Look up the BIMI TXT record at default._bimi.yourdomain and validate the v=BIMI1, l= logo, and a= certificate tags. It is free, instant, and runs entirely in your browser over DNS-over-HTTPS, with no signup and nothing stored.
Create a free Unspam account to save your results and re-run these checks anytime, so you catch a broken setup before it costs you. No credit card.
BIMI (Brand Indicators for Message Identification) is a DNS TXT record that tells supporting inboxes which logo to show next to your messages. It is published at default._bimi.yourdomain and starts with v=BIMI1, followed by an l= tag pointing to your logo and an optional a= tag pointing to your certificate. The logo at the l= URL must be an SVG in the SVG Tiny PS (Portable/Secure) profile and served over HTTPS, and it should be square, because inboxes crop it into a round or square avatar slot. BIMI only takes effect after your domain already passes DMARC at an enforcement policy, so it is the last step in email authentication, not the first. Publishing a correct record is the part you control. Whether a logo then appears is the inbox’s call: Yahoo Mail will show one from the l= tag alone, while Gmail and Apple Mail also want a certificate, and Apple asks that the receiving mail provider be on the BIMI Group list and verified by Apple first.
This is the version tag and it must come first. If the record does not begin with v=BIMI1, inboxes will ignore it.
The l= tag is the HTTPS URL of your logo, which must be an SVG in the SVG Tiny PS profile and reachable without redirects or login, and should be square (1:1) so it survives the avatar crop intact. A blank or missing l= means no logo will display.
The a= tag is the HTTPS URL of your VMC or CMC certificate (a .pem file). It is optional in the spec, but Gmail and Apple require a certificate before they will show your logo.
BIMI only works if your domain already has a DMARC policy of p=quarantine or p=reject that applies to all of your mail rather than a sample. A p=none policy is not enough and will block your logo from rendering.
A pass means a valid BIMI record exists with an HTTPS SVG logo URL. We do not fetch the file, so confirm it loads and is SVG Tiny PS. Inbox display still depends on your DMARC policy and, for Gmail and Apple, a valid certificate.
BIMI requires your domain to be at an enforcement policy of p=quarantine or p=reject before any logo will show. A monitoring-only p=none policy blocks BIMI entirely. Move DMARC to enforcement across all of your mail first, then publish or revisit your BIMI record.
The file at your l= URL must be an SVG in the SVG Tiny PS (Portable/Secure) profile, not a PNG, JPG, or a regular full-feature SVG. A standard SVG export usually needs editing to strip unsupported elements and add a title element. Use a BIMI-specific SVG tool or converter to produce a compliant file.
Gmail and Apple Mail require a certificate (a= tag) before they display your logo, even if the rest of the record is valid. Gmail accepts a VMC or a CMC, and only a VMC earns the check mark beside your logo. Apple names a VMC as its example but asks for a BIMI Evidence Document verified by the mail provider, so which certificate types work there is the provider’s decision rather than Apple’s. Without the a= tag, your logo may show in some clients but not in Gmail or Apple Mail.
Both the l= and a= URLs must be public HTTPS links that load directly with no redirects, no authentication, and a valid TLS certificate. If either URL returns an error or redirects, inboxes will skip your logo. Host the files on a stable, publicly accessible HTTPS path.
The BIMI record lives at the default._bimi subdomain of your domain, for example default._bimi.example.com, not at the root. Publishing it at the apex or under a different selector means inboxes will not find it. Confirm the selector and host before saving the TXT record.
BIMI art is shown in a circular or square avatar slot, so a wide wordmark gets cropped to something unreadable. The SVG needs a 1:1 viewBox with the mark centred and enough padding to survive the crop.
Every date and figure Unspam publishes about sender requirements is kept here, checked against each provider’s own documentation. Last read August 16, 2026.
| Provider | What | Value | Applies to |
|---|---|---|---|
| Bulk sender rules in force since source | February 2024 required | mail to personal Gmail addresses | |
| Enforcement tightening since source | November 2025 observed Google calls this gradual and progressive rather than a switch that flipped on a date. | mail to personal Gmail addresses | |
| Counts as a bulk sender at source | 5,000 required This is Google’s number. Yahoo declines to publish one at all. | mail to personal Gmail addresses | |
| Spam complaint rate ceiling source | 0.3% required Google describes the effect as graduated rather than a cutoff: above the recommended figure inbox placement already suffers, and at the ceiling it suffers more. | every sender to Gmail, not only bulk | |
| Spam complaint rate to aim for source | 0.1% recommended Postmaster Tools does not divide complaints by everything you sent. It measures them against DKIM-signed messages that reached an engaged recipient’s inbox, so a sender already being filtered can see an artificially low rate. | every sender to Gmail, not only bulk | |
| Yahoo | Bulk sender rules in force since source | February 2024 required | mail to Yahoo, AOL and Yahoo’s other mailboxes |
| Counts as a bulk sender at source | not published Yahoo states it will not specify a volume threshold, so no figure can be attributed to it. | mail to Yahoo, AOL and Yahoo’s other mailboxes | |
| Spam complaint rate ceiling source | 0.3% required | mail to Yahoo, AOL and Yahoo’s other mailboxes | |
| Outlook.com | Bulk sender rules in force since source | May 2025 required | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant |
| Counts as a bulk sender at source | 5,000 required The rule applies to any domain that has ever crossed the threshold, so it keeps applying on a quieter day. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| What happens to failing mail source | 550 5.7.515 observed Failing mail is refused during the SMTP conversation rather than filed in a spam folder. Microsoft’s postmaster policy page still describes junk foldering as a first step, so a sender may see either, but the bounce is the outcome to plan for. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| SPF and DKIM must both pass, not just DMARC source | required Stricter than DMARC alone. DMARC passes when either SPF or DKIM aligns, and Outlook.com asks for both checks to pass on top of that. | Outlook.com and Microsoft’s other consumer mailboxes, never a Microsoft 365 tenant | |
| Apple | Bulk sender rules in force since source | February 2025 required | mail to iCloud Mail, me.com and mac.com |
| ARC headers on forwarded mail source | required Apple is the only one of the four to ask for this, which is the honest reason to look at ARC at all. | mail to iCloud Mail, me.com and mac.com |
Unspam reads all of these from your domain name alone.
No DNS lookup can reach these. They need a real message or real sending history, which is what an inbox placement test is for.
