Skip to content
Toolbox

DKIM and BIMI Check

The DKIM check finds your domain's keys and checks their length; the BIMI check verifies brand logo, certificate and the required DMARC policy.

DKIM and BIMI are related: DKIM signs outgoing mail so receivers can verify it came unchanged from your domain. BIMI shows your logo next to the message in supporting mailboxes, but requires an enforced DMARC policy. Both checks are in the Mail category and both require a license.

DKIM check

Your domain publishes the public DKIM key as a TXT record at <selector>._domainkey.<domain>. The selector is chosen by the mail server or service provider. It appears in every signed message in the DKIM-Signature header as s=.

How to check

  1. Enter the domain.
  2. Enter the selector in the Selektor field, for example google or selector1. Separate several with commas or spaces.
  3. Click Prüfen (check).

If you leave Selektor empty, the app tries 46 common selectors, including those of Microsoft 365 (selector1, selector2), Google Workspace (google), Mailchimp, SendGrid, Fastmail, Proton and German hosting providers such as IONOS and Strato. That’s handy for a first look. Only a check with the selector from a real message is conclusive, though.

The DKIM-Schlüssel (DKIM keys) table shows type, length, status and the queried name for each selector found. If the name is delegated to a provider by CNAME, the target is shown as well.

Findings

Finding Meaning and what to do
RSA key with 2048 bits (or Ed25519) OK.
RSA key with 1024 bits Warning: 2048 bits is standard today. Increase it at the next key rotation.
„RSA-Schlüssel mit nur … Bit“ (under 1024) Error: receivers treat the signature as invalid. Generate a new 2048-bit key.
„Schlüssel widerrufen (leeres p=)“ Key revoked. Signatures with this selector fail. That’s intended after a key rotation.
„Testmodus (t=y)“ Test mode: receivers treat signed mail like unsigned mail. Remove it after testing.
„Kein DKIM-Schlüssel unter …“ No DKIM key: the name doesn’t exist or contains no DKIM record. Check the selector.
several DKIM records Only one per selector is allowed.
error in the record For example a missing p, invalid Base64, an unknown key type, or an s= that excludes email.
„h=… erlaubt kein sha256“ sha1 is considered insecure. Remove h= or allow sha256.
„Unter 46 gängigen Selektoren kein DKIM-Schlüssel gefunden“ No key among 46 common selectors. That doesn’t mean DKIM is missing. Check with the s= value from a message.
„… Selektoren ohne Antwort“ Some queries got no answer. Try again later or pick another resolver.

BIMI check

BIMI (Brand Indicators for Message Identification) is a TXT record at default._bimi.<domain>. It contains the logo URL (l=) and optionally a mark certificate (a=). If a subdomain has no record, the app looks at the organizational domain.

What is checked

DMARC prerequisite. Without enforced DMARC, no mailbox shows a logo. The app therefore checks the domain’s DMARC record first:

Finding Meaning
„DMARC-Voraussetzung erfüllt“ requirement met: p=quarantine or p=reject for 100% of messages
„DMARC-Policy „none“ reicht für BIMI nicht“ raise p to quarantine or reject
„DMARC pct=…“ BIMI requires the policy to apply to 100%
„DMARC sp=none“ warning: some mailboxes require a policy for subdomains too
„Kein DMARC-Record“ set up DMARC first

The record. It must start with v=BIMI1 and give the logo or certificate via https. An empty l= means the domain deliberately opts out of BIMI.

The certificate. Gmail and Apple Mail only show the logo with a Verified or Common Mark Certificate (VMC/CMC). If a= is missing, you get a warning. If a= is set, the app only checks that it’s present. It doesn’t download or validate the certificate itself.

The logo. The app downloads the SVG file (10-second timeout) and checks:

  • whether it is reachable with HTTP 200 and really is an SVG,
  • whether it uses the SVG Tiny PS profile (baseProfile="tiny-ps"),
  • whether it is at most 32 KB,
  • whether it contains scripts or event handlers, which BIMI forbids.

If the domain has no BIMI record, that’s only a note. BIMI is optional.

In the browser

In the web version, CORS usually blocks fetching the logo. The app reports this as a note rather than an error. The desktop app checks the logo fully.

See also