To show a BIMI logo, three things must all be true at once: DMARC must be at enforcement (p=quarantine or p=reject, with pct=100), your logo has to be a compliant SVG Tiny PS file served over HTTPS, and where a mailbox provider demands it, you need a Verified Mark Certificate or Common Mark Certificate. Even with all three in place, display is never guaranteed; each mailbox provider decides independently whether to render your logo.
TL;DR:
- Achieving DMARC enforcement with p=quarantine or reject at 100% and ensuring DKIM alignment for all senders are critical, as many issues stem from misconfigured policies or third-party senders.
- The SVG logo must be a compliant SVG Tiny PS file, under 32 KB, with no scripts, embedded rasters, or metadata, and hosted over HTTPS with correct MIME type to render properly.
- Validating and obtaining a VO certificate, such as a VMC or CMC, involves trademark or long-term brand use proof and validation, which can delay implementation if not coordinated early.
- Publishing the BIMI TXT record requires precise syntax and URLs that correctly resolve with content-type verification, with testing across multiple mailbox providers before going live.
- The major obstacle often lies in internal approval processes and legal coordination, making early engagement with legal, brand, and procurement essential to shorten BIMI rollout timelines.
Digistrat
Make BIMI Readiness More Predictable
Digistrat assesses sender reputation, infrastructure, and list quality to help businesses address email deliverability issues affecting performance.
Table of Contents
- Implementation checklist: your BIMI readiness order of work
- What DMARC, SPF and DKIM alignment actually require
- Getting the logo file and hosting right
- VMCs and CMCs: when you need a certificate and how they differ
- Publishing the BIMI TXT record correctly
- Rolling out and diagnosing silent failures
- Digistrat’s approach to shortening BIMI time-to-live
- Why the DMARC step gets underrated
- Get BIMI ready without the guesswork
- Sources
- FAQ
Implementation checklist: your BIMI readiness order of work
Most BIMI projects stall not because the specification is unclear but because teams tackle tasks out of order and discover a blocker three weeks in. Work through this sequence and assign an owner to each task before you start.
- Inventory every authorised sender (security team) sending on your behalf, including marketing platforms, transactional services, and any third-party vendors using your domain.
- Achieve DKIM alignment (security/DNS team) so signed mail matches your visible From domain.
- Move DMARC to p=quarantine, then p=reject, with pct=100 (security team), monitoring aggregate reports at each stage.
- Prepare your SVG Tiny PS logo file (design team), keeping it under the file-size limit and free of scripts or embedded rasters.
- Host the SVG and PEM certificate over HTTPS (DNS/infrastructure team) on a stable, always-available domain.
- Publish the BIMI TXT record (DNS team) at the correct hostname.
- Validate and test (security team) against multiple mailbox providers before declaring victory.
Legal involvement usually sits alongside the certificate step, not at the end, particularly if a VMC is required; consider how to master the professional development process for online growth to better coordinate your BIMI rollout.
What DMARC, SPF and DKIM alignment actually require
“Enforcement” is the word that trips up most teams. It means your DMARC policy is set to p=quarantine or p=reject, applied at pct=100, on the organisational or apex domain and any subdomain that sends mail carrying your brand. A policy of p=none tells mailbox providers you are only monitoring, not enforcing, and BIMI Group’s implementation guidance is explicit that neither p=none nor a partial pct value below 100 will be accepted for BIMI eligibility.
DKIM alignment is the more reliable route to get there safely. DMARC passes when either SPF or DKIM aligns with the visible From domain, but DKIM tends to survive forwarding and third-party resending far better than SPF, which breaks the moment a message is relayed through an intermediate server. Building your enforcement plan around DKIM alignment for every authorised sender, rather than leaning on SPF alone, avoids a lot of the mail that silently vanishes once you flip the switch.
A safe phased plan looks like this:
- Gather DMARC aggregate reports for at least two to four weeks to see who is actually sending on your domain.
- Build a full authorised-sender inventory from those reports, cross-checked against what marketing and IT believe is in use.
- Implement DKIM signing and SPF alignment for each sender individually, retesting after each change.
- Move to p=quarantine and hold there while monitoring RUA and RUF reports for unexpected failures.
- Move to p=reject with pct=100 once quarantine has run clean for a reasonable period.
Pro Tip: The most common pitfall is a third-party sender, often a CRM plug in or event platform, that authenticates mail with SPF but never signs with an aligned DKIM key. It passes DMARC quietly right up until you reach p=reject, at which point it disappears from inboxes with no warning. Digistrat’s own notes on SPF, DKIM and DMARC alignment cover this failure mode in more depth, and the 90 day plan for UK teams sets out a similar staged rollout if you want a template to work from.
Getting the logo file and hosting right
The BIMI specification requires a very specific image format, and this is where a surprising number of otherwise well-executed projects fail silently. Your logo must be built to the SVG Tiny PS profile, which means:
- No scripts, no animation, and no external references of any kind.
- No embedded raster images (no JPEGs or PNGs hidden inside the SVG).
- A square aspect ratio, with a solid background colour recommended for consistent rendering across dark and light mail clients.
- No unnecessary metadata or editor cruft left in by design tools such as Illustrator or Figma.
File size matters more than most teams expect. BIMI Group’s guidance sets the practical ceiling at under 32 KB, and several mailbox providers will simply decline to fetch anything larger.
Host the file on a stable HTTPS endpoint that serves the correct MIME type, image/svg+xml. A misconfigured web server that returns text/plain or application/octet-stream for an SVG file is one of the most common and most invisible causes of a BIMI record that looks perfect in DNS but never renders anywhere. Run a quick check with curl -I https://yourdomain.com/logo.svg and confirm the content-type header before you go anywhere near DNS publication.
VMCs and CMCs: when you need a certificate and how they differ
Not every mailbox provider requires a certificate to show your logo, but the two largest, Gmail and Apple Mail, generally do, which makes this section unavoidable for most UK brands. A Verified Mark Certificate requires a registered trademark plus rigorous identity validation of your organisation, while a Common Mark Certificate offers an alternative route for brands that can document at least 12 months of consistent public use of the mark without holding a registered trademark. Some providers, including Yahoo! and AOL, will accept a self-asserted BIMI record with no certificate at all, which is worth knowing before you spend budget on a VMC you may not strictly need for every mailbox provider your recipients use.
Whichever certificate you pursue, expect the issuing authority to request:
- Evidence of trademark registration (for a VMC) or documented proof of public brand use spanning a year or more (for a CMC).
- Corporate identity documentation, including registration details and authorised signatory confirmation.
- Your finished SVG Tiny PS logo file, submitted for validation against the mark on record.
The certificate itself is delivered as a PEM file, and the order of certificates inside that file matters: entity certificate first, then any intermediates, then the root. Get that ordering wrong, or omit an intermediate, and the certificate chain fails validation even though the certificate itself is perfectly valid.
Pro Tip: Loop in legal or trademark counsel the day you decide to pursue BIMI, not the week you’re ready to publish DNS records. Identity and trademark verification is consistently the slowest part of the entire project, and there is no way to compress it once it’s underway. Established certificate authorities including DigiCert, Sectigo, and GlobalSign all issue VMCs and CMC-equivalent certificates, so it is worth getting quotes and timelines from more than one before committing.
Publishing the BIMI TXT record correctly
The DNS record is short, but every character matters. The canonical form looks like this:
<code>default._bimi.yourdomain.com. IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/cert.pem"
</code>v=BIMI1declares the record version and must appear first, exactly as written.l=points to your hosted SVG logo URL.a=is optional but points to your certificate PEM URL where one is required.avp=is rarely used but reserved for BIMI Assertion Verification Provider information.- The record must sit at the
default._bimisubdomain of the domain used in the visible From address, per Google Workspace’s setup guidance.
Keep the TTL sensible (an hour or two while testing, longer once stable), avoid stray quotation marks or semicolons that break the TXT syntax, and retrieve both URLs manually with curl to confirm they return the expected content before you consider the record live. A surprising number of “broken” BIMI records turn out to be a copy-paste error in the DNS console rather than anything wrong with the logo or certificate itself.
Rolling out and diagnosing silent failures
Test in this order, and don’t skip a step because an earlier one “should” have worked:
- Confirm DMARC is passing at enforcement for real production traffic, not just test messages.
- Verify the BIMI TXT record resolves correctly from an external DNS lookup tool.
- Retrieve the SVG file directly and check both the content-type header and that it renders as expected.
- Validate the PEM certificate chain, confirming ordering and that no intermediate is missing.
- Send test messages to accounts on several major mailbox providers and inspect both the raw headers and the rendered inbox.
When the logo doesn’t show despite every check passing, the usual suspects are: DMARC quietly slipping back to p=none or pct<100 after a DNS change; an SVG that technically validates but fails a stricter provider-side check; a PEM chain missing an intermediate; or, less obviously, a sender reputation issue. BIMI Group notes that mailbox providers apply their own reputation and engagement thresholds independently of the technical checks, so a domain with patchy sender reputation can pass every specification test and still never display a logo.
Pro Tip: Build a recurring monthly check into your calendar, not just a one-off launch test. DNS caching delays mean changes can take days to propagate fully, and provider-side policy tweaks happen without warning. If a trademark dispute or identity mismatch surfaces during certificate renewal, escalate to your certificate authority and legal counsel immediately rather than waiting for the next scheduled review.
Digistrat’s approach to shortening BIMI time-to-live
Digistrat runs BIMI readiness as a structured workstream rather than a single DNS change, because the DNS record is genuinely the easy part. A typical engagement starts with a discovery audit of existing authentication, followed by DMARC aggregate report analysis to build an accurate authorised-sender inventory before anyone touches enforcement policy.
- Discovery audit of current SPF, DKIM and DMARC posture, plus sender inventory.
- DKIM and SPF alignment work across every identified sender, verified before moving policy.
- DNS and hosting verification for the SVG and PEM files, including MIME-type and chain checks.
- Certificate procurement assistance, coordinating with legal and brand teams to reduce VMC delays.
- Controlled rollout with monitoring at each DMARC enforcement stage.
James, who leads these engagements at Digistrat, has seen the same pattern repeat across UK clients: technical readiness is rarely the bottleneck, but slow internal sign off between legal, brand, and IT consistently is. Bringing procurement and legal into the conversation at week one, rather than at the certificate application stage, is what actually shortens the timeline.
Why the DMARC step gets underrated
The part of BIMI that gets the least attention in most guides is also the part that determines almost everything else: reaching genuine DMARC enforcement without breaking legitimate mail. Vendors and marketing teams tend to treat the DNS TXT record and the logo file as the “real” work, because they’re visible and finite. They’re not.
The uncomfortable truth is that most organisations that fail to get BIMI live aren’t blocked by a certificate authority or a malformed SVG. They’re blocked because nobody built a proper authorised-sender inventory before flipping DMARC to enforcement, and three business-critical systems quietly stopped sending mail. That’s not a BIMI problem. It’s an authentication hygiene problem that BIMI simply forces into the open, which is arguably its most useful side effect regardless of whether the logo ever appears.
If you take one thing from this checklist, prioritise the DMARC and DKIM alignment work above the logo design and certificate procurement. Get enforcement clean first. Everything downstream of that becomes considerably easier, and considerably less risky.
Get BIMI ready without the guesswork
BIMI implementation can be smoother with direct support from a senior specialist handling the technical detail, providing precise identification of authentication issues and resolving them, rather than just producing a report for you to action.
For readers working through the checklist above, Digistrat’s relevant services cover the parts that most commonly stall: Deliverability Review and Fix to diagnose exactly where your DMARC and DKIM alignment stands, dedicated Authentication setup work to get you safely to enforcement, and a fixed £250 one-off Advisory session if you just need an expert to sanity check your record before you publish it. If you’re not sure where your domain currently stands, book a free health check and get a clear, honest view of what’s actually blocking your logo from showing.
Sources
FAQ
What are the requirements for a BIMI logo?
A BIMI logo requires DMARC at enforcement, meaning p=quarantine or p=reject with pct=100, alongside a compliant SVG Tiny PS logo hosted over HTTPS. Where a mailbox provider demands it, such as Gmail or Apple Mail, you’ll also need a VMC or CMC certificate.
How much does a BIMI certificate cost?
Certificate pricing varies by issuing authority and by whether you need a full VMC (requiring a registered trademark) or a CMC, and is not published as a fixed industry rate. If you’d rather have an expert scope the certificate route and cost for your specific case, Digistrat’s Advisory session is available for a fixed one-off fee of £250.
Is a BIMI record necessary?
BIMI isn’t mandatory for email delivery and won’t affect whether your mail reaches the inbox, since it’s a display signal rather than a security protocol. It’s worth pursuing mainly because the DMARC enforcement work it requires meaningfully reduces impersonation risk, with logo display as a visible bonus rather than the main prize.
How do you implement BIMI?
Implementation runs in a fixed order: reach DMARC enforcement with DKIM alignment across every authorised sender, build a compliant SVG Tiny PS logo hosted over HTTPS, obtain a VMC or CMC certificate if your target mailbox providers require one, then publish the BIMI TXT record and test across providers. Digistrat’s deliverability services cover each of these stages for teams who want the technical work done directly rather than managed in house.
