Start from the Author Domain

Read the domain in the visible From address of the message you are testing. BIMI builds on DMARC alignment for that identity; a DKIM selector, return-path domain, website host, or link domain is not automatically the BIMI domain.

For the default selector on example.com, query:

dig TXT default._bimi.example.com

The domain is reserved for examples. Record the queried name, resolver, answer, status, TTL, and UTC time. Query an authoritative server as well when diagnosing a publication issue.

Classify the DNS response

NXDOMAIN, a valid no-data response, timeout, and SERVFAIL are different states. A temporary resolver problem must not be reported as “BIMI not configured.” If more than one candidate assertion is published at the selected name, use a current BIMI validator and the specification guidance rather than choosing the friendliest-looking string.

An illustrative record is:

v=BIMI1; l=https://assets.example.com/brand.svg; a=https://assets.example.com/mark.pem

Check that the version, logo location, and optional evidence location are parseable. Do not fetch arbitrary URLs from untrusted domains with an unrestricted server-side tool; asset retrieval needs HTTPS, bounded size/time, safe redirect and address checks, and content validation.

Check policy prerequisites separately

Inspect a fresh message for DMARC pass and the applicable enforcement policy required by current BIMI program guidance. Confirm that subdomain policy is appropriate for the From domain. A valid BIMI TXT record does not repair DMARC alignment.

Then validate the SVG profile and evidence document, if used. A successful TXT lookup proves only that DNS returned an assertion. It does not prove the logo is reachable, the certificate matches, the sender meets a mailbox provider’s reputation criteria, or the provider supports the selector.

Report the result honestly

Use states such as “record retrieved,” “record missing,” “DNS unavailable,” “asset validation failed,” and “provider display not observed.” Send an authorized fresh message to a supported test mailbox only after configuration checks. Even then, describe the exact provider, account, client, and observation time. BIMI display remains a provider decision, not a deterministic outcome of the DNS query.