---
title: "How to Check Whether Your BIMI Record and VMC Certificate Are Valid | AutoSPF"
description: "Learn to validate BIMI DNS records, verify VMC certificates, check SVG logo hosting, and fix common errors for reliable email logo display."
image: "https://autospf.com/og/blog/how-to-check-bimi-record-and-vmc-certificate-validity.png"
canonical: "https://autospf.com/blog/how-to-check-bimi-record-and-vmc-certificate-validity/"
---

Quick Answer

BIMI validation checks whether your BIMI DNS record, SVG logo, and VMC or CMC certificate meet email authentication requirements. Verify your DNS syntax, HTTPS accessibility, certificate validity, and DMARC enforcement to support secure brand logo display in email inboxes.

## Try Our Free BIMI Checker

Verify your BIMI record and check VMC certificate status.

[ Check BIMI Record → ](/tools/bimi-checker/) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20to%20Check%20Whether%20Your%20BIMI%20Record%20and%20VMC%20Certificate%20Are%20Valid&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F "Share on Facebook") [ ](https://reddit.com/submit?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F&title=How%20to%20Check%20Whether%20Your%20BIMI%20Record%20and%20VMC%20Certificate%20Are%20Valid "Share on Reddit") [ ](mailto:?subject=How%20to%20Check%20Whether%20Your%20BIMI%20Record%20and%20VMC%20Certificate%20Are%20Valid&body=Check out this article: https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F "Share via Email") 

![BIMI Record and VMC Certificate Validation](https://media.mailhop.org/autospf/spf-record-example-1207-1792756935912.jpg) 

## What BIMI Validation Means and Why It Matters

Brand Indicators for Message Identification (BIMI) lets participating mailbox providers display brand logos beside authenticated emails. A valid BIMI record identifies the logo, while a VMC or CMC verifies the mark.

BIMI validation checks [DNS records](https://www.cloudns.net/wiki/article/9/), SVG logos, certificates, hosting URLs, and DMARC configuration. Proper validation supports logo display and brand trust, although visibility depends on **provider support and policies**.

## Prerequisites: DMARC Enforcement, Brand Logo Requirements, and DNS Access

### DMARC Enforcement and Authentication Baseline

_The most important prerequisite for BIMI is DMARC enforcement_. Your organizational domain must have a [DMARC policy](https://dmarcreport.com/blog/what-is-a-dmarc-policy-and-how-does-it-affect-sending-my-emails/) set to either `p=quarantine` or `p=reject`, with the policy applying to 100% of messages (`pct=100`). A **monitoring-only policy** such as `p=none` does not meet BIMI’s DMARC enforcement requirements.

A typical DMARC policy looks like this:

```
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com
```

Alternatively, you can use:

```
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@example.com
```

The `p=quarantine` policy instructs receiving servers to treat messages that fail DMARC as suspicious, while `p=reject` requests that they reject those messages. The `pct=100` tag indicates that the policy applies to all messages covered by the record.

Correct [SPF](https://autospf.com/blog/what-is-spf-hosting-and-why-your-domain-needs-it/) and DKIM configurations are essential for **DMARC alignment.** At least one authentication method must pass and align with the visible From domain for a message to pass DMARC. Check your organizational domain and relevant subdomain policies to ensure they meet applicable BIMI requirements.

[AutoSPF](https://autospf.com/) helps organizations manage complex SPF records and multiple email senders to support reliable email authentication.![Spf Flattening 2388](https://media.mailhop.org/autospf/spf-flattening-2388-1792757061307.jpg)

### Brand Logo and Certificate Requirements

_Your BIMI logo must use a secure, compliant SVG format without scripts, animations, external references, or unsupported elements._ A valid [VMC or CMC](https://www.digicert.com/blog/bimi-setup-guide-for-vmc-and-cmc) may also be required, depending on **mailbox provider requirements**.

### DNS Access and Tooling

To publish the BIMI DNS record, you need access to your domain’s DNS zone. BIMI is published as a [DNS TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/) at a selector-based location, typically:

```
default._bimi.example.com
```

A **BIMI record lookup** checks whether the record resolves correctly and contains the required tags. Use a BIMI validator or checker to verify its configuration and follow the BIMI implementation guidelines for proper setup and maintenance.

## How to Check Your BIMI DNS Record for Correct Syntax and Placement

### Run a BIMI Record Lookup

A typical BIMI record looks like this:

```
v=BIMI1;l=https://example.com/bimi/logo.svg;a=https://example.com/bimi/vmc.pem
```

The `v=BIMI1` tag identifies the BIMI record version. The `l=` tag points to the publicly accessible SVG logo over HTTPS. The `a=` tag points to the VMC or CMC certificate file when required by the applicable BIMI implementation and mailbox provider requirements.

_A BIMI checker can help verify that the record exists, uses the expected selector, and follows the required syntax._ If no record is found, check the selector, DNS propagation, and authoritative [DNS zone](https://www.ibm.com/think/topics/dns-zone).![Spf Record Checker 5099](https://media.mailhop.org/autospf/spf-record-checker-5099-1792757110002.jpg)

### Confirm Syntax, Tags, and Selector Placement

Your BIMI check should verify the following:

- The record begins with `v=BIMI1`.
- The `l=` value points to a valid _SVG_ file.
- The logo URL uses HTTPS.
- The `a=` value points to a valid mark certificate when required.
- The **BIMI DNS record** is published as TXT, not [CNAME](https://efficientip.com/glossary/what-is-cname/) or another record type.
- There are no duplicate BIMI records at the same selector.
- The domain has DMARC enforcement with a DMARC policy of `p=quarantine` or `p=reject`.

#### Example of a Valid BIMI DNS Record

```
default._bimi.example.com.TXT"v=BIMI1;l=https://assets.example.com/bimi/logo.svg;a=https://assets.example.com/bimi/*vmc*.pem;"
```

During BIMI validation, a checker may verify the domain’s DMARC policy, SPF and DKIM alignment, and authentication compliance. Advanced checks may also assess redirects, [TLS security](https://www.trendmicro.com/en%5Fus/research/22/g/transport-layer-security-tls-issues-protocol.html), [MIME type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/MIME%5Ftypes), logo accessibility, and **SVG validity**.

## How to Verify Your VMC Certificate and Logo Hosting URL

### Validate the VMC or CMC Certificate

The VMC or CMC must be issued by a trusted certificate issuer and match the logo in the BIMI record. _Check that the certificate is accessible, valid, not expired or revoked, and served over HTTPS._ Ensure the certificate chain and brand details are correct. If errors appear, contact the certificate issuer.

### Confirm Logo Hosting, SVG Format, and HTTPS Accessibility

The `l=` tag must point to a publicly accessible HTTPS URL. The SVG logo should be securely hosted and accessible without login or restrictions.

Check that the logo uses the approved SVG Tiny PS format, is square, has no external dependencies, and loads with a valid HTTPS connection and [HTTP 200 status](https://www.olostep.com/glossary/web-scraping-apis/what-is-200-status-code). Avoid unnecessary redirects and ensure the correct content type.

Mailbox providers may apply their own **BIMI validation and display policies**. Final logo visibility also depends on sender reputation and provider requirements.

## Common BIMI and _VMC_ Validation Errors and How to Fix Them

![Spf Lookup 9702](https://media.mailhop.org/autospf/spf-lookup-9702-1792757016933.jpg)Common issues include:

- **No BIMI record found:** Run a BIMI record lookup against `default._bimi.yourdomain.com`. Confirm that the DNS TXT record was published in the authoritative zone and that [DNS propagation](https://www.ioriver.io/terms/dns-propagation) has completed.
- **Invalid DMARC policy:** Update your DMARC policy from `p=none` to `p=quarantine` or `p=reject`. BIMI requires **DMARC enforcement**, and many mailbox providers will ignore a BIMI DNS record without it.
- **SPF or DKIM alignment failure:** Review your sending sources and make sure authenticated email messages align with the visible From domain.
- **Malformed BIMI record:** Check for missing semicolons, unsupported tags, duplicate records, or incorrect URL values. Use a record builder or validation tool to generate a clean record.
- **Logo file rejected:** Convert the _SVG_ logo to _SVG_ Tiny PS and remove scripts, embedded raster images, external links, and unsupported _SVG_ elements.
- **Logo URL not accessible:** Host the file at a publicly accessible HTTPS URL, avoid authentication barriers, and verify that the secure URL returns HTTP 200.
- **Invalid or expired _VMC_:** Reissue the verified mark certificate through an approved certificate issuer and confirm that the certificate matches the brand logo.
- **Certificate URL blocked:** Ensure the _VMC_ file is reachable without bot protection, IP restrictions, or forced downloads.
- **Mailbox provider does not display the logo:** Confirm mailbox support, sender reputation, and the provider’s current BIMI requirements. Some providers may support VMC, others may support CMC, and some may not display BIMI logos consistently.

Run a BIMI check after DNS changes, certificate renewals, logo updates, or [DMARC](https://autospf.com/blog/what-is-dmarc-email-authentication-guide/) adjustments. Regular validation helps **maintain security**, protect brand reputation, and build recipient trust by supporting verified logo display in authenticated emails.

![Brad Slavin](https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

General Manager of DuoCircle. Product strategy and commercial lead for AutoSPF's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Ready to get started?

Try AutoSPF free — no credit card required.

[ Book a Demo ](/book-a-demo/) 

Scan Your Domain Now

Instantly scan your domain for DKIM, SPF, and DMARC issues

Check My Domain 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F) [ ](https://twitter.com/intent/tweet?text=How%20to%20Check%20Whether%20Your%20BIMI%20Record%20and%20VMC%20Certificate%20Are%20Valid&url=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fautospf.com%2Fblog%2Fhow-to-check-bimi-record-and-vmc-certificate-validity%2F) Copy 

Related Articles

- [ ![DIY-ing SPF](https://media.mailhop.org/autospf/images/2024/04/spf-record-example-5874.jpg)  10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies Intermediate ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)
- [ ![phishing actors](https://media.mailhop.org/autospf/images/2025/11/spf-record-checker-0096.jpg)  The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors! Intermediate ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)
- [ ![421 Error SMTP Guide](https://media.mailhop.org/autospf/spf-lookup-1607-1785756872932.jpg)  421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue Intermediate ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/)
- [ ![DNS vulnerabilities affecting email authentication](https://media.mailhop.org/autospf/spf-lookup-9081-1790592336407.jpg)  5 Common DNS Vulnerabilities Affecting Email Authentication Intermediate ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/)

## Related Articles

[  Intermediate 6m  10 Reasons Why DIY-ing SPF isn’t a Good Choice for Companies  Apr 4, 2024 ](/blog/10-reasons-diy-ing-spf-isnt-good-choice-for-companies/)[  Intermediate 5m  The 12.4 billion shield for your email communications: Why DMARC software is the unsung hero in the war against phishing actors!  Nov 19, 2025 ](/blog/12-4-billion-dmarc-software-shield-protecting-email-from-phishing-actors/)[  Intermediate  421 Error SMTP Survival Guide: Fix the 4.4.2 Connection Dropped Issue  Aug 3, 2026 ](/blog/421-error-smtp-survival-guide-fix-connection-dropped-email-issue/)[  Intermediate  5 Common DNS Vulnerabilities Affecting Email Authentication  Sep 28, 2026 ](/blog/5-common-dns-vulnerabilities-affecting-email-authentication/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"AutoSPF","url":"https://autospf.com","description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","publisher":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
{"@context":"https://schema.org","@type":"BlogPosting","headline":"How to Check Whether Your BIMI Record and VMC Certificate Are Valid","description":"Learn to validate BIMI DNS records, verify VMC certificates, check SVG logo hosting, and fix common errors for reliable email logo display.","url":"https://autospf.com/blog/how-to-check-bimi-record-and-vmc-certificate-validity/","datePublished":"2026-10-23T00:00:00.000Z","dateModified":"2026-10-23T00:00:00.000Z","dateCreated":"2026-10-23T00:00:00.000Z","author":{"@type":"Person","@id":"https://autospf.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://autospf.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind AutoSPF, DMARC Report, Phish Protection, and Mailhop. He founded DuoCircle in 2014 to solve the SPF 10-DNS-lookup problem at scale and has led the company's growth to 2,000+ customers. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement) rather than hands-on DNS engineering.","image":"https://media.mailhop.org/autospf/images/authors/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"AutoSPF","url":"https://autospf.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com","logo":{"@type":"ImageObject","url":"https://autospf.com/images/autospf-logo.png"},"description":"Automatic SPF flattening and email authentication management. Resolve SPF lookup limits, flatten SPF records, and maintain email deliverability across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138897474","https://www.linkedin.com/company/autospf","https://x.com/autospf01","https://www.g2.com/products/autospf/reviews"],"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://autospf.com/contact-us/"},"knowsAbout":["SPF Record Flattening","Sender Policy Framework","Email Authentication","DNS Management","DMARC","DKIM"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://autospf.com/blog/how-to-check-bimi-record-and-vmc-certificate-validity/"},"articleSection":"intermediate","keywords":"","image":{"@type":"ImageObject","url":"https://media.mailhop.org/autospf/spf-record-example-1207-1792756935912.jpg","caption":"BIMI Record and VMC Certificate Validation"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://autospf.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://autospf.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://autospf.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How to Check Whether Your BIMI Record and VMC Certificate Are Valid","item":"https://autospf.com/blog/how-to-check-bimi-record-and-vmc-certificate-validity/"}]}
```