Somewhere in your inbox right now, a competitor's logo is sitting neatly next to their emails. Yours has a grey circle with your first initial.
That isn't a design choice. It's a broken BIMI setup — and it's extremely common. One 2025 analysis of published BIMI records found that over half of them contain at least one error that silently prevents the logo from ever displaying. No error message. No warning. The record simply fails, quietly, until someone goes looking for it.
This guide is that someone. It covers exactly what BIMI requires in 2026, the specific reasons it fails, and the order in which to check and fix your own setup.
Why Your Logo Isn't Showing: The Short Answer
Almost every broken BIMI setup fails for one of four reasons. In rough order of how often they appear:
- DMARC is published but not enforced. The policy is set to
p=none, so BIMI ignores it.
- The BIMI DNS record is missing or malformed. A typo, a dead link, or a missing certificate reference.
- The logo file isn't valid SVG Tiny P/S. It looks like a logo but fails Gmail's technical validation.
- There's no VMC or CMC certificate. Gmail won't render a logo without one, even if everything else is perfect.
The single most common cause is DMARC stuck at p=none. If you only fix one thing, check that first.
What BIMI Actually Is
BIMI stands for Brand Indicators for Message Identification. It's the standard that lets your logo appear next to your emails in the inbox — in Gmail, Yahoo Mail, Apple Mail and a growing list of other providers.
The key thing to understand is that BIMI is not a security system of its own. It's a display layer that sits on top of your existing email authentication. It only activates once SPF, DKIM and DMARC are already passing and enforced.
Think of it as the reward for getting your authentication foundation right — not a separate project. That's why DMARC and BIMI are always discussed together: you cannot have the second without the first.
The business case is bigger than aesthetics. A 2025 consumer survey found that roughly half of respondents said a verified logo in the inbox would influence which brand's email they engaged with first, and separate research measured meaningfully higher open rates on campaigns where a BIMI logo was present.
The Three Things BIMI Requires — All at Once
BIMI has no partial credit. Every one of these needs to be correct at the same time, or the logo doesn't display:
| Requirement |
What It Means |
| DMARC enforcement |
Policy set to p=quarantine or p=reject, with pct=100 |
| A valid BIMI DNS record |
Published at default._bimi.yourdomain.com, pointing to your logo and certificate |
| A compliant logo and certificate |
Square SVG Tiny P/S file, plus a VMC or CMC for Gmail |
Miss any one of the three, and the result is identical from your recipient's perspective: no logo. That's what makes BIMI frustrating to debug — the failure is silent, and there's no single dashboard that tells you which piece is wrong.
Requirement 1: Enforce DMARC (Not Just Publish It)
This is where most BIMI setups break, and it's the one worth checking first.
Having a DMARC record published is not the same as having DMARC enforced. A huge number of domains publish DMARC at p=none — monitoring mode, which reports on failures but doesn't act on them. BIMI ignores p=none entirely.
To qualify, your DMARC record needs:
- Policy (
p=) set to quarantine or reject
pct=100, meaning the policy applies to all mail, not a sampled percentage- SPF and DKIM already aligned and passing for every legitimate sending source on the domain
One warning before you flip the switch: if you jump straight to p=reject without auditing every tool that sends mail from your domain — your ESP, your CRM, your support desk, your HR platform — you risk blocking legitimate email, not just spoofed email. This is the step that takes the longest, and it's also the step most guides skip past. Do it properly before touching anything else.
Requirement 2: The BIMI DNS Record
Once DMARC is enforced, you publish a TXT record at:
default._bimi.yourdomain.com
With a value structured like:
v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/certificate.pem
l= points to your hosted logo file (must be HTTPS)a= points to your certificate file (required for Gmail; optional for providers that support self-asserted logos)
A single typo, an expired hosting link, or a missing trailing slash in either URL is enough to break the entire record. For a full walkthrough, see our guide to BIMI setup.
Requirement 3: A Compliant Logo and a Valid Certificate
The Logo File
The logo must be:
- SVG Tiny P/S format — a restricted subset of SVG. Most design tools export regular SVG, which will fail validation without conversion.
- Square in aspect ratio
- Under 32KB in file size
- On a solid background
- Hosted over HTTPS
The Certificate
The certificate determines where your logo actually shows up:
| Certificate |
Requires |
Gmail Logo |
Gmail Checkmark |
Other Providers |
| None (self-asserted) |
Nothing beyond DMARC enforcement |
No |
No |
Yes — Yahoo, Fastmail and others |
| CMC (Common Mark Certificate) |
12+ months of continuous public logo use |
Yes |
No |
Yes |
| VMC (Verified Mark Certificate) |
A registered trademark |
Yes |
Yes |
Yes |
The CMC is the newer, more accessible option — it opened Gmail logo display up to brands without a trademark, which previously locked out a lot of startups and smaller e-commerce brands. If you specifically want the blue verified checkmark, only a VMC will trigger it, and VMCs are valid for a maximum of 397 days before they need renewing.
Fix It in 30 Minutes: A Step-by-Step Diagnostic
If you believe your setup is "mostly right" and it still isn't rendering, work through these in order. Each step rules out one specific failure point.
- Check your DMARC policy first. Look up your domain's DMARC TXT record. If it says
p=none, stop here — that's your answer, and it needs fixing before anything else matters.
- Confirm
pct=100. A policy of p=reject; pct=50 will not qualify. It needs to be 100.
- Look up your BIMI TXT record. Query
default._bimi.yourdomain.com and confirm it resolves and matches the format above exactly.
- Open the logo URL directly in a browser. If it doesn't load, or returns a 404, that's your break.
- Validate the SVG is Tiny P/S format, not a standard SVG export. This is one of the most common silent failures — the file looks fine but fails validation.
- Open the certificate URL directly. Confirm it loads as a valid PEM file, and check its expiry date if it's a VMC.
- Check domain alignment. The domain in your BIMI record, your certificate, and your email's visible
From: address all need to match — including matching at the organisational domain level if you send from a subdomain.
- Send yourself a test email from the exact sending domain and check it in Gmail directly. Some validators check DNS and file presence but can't confirm final rendering.
If all eight check out and the logo still isn't appearing, the most likely remaining cause is sender reputation. Some providers apply an additional trust threshold on top of technical BIMI compliance, particularly for newer or lower-volume sending domains. That one can't be fixed with a DNS change — it resolves with consistent, well-authenticated sending over time.
The Most Common BIMI Mistakes
If you'd rather work backwards from a symptom, here's the short map:
| Symptom |
Likely Cause |
Fix |
| No logo anywhere |
DMARC at p=none |
Move to p=quarantine or p=reject with pct=100 |
| Logo shows in Yahoo, not Gmail |
Missing VMC or CMC |
Add a valid certificate to your BIMI record |
| No checkmark next to the logo |
CMC instead of VMC |
Obtain a VMC (requires a registered trademark) |
| Logo worked, then disappeared |
Expired VMC |
Renew the certificate |
| Logo fails validation |
Standard SVG instead of SVG Tiny P/S |
Convert the file to SVG Tiny P/S |
| Wrong domain's logo shows |
Subdomain alignment issue |
Match the BIMI record to the visible From: domain |
A few other things that trip people up:
- Outlook doesn't support BIMI at all, as of mid-2026. If you're testing there, you'll never see it — that's expected, not a bug in your setup.
- BIMI follows the domain in the visible
From: header, not whatever domain your organisation considers "the real one." Large organisations sending from multiple subdomains often authenticate the wrong one.
- VMCs expire. A working setup today can silently stop working in just over a year if nobody owns the renewal.
- Testing one SVG and publishing another is more common than it sounds. Confirm the file actually hosted at your
l= URL is the final, validated version — not an earlier draft.
Where BIMI Actually Works
Before you spend an afternoon debugging, make sure you're testing in a client that supports BIMI:
| Provider |
BIMI Support (mid-2026) |
| Gmail |
Yes — requires a VMC or CMC |
| Yahoo Mail |
Yes |
| Apple Mail |
Yes |
| Fastmail |
Yes |
| Microsoft Outlook |
No |
| Most other clients |
No |
The Bottom Line
BIMI is one of the few pieces of email marketing infrastructure where the entire benefit — brand recognition, trust, and a measurable lift in engagement — sits behind a checklist rather than a creative decision. There's no design trick that substitutes for DMARC enforcement, a correctly formatted DNS record, and a compliant logo file.
The good news is that, unlike most deliverability problems, BIMI failures are fully diagnosable. Every requirement above is checkable in minutes once you know where to look. The issue was never that BIMI is hard. It's that it fails silently — and nobody was looking.
Related Articles
Related tools: Check your current setup with the Email Authentication Health Check, generate a compliant record with the Email DMARC Record Generator, or see how authentication issues could be affecting performance with the Email Engagement Score Calculator.
