Find out why your logo is not showing
BIMI fails on the prerequisite far more often than on the logo. Your DMARC policy, the logo URL and the VMC behind it are checked together, and you get a readiness score that says which part is missing
The prerequisite nobody meets
BIMI needs DMARC at quarantine or reject with pct=100. A domain at p=none will never show a logo no matter how good the artwork is
- DMARC policy read and judged
- pct=100 required and checked
- Subdomain policy considered
- Worth 40 of the 100 readiness points
The certificate and its expiry
The VMC is fetched and the leaf certificate parsed, so you know how many days are left before the logo quietly stops appearing
- VMC fetched over HTTPS
- Leaf certificate parsed
- Expiry date and days remaining
- A missing a= tag called out
The logo, reachable and plausible
The URL in your l= tag is fetched and what comes back is examined, because a logo behind a redirect or a login page is a logo nobody sees
- HTTPS required for l= and a=
- The URL actually fetched
- Content type recorded
- Checked that the body looks like SVG
What the BIMI check does
Four things have to be true at once for a logo to appear, and the one that fails is usually not the one people look at first
A readiness score, not a yes or no
Out of 100, with the parts named
DMARC enforcement is worth 40 points, the logo URL 20, and the rest comes from the logo and certificate being reachable. A score tells you how far you are and which piece to do next, which a red cross does not
The DMARC gate, checked properly
p=quarantine or reject, and pct=100
Almost every BIMI question turns out to be a DMARC question. A policy of none disqualifies you outright, and a quarantine policy with pct set below 100 disqualifies you just as surely while looking like it should work
How long the VMC has left
Parsed from the certificate itself
The certificate is fetched and its leaf parsed, so the expiry comes from the certificate rather than from a note somebody made when it was bought. A VMC is expensive and expires quietly, and the logo simply stops appearing
HTTPS, and nothing else
For both the logo and the certificate
A plain HTTP URL in l= or a= is not merely poor practice, it disqualifies the record. Both URLs are checked for scheme before anything is fetched, and a non-HTTPS one is reported as the reason rather than as a generic failure
What is actually at the URL
Fetched, not assumed
The logo URL is requested and the response examined: the status, the content type, and whether the body looks like SVG at all. A URL that used to serve a logo and now serves a redirect or an error page fails here rather than in somebody mail client
The record read as a record
Selector, tags and syntax
The BIMI record at your selector is parsed as a tag list, with a missing l= or a= named individually. A default selector is assumed where you do not give one, the same way a receiver would
Where the hundred points come from
Four things are scored, and the first is worth twice as much as any other. A logo that never appears is usually the first one, not the last three
| Scored | Points | What full marks require |
|---|---|---|
| DMARC enforcement | 40 | A policy of quarantine or reject with pct at 100. A policy of none scores nothing here, whatever else is in place |
| Logo URL | 20 | An l= tag in the record, served over HTTPS |
| Logo validation | 20 | The file at that URL fetched and read as SVG Tiny PS, not merely reachable |
| VMC certificate | 20 | An a= tag whose certificate is fetched, parsed and still in date |
Partial credit exists inside each row, so a score is not a count of how many of the four passed
Three steps, and the first one is the hard one
If your DMARC is not at enforcement yet, that is the whole project. The rest is an afternoon
Check the DMARC gate first
Quarantine or reject, with pct at 100. Until that is true nothing else about BIMI matters, and the readiness score will say so
Publish the record and check what is behind it
The l= and a= URLs are fetched over HTTPS and what comes back is examined, so a broken link is found here rather than by a customer noticing no logo
Watch the certificate expiry
On an account the VMC expiry is tracked from the certificate itself, so the renewal is a calendar item rather than a surprise
Questions about BIMI
Why the logo is not appearing, what a VMC costs you in practice, and which mailbox providers act on it
BIMI requires a DMARC policy of p=quarantine with pct=100 or p=reject. If your domain is at p=none or has a reduced percentage, mailbox providers will ignore the BIMI record.
While some clients show logos without it, major providers like Gmail require a Verified Mark Certificate (VMC) for your logo to be displayed.
It is a specialized, secure version of SVG. BIMI requires this profile to prevent security risks associated with standard SVG files.
Once your record and VMC are correctly configured and cached by ISPs, it usually takes 2-4 days for your logo to start appearing consistently.
The BIMI record is read every ten minutes, and the logo and certificate URLs are fetched to check they still answer. The VMC expiry comes from the certificate itself rather than from a note somebody made. If the logo becomes unreachable, the certificate expires, or your DMARC policy drops below enforcement, the check fails and you get an email.
Find out how far you are from a logo
The readiness score tells you in a minute whether this is an afternoon of work or a DMARC project. One free domain, and no card