC, monitor authentication changes, manage policy staging, keep SPF within lookup limits, and flag reputation issues that can affect mailbox display. That gives the logo work a stable base and helps separate authentication failures from DNS, hosting, or receiver-side evaluation.
Views from the trenches
Best practices
Validate the exact From domain before testing selectors, logos, or certificate evidence.
Keep the BIMI SVG as clean vector art with a square viewBox and no embedded bitmap.
Move DMARC to quarantine or reject only after reports show legitimate mail passing.
Common pitfalls
Uploading a PNG inside an SVG wrapper fails because BIMI needs real SVG vector content.
Testing the root domain while sending from a subdomain hides the record lookup problem.
Buying a certificate before the logo file is final creates certificate logo mismatch errors.
Expert tips
Test DNS, hosting, SVG, certificate, and mailbox rendering so the failing layer is clear.
Use a short TTL during launch, then increase it after the receiver logo checks pass.
Treat mailbox display as the final check because receivers cache BIMI results aggressively.
Marketer from Email Geeks says BIMI validation should use the domain in the visible From address, then resolve the default selector under that domain.
2020-08-04 - Email Geeks
Marketer from Email Geeks says the common SVG failure is a PNG placed inside an SVG container instead of true vector artwork.
2020-08-04 - Email Geeks
A practical validation path
The cleanest way to validate BIMI is to stop treating it as one record. It is a chain. Check DMARC enforcement, then the selector lookup, public HTTPS hosting, the SVG, the VMC or CMC, and a real mailbox display test. If one layer fails, fix that layer and retest before moving on.
The errors in this area sound more mysterious than they are. An invalid certificate usually means a fetch, chain, evidence, expiry, revocation, or logo mismatch problem. An SVG specification failure usually means the file is not a true BIMI-safe vector SVG. A missing logo in the inbox usually means DMARC, provider policy, cache timing, or sender reputation still needs attention.
Suped's product gives the BIMI rollout an authentication base through DMARC monitoring, hosted policy controls, SPF and DKIM visibility, alerts, and clear fix steps. Once those pieces are in good shape, BIMI validation becomes a focused DNS, hosting, SVG, and certificate task instead of a guessing exercise.
