Validates BIMI for brand authentication in emails
3 of 3 free audits left today
See what DNS Mail BIMI finds on your site. No sign-up needed.
Domain — takes the hostname of the audited URL and strips one leading www.: https://www.example.com/ is audited as example.com. A URL without a hostname ends the audit with 501.
Lookup — asks DNS for the TXT records at default._bimi.<domain> (the default selector). The auditor never fetches the audited page. A resolver failure (SERVFAIL, timeout) ends the audit with 500; a name with no record is a finding, not an error.
Rules — no TXT record at the name warns (300, BIMI is optional). Every TXT value that does not start with v=BIMI1 (case-insensitive) warns once (301). The first v=BIMI1 record must carry an l= tag with an https:// URL (302). More than one v=BIMI1 record warns (303), because mailbox providers expect exactly one.
Aggregate — any warning makes the audit WARNING; when every rule passes the audit is SUCCESS (200) and the message quotes the record and its logo URL.
Specification pin — every run emits 37A-DnsMailBimiAuditor-100 (INFORMATION), naming the IETF BIMI draft revision this auditor implements. It does not change the overall status.
Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
|---|---|---|---|---|
37A-DnsMailBimiAuditor-100 | INFORMATION | Always. Records the BIMI draft revision this auditor implements. | — (recommendation is null; nothing for the site to change) | — |
37A-DnsMailBimiAuditor-300 | WARNING | No TXT record exists at default._bimi.{domain}. | Once {domain} enforces DMARC (p=quarantine or p=reject), publish a TXT record at default._bimi.{domain} such as "v=BIMI1; l=https://{domain}/bimi/logo.svg" pointing at your SVG Tiny PS logo. | Without BIMI, mailbox providers show no brand logo next to your messages, so your email is less recognizable in the inbox and competes harder for opens. |
37A-DnsMailBimiAuditor-301 | WARNING | A TXT record at the BIMI name does not start with v=BIMI1 (one check per such record). | Rewrite "{record}" at default._bimi.{domain} so it starts with "v=BIMI1;" followed by the logo URL, for example "v=BIMI1; l=https://example.com/bimi/logo.svg", or remove it from the zone. | Mailbox providers ignore a record they cannot parse, so no logo appears while the DNS entry gives the impression that BIMI is in place. |
37A-DnsMailBimiAuditor-302 | WARNING | The BIMI record has no l= tag, or its value is not an https:// URL. | Add an l= tag with the HTTPS URL of your SVG Tiny PS logo to "{record}" at default._bimi.{domain}, for example "v=BIMI1; l=https://example.com/bimi/logo.svg". | Mailbox providers only fetch the logo over HTTPS; without a usable l= URL the record shows nothing and the brand stays invisible in the inbox. |
37A-DnsMailBimiAuditor-303 | WARNING | More than one v=BIMI1 TXT record answers at the BIMI name. | Keep a single v=BIMI1 TXT record at default._bimi.{domain} and delete the other {count - 1} of "{records}". | When several BIMI records answer the same name, mailbox providers treat the lookup as invalid and show no logo at all. |
37A-DnsMailBimiAuditor-200 | SUCCESS | All rules passed. Message quotes the BIMI record and its logo URL. | — | — |
37A-DnsMailBimiAuditor-500 | ERROR | The resolver could not answer the TXT query for default._bimi.{domain} (SERVFAIL, timeout). The record may well exist. | Check that the DNS zone serving default._bimi.{domain} answers TXT queries, then run the audit again. Last error: {error}. | — |
37A-DnsMailBimiAuditor-501 | ERROR | The audited URL is null, empty, malformed or has no hostname. | Provide an absolute URL with a hostname, such as https://example.com/, instead of "{url}". | — |
| Status | Description | Test logic |
|---|---|---|
| SUCCESS | One valid BIMI record with an HTTPS logo | Exactly one v=BIMI1 TXT record at default._bimi.<domain> whose l= tag is an https:// URL (200). |
| WARNING | BIMI is missing or will not show a logo | No record (300); a TXT value not starting with v=BIMI1 (301); no https:// logo URL in l= (302); more than one BIMI record (303). |
| FAIL | — | This auditor emits no FAIL: BIMI is optional. |
| ERROR | The auditor could not run the check | DNS lookup failed (500); the URL has no usable hostname (501). |
| INFORMATION | Specification pin | Always emitted (100); does not change overall status. |
Mailbox providers only honor BIMI for domains whose DMARC policy is p=quarantine or p=reject (with pct=100). A correct BIMI record on a domain with p=none shows no logo; run the DNS Mail DMARC auditor alongside this one.
The logo must be an SVG Tiny PS file served over HTTPS, and Gmail and Apple Mail also require a Verified Mark Certificate (a= tag). This auditor checks neither the logo file nor the certificate.
Only the default selector is read. Mail sent with a BIMI-Selector header naming another selector is published elsewhere and is not seen here.
The record is read for the hostname of the audited URL (minus www.); mail sent from a subdomain or the organizational domain may use a different BIMI record.
A null, empty or malformed URL, or one without a hostname, used to be reported as FAIL with no check code; it is now ERROR with 37A-DnsMailBimiAuditor-501, because a bad input is not a defect of the domain.
A DNS failure or timeout used to be reported as "No BIMI record found"; it is now ERROR with 37A-DnsMailBimiAuditor-500, since the record may exist and the audit could not tell.
A record without an https:// logo URL in l= (302) and more than one BIMI record at the name (303) are new warnings; the previous version only looked at the first TXT record's v=BIMI1 prefix.
The v=BIMI1 check is now case-insensitive.
This documentation is built and hosted on Mintlify, a developer documentation platform.
Add this auditor to your monitoring setup and start identifying issues on your websites today.