BIMI Validation
BIMI puts your logo beside your messages in Gmail, Apple Mail, and Yahoo - but only when the record, the SVG, the certificate, and your DMARC policy all line up exactly.
BIMI is the rare security standard with a visible reward: your logo, beside every message, in the inboxes of the world's biggest mail providers. But it is also unforgiving. The DNS record must be syntactically correct, the logo must be a strictly profiled SVG, the mark certificate must be valid, and your DMARC policy must be at enforcement. Any one link fails and the logo silently does not appear - with no error message from anyone.
DNS Watchdog validates the full chain, continuously and on demand. Every domain in your inventory publishing a BIMI record is discovered automatically and validated during scans, and a live validator tool lets you re-check instantly while you work on the setup. Results are organised into the four links of the chain - the record, the SVG logo, the mark certificate, and DMARC - each with its own pass, warn, or fail verdict, so the broken link names itself.
The checks go deep. The SVG is fetched and validated against the full SVG Tiny Portable/Secure profile BIMI demands: the tiny-ps base profile, a title element, square dimensions, no scripts, animations, styles, or raster images, and the 32 KB size cap. The mark certificate - VMC or CMC - is checked for its validity window, the required extended key usage and logotype extension, and that it actually matches the domain. The DMARC prerequisite is evaluated properly: quarantine or reject passes, a monitoring-only p=none fails. And an unreachable logo or certificate URL is a finding of its own, because a mailbox provider that cannot fetch your logo will not display it.
How it works
- DiscoverEvery domain in your inventory with a BIMI record is found automatically - selectors included - with no list to maintain.
- Validate the recordThe record is parsed tag by tag - version, logo location, certificate authority - and structural errors and insecure URLs are flagged.
- Check the SVGThe referenced logo is fetched and validated against the full SVG Tiny Portable/Secure profile: base profile and version, title element, square dimensions, no scripts, animations, styles, or raster images, and the 32 KB cap.
- Check the certificateThe mark certificate - VMC or CMC - is validated for its validity window, the required extended key usage and logotype extension, and a match against the domain.
- Verify DMARC and trackThe DMARC prerequisite is evaluated - quarantine or reject passes, p=none fails - and every failed link becomes a graded issue that re-checks on each scan and closes itself when fixed.
What you get
- Automatic discovery of every BIMI record across your zones
- Record syntax validated tag by tag, with insecure URLs flagged
- SVG checked against the full SVG Tiny P/S profile, square viewBox to 32 KB cap
- VMC and CMC certificates validated: validity, key usage, logotype, domain match
- DMARC enforcement verified - a monitoring-only p=none is caught
- A live validator tool, plus scan-time issues that auto-close when fixed
Why it matters
Brand impressions on every email
Your logo in the inbox turns every message into a branded touchpoint and helps recipients distinguish your genuine mail at a glance.
A security upgrade in disguise
BIMI's prerequisite is DMARC at enforcement - the single most effective anti-spoofing control for a domain. Chasing the logo gets your email security to where it should have been anyway.
No more silent failure
Mailbox providers do not tell you why a logo is not showing. Four verdicts across the chain replace guesswork with a specific, fixable finding.
Iterate in minutes, not send cycles
The usual BIMI experience is publishing a change and waiting to see whether a logo appears. The live validator re-checks the whole chain on demand, so each fix is confirmed the moment you make it.
Common questions
Why is my logo not showing even though I published a BIMI record?
Usually one of three reasons: the SVG does not conform to BIMI's strict profile, the mark certificate is missing or invalid, or DMARC is not at an enforcement policy. DNS Watchdog checks each link separately - and also verifies the logo and certificate URLs are actually reachable - so you see exactly which link failed.
How strict is the SVG requirement, really?
Very - it is the most common reason a 'correct' setup shows no logo. BIMI requires the SVG Tiny Portable/Secure profile: a tiny-ps base profile declaration, a title element, square dimensions, no scripts, no animations, no style elements, no embedded raster images, and a file under 32 KB. DNS Watchdog validates every one of those constraints and names the specific violation.
Do I need a Verified Mark Certificate?
For Gmail and several other major providers, yes - a VMC from an authorised certification authority, which in turn requires a registered trademark for your logo (Common Mark Certificates are also supported for established logos). DNS Watchdog validates whichever certificate you reference - expiry, required extensions, and domain match - so a broken certificate does not silently cost you the logo.
What DMARC policy does BIMI require?
An enforcement policy: p=quarantine or p=reject. A monitoring-only p=none policy disqualifies your domain no matter how perfect the rest of the setup is. DNS Watchdog evaluates the policy as part of the chain and raises a finding when enforcement is missing.