BIMI レコード・VMC デコーダー

What BIMI is

Brand Indicators for Message Identification — BIMI — lets a domain publish the logo that mailbox providers may show next to its messages. It is defined in an IETF draft (draft-brand-indicators-for-message-identification) and run in practice by the BIMI Group, which writes the rules for the certificates and the logo format. Gmail, Apple Mail, Yahoo and others implement it, each with its own details.

BIMI does not authenticate anything by itself. A logo is shown only for a message that already passed DMARC with an enforcing policy — p=quarantine or p=reject, with no sampling below 100 percent. That is the first thing to check when a valid setup still shows no logo: the email authentication analyzer reads the DMARC result of a real message.

The record

The domain publishes a TXT record at default._bimi.<domain> (another selector can be named in a BIMI-Selector header). It starts with v=BIMI1 and carries two URLs: l= for the logo and a= for the evidence, a Mark Certificate. Both must be HTTPS. Empty l= and a= mean the domain explicitly declines to show a logo. When a subdomain has no record, receivers fall back to the organizational domain, so news.example.com inherits the record of example.com.

The decoder looks the record up from your browser over DNS-over-HTTPS and checks its syntax: the version tag first, valid HTTPS URLs on fully qualified names, an SVG rather than a bitmap at l=, no stray commas, and the avatar preference if present.

Mark Certificates: VMC and CMC

The a= file is a PEM bundle: an X.509 certificate issued under the BIMI Group's Minimum Security Requirements for the Issuance of Mark Certificates, followed by its intermediate CA. Mark Certificates are not TLS certificates. They carry the extended key usage id-kp-BrandIndicatorforMessageIdentification (1.3.6.1.5.5.7.3.31) and the Mark Certificate policy 1.3.6.1.4.1.53087.1.1, list the domains they cover in subjectAltName, are logged to Certificate Transparency like TLS certificates, and embed the logo itself in a logotype extension (RFC 3709) as a gzip-compressed SVG in a data: URL, together with its hash.

There are two kinds. A Verified Mark Certificate (VMC) states a registered trademark — the subject names the trademark office and registration number — or a government mark. A Common Mark Certificate (CMC) is for a logo the organization has used publicly for at least a year without a trademark (a prior use mark), or a modified version of a registered one. Gmail shows a blue verified checkmark next to VMC logos only; some receivers accept CMCs, others do not.

The decoder reads the mark type and its required subject fields, the domains, the validity period, the key and the signature, and verifies the chain up to one of the roots the BIMI Group lists — those of DigiCert, GlobalSign, SSL.com and Entrust today; Sectigo's Mark Certificates chain to SSL.com's root. It also recomputes the embedded logo's hashes: a hash that does not match means the certificate was assembled wrongly and no receiver will use it.

The logo: SVG Tiny PS

The logo at l= must be an SVG in the restricted SVG Tiny Portable/Secure profile: version="1.2" and baseProfile="tiny-ps" on the root element, a non-empty <title>, a square viewBox, no scripts, no event handlers, no links to external resources, no embedded bitmaps and no animation. Receivers reject anything else, and most recommend staying under 32 KB. When a certificate is present, the file at l= must also be byte-for-byte the logo embedded in the certificate.

The decoder checks both logos against those rules and compares them. It shows them only as images built from local data — an SVG is never inserted into the page, so whatever a file contains, nothing in it can run.

What goes over the network

Looking up a domain sends the domain name to Cloudflare's DNS-over-HTTPS resolver from your browser. The certificate and logo cannot be read by a web page — their servers send no CORS headers — so the page sends those two URLs, and nothing else, to our server. It downloads them through the same guarded path every server-side download on this site uses: HTTPS only, every address screened against private and reserved ranges, the connection pinned to the screened address, redirects re-checked, 256 KB for a certificate and 64 KB for a logo. The files are passed back only if they really are certificates or SVG, and kept for a day so a popular brand's files are not fetched again for every visitor. In the paste mode nothing leaves your browser at all.