Our source and coverage
We collect records directly from DigiCert’s Gorgon Certificate Transparency log, listed by the BIMI Group. We do not copy statistics from another dashboard. One log can contain certificates from several issuing authorities.
The initial dataset covers entries from index 0 through the collection cursor. The dashboard shows the latest processed count, checkpoint size and successful collection time. The HTML snapshot was generated on 1 Nov 2026, 20:03 UTC; JavaScript requests current results from our data service.
This is a view of the monitored log, not a complete census of BIMI, every certificate authority or every domain using a logo. Certificate-free BIMI and certificates that only appear elsewhere are outside this dataset. A provider missing from a chart does not mean it does not issue BIMI certificates.
What is a mark record?
We identify end-entity certificates carrying the BIMI extended key usage (OID 1.3.6.1.5.5.7.3.31). Each issuer and serial-number pair is counted once. Repeated log entries and matching precertificate/final-certificate pairs do not add another record. Renewals normally have a new serial number and count separately.
A precertificate is a record of intent to issue a certificate. It does not prove that a final certificate was issued or deployed. The overview includes these records; the explorer can show only entries where a final certificate was observed, or only precertificates.
How we distinguish VMC and CMC
We read the certificate’s markType subject attribute, following the Mark Certificate Requirements. Registered Mark and Government Mark map to VMC; Prior Use Mark, Modified Registered Mark and Provisional Mark map to CMC. Missing or unrecognised values remain Unknown; we do not guess from the issuing authority’s name.
Dates, issuers and validity
Activity charts use the earliest CT timestamp we observed for each record, in UTC. This is not necessarily its exact issuance date. Certificate validity may begin earlier. The issuer chart uses the organisation stated in the certificate’s issuer field, rather than inferring a reseller or corporate parent.
An expiry date is a certificate field, not a live validity verdict. This release does not verify revocation, certificate chains, CT signatures or inclusion proofs. We fetch the log over HTTPS and inspect its contents; this is an observatory, not a certificate validator.
Updates and failures
The data service checks the log at 17 minutes past every hour (UTC), independently of a visitor’s browser. An open dashboard requests fresh data every five minutes while visible and keeps its selected filters. Responses may be cached for up to fifteen minutes. Rate limits or the monthly query allowance can temporarily pause live queries; the last loaded data and its timestamp remain available. Collection resumes from its saved cursor and commits records with that cursor. An invalid entry stops the batch instead of silently skipping it. A failed update retains previous records; the dashboard marks collection as delayed after three hours without a successful check.
Reading the interactive charts
Shared date, type, authority, country, evidence and certificate-date filters apply to all charts and the records table. Date ranges include both endpoints in UTC. Weekly buckets start on Monday; boundary buckets can be partial. The activity chart uses first-log timestamps by default; “Validity start” uses the certificate’s not-before field, not an independently verified issuance time.
Cumulative totals begin at zero at the selected range’s start. Country is the certificate subject’s country, not the locations of recipients. Expirations cover the filtered cohort’s remaining expiries in the current and next five calendar months. The heatmap counts that cohort by weekday and hour. Rankings show the top ten; CSV exports include the full grouped breakdown. These are observations of certificates, not unique-domain adoption counts.
What we do not measure yet
We do not currently crawl the listed domains, check their BIMI or DMARC records, fetch their logos, or test inbox display. No deployment or adoption percentage is inferred from certificate counts. DNS history can be added as a separate, clearly dated observation later.
Reproducible evidence
Open a search result to see its domains, mark type, validity dates, serial number, SHA-256 fingerprint and public CT entry. The API follows RFC 6962. Public certificate observations can be incomplete or contain errors; report a concern to bimicert@gmail.com.