H
HTTPSense

BIMI Inspector

Check and validate BIMI records — validate the SVG logo, inspect the Verified Mark Certificate, and confirm the DMARC prerequisite.

What is a BIMI Inspector?

A BIMI inspector is a tool that checks a domain's Brand Indicators for Message Identification configuration — the TXT record published at <selector>._bimi.<domain> that points to an SVG brand logo and, optionally, a Verified Mark Certificate. BIMI is a domain-level standard that lets your verified logo appear next to authenticated mail in supporting inboxes. It builds directly on email authentication: a logo is only shown when the domain already enforces DMARC.

HTTPSense's BIMI Inspector resolves the record, validates the SVG logo against the strict SVG Tiny PS profile, fetches and parses the Verified Mark Certificate, and confirms the DMARC enforcement prerequisite. It renders a preview of the logo, shows a pass/fail for every SVG and certificate rule, and surfaces problems like an invalid logo, a missing or expired VMC, and a DMARC policy that is not yet at enforcement — then assigns a letter grade (or marks the domain "not configured" when BIMI is simply not in use). It's free and requires no signup.

How to Use the BIMI Inspector

  1. Enter a domain name or URL in the search bar and click Inspect BIMI.
  2. Review the Summary tab for the logo preview, the record, certificate status, and the overall grade.
  3. Open the Record tab to see the parsed l= logo and a= VMC URLs.
  4. Use the SVG Validation tab to check every SVG Tiny PS rule against the served logo.
  5. Check the VMC tab for the certificate subject, issuer, validity, and logotype extension.
  6. Open Prerequisites to confirm DMARC is enforcing, then use Findings and Raw for issues and the full JSON.

How the BIMI Inspector Works

When you submit a domain or URL, we strip the scheme, port, and path to extract the bare hostname and query default._bimi.<domain> for its TXT record through Cloudflare's public resolver (1.1.1.1). The record is parsed for its v=BIMI1 version, the l= logo URL, and the optional a= certificate URL, and we resolve the domain's DMARC policy to evaluate the enforcement prerequisite.

The logo is fetched over HTTPS and validated against the SVG Tiny PS profile using a strict, entity-free XML parser: we check the root element, namespace, version, base profile, a square viewBox, and a <title>, and reject scripts, external references, raster images, animation, and hyperlinks. When an a= URL is present we fetch the Verified Mark Certificate, parse the PEM chain, verify the validity window, confirm the domain appears in the certificate's subject alternative names, and check for the logotype extension (OID 1.3.6.1.5.5.7.1.12).

Finally we evaluate a findings catalog — no record (treated as optional, not a failure), an invalid or unfetchable logo, a missing or invalid VMC, and an unmet DMARC prerequisite — and translate the results into a 0–100 score and an A–F grade. Because BIMI is optional, a domain with no record is reported as "not configured" rather than graded F. We never send email; the analysis combines DNS lookups with read-only HTTPS fetches of the public logo and certificate.

Key Features

  • Record parsing — Resolves the BIMI record and extracts the l= logo and a= certificate URLs.
  • SVG Tiny PS validation — Checks every profile rule with a strict, entity-free parser and renders a logo preview.
  • VMC inspection — Parses the certificate, validity window, SAN coverage, and logotype extension.
  • DMARC prerequisite check — Confirms the domain enforces DMARC at p=quarantine or reject with pct=100.
  • Optional-aware grading — Reports "not configured" for domains without BIMI instead of a misleading F.
  • Findings & remediation — Severity-ranked issues, each with a concrete fix.
  • Scored grade & raw JSON — A 0–100 score mapped to an A–F grade, plus the full response for scripting.

Common Use Cases

  • Brand & marketing teams — Confirm the verified logo is valid and will render in supporting inboxes.
  • Email administrators — Check the SVG and VMC before and after deploying BIMI.
  • Security engineers — Verify the DMARC enforcement prerequisite is genuinely met.
  • Deliverability specialists — Diagnose why a logo is not displaying despite a published record.

Frequently Asked Questions

What is BIMI?

BIMI (Brand Indicators for Message Identification) is a standard that lets a domain publish a verified brand logo to display next to authenticated messages in supporting inboxes such as Gmail, Apple Mail, and Yahoo. The domain publishes a TXT record at <selector>._bimi.<domain> pointing to an SVG logo and, for most providers, a Verified Mark Certificate. BIMI is optional, but it improves brand recognition and is a visible reward for getting email authentication right.

Why does BIMI require DMARC enforcement first?

Mailbox providers only show a BIMI logo when they are confident the message is genuinely from the domain, so BIMI requires the domain to enforce DMARC at p=quarantine or p=reject with pct=100. A logo on an unauthenticated message would be a gift to phishers. The Inspector resolves the domain's DMARC policy and reports whether this prerequisite is met before the logo or certificate even matter.

What are the rules for a BIMI SVG logo?

BIMI logos must use the SVG Tiny Portable/Secure (SVG Tiny PS) profile: a single square root <svg> with version 1.2, baseProfile "tiny-ps", a square viewBox, and a <title> element. Scripts, external references, raster <image> elements, animation, and hyperlinks are forbidden for security. The Inspector fetches the SVG over HTTPS and checks each of these rules, showing a pass or fail for every one and rendering a preview of the logo.

What is a VMC and do I need one?

A Verified Mark Certificate (VMC) is a certificate from an authorized CA (such as DigiCert or Entrust) that proves your organization owns the logo, typically backed by a trademark registration. It embeds the logo's hash in a logotype extension. Gmail and most other major providers require a valid VMC before they display the logo. The Inspector fetches the VMC, parses the certificate, checks its validity window, confirms the domain is in the SAN, and verifies the logotype extension is present.

Why does my domain show "not configured" instead of a grade?

BIMI is optional, so a domain with no BIMI record is not failing — it simply has not adopted BIMI. In that case the Inspector reports a "not configured" status rather than an F grade, and still shows whether the DMARC prerequisite is met so you know how much work deploying BIMI would take. Domains that do publish a record receive a graded analysis of the logo, certificate, and prerequisites.