Why BIMI Fails in Gmail Even With a Valid Certificate

Your BIMI record passes every online checker. Your certificate is valid. Your SVG logo looks fine in a browser. And yet Gmail shows nothing.

The general BIMI spec is well documented. Gmail's actual requirements are not. Most troubleshooting guides cover the basics - the TXT record, the HTTPS URL, the SVG format. They do not cover the four specific requirements that Gmail enforces and most tools do not check.

This guide is about those four requirements and how to test for all of them at once using DMARCFlow's BIMI Checker, which was built specifically to catch Gmail's stricter validation rules.

What Gmail actually requires for BIMI

Gmail is one of the strictest major mailbox providers when it comes to BIMI. It does more validation than the baseline BIMI spec requires, and it does not give you an error message when something is wrong - it simply does not show your logo.

The four things Gmail checks that your existing BIMI checker might not:

#### 1. VMC or CMC: Gmail requires a certificate

BIMI supports two types of certificates. A Verified Mark Certificate (VMC) is issued by a supported Certificate Authority after identity verification. A Certificate Authority Certificate (CMC) is a self-signed certificate from a CA that has not completed the full VMC validation process.

Gmail requires a VMC for your logo to display. A CMC will not work. If you have a certificate but your logo is not showing in Gmail, this is the first thing to check.

Getting a VMC costs money and takes time - typically 5 to 10 business days after identity verification. If you only have a CMC, Gmail will silently skip your logo. There is no error, no warning in your DMARC reports, just no logo.

#### 2. DMARC policy: p=none does not qualify

The BIMI spec allows a domain to have p=none in its DMARC record and still publish a BIMI record. Gmail does not follow the baseline spec here. Gmail requires the sending domain to have a DMARC policy of either p=quarantine or p=reject.

If your DMARC policy is p=none, Gmail will not display your BIMI logo regardless of how correct everything else is. This catches many people who set up BIMI in a testing environment before moving their DMARC policy to enforcement.

The SVG Tiny P profile: the most common actual failure

Even when the certificate is correct and DMARC policy is at enforcement, the SVG logo is where most BIMI setups break. Gmail validates your SVG against the W3C Tiny P profile specification, and most design tools do not produce compliant SVGs by default.

#### What makes an SVG Tiny P compliant

The Tiny P profile is a restricted subset of SVG designed for small logo display in email clients. Your SVG must pass these checks:

No JavaScript. Any script tag invalidates the logo immediately.
No external references. This means no external images, no external fonts, no use elements pointing to external URLs.
No CSS animations. Even if the animation is purely decorative, Gmail rejects animated SVGs for BIMI.
A defined viewBox attribute. The viewBox must be set to the exact dimensions of the logo.
No width or height attributes on the root SVG element. Use viewBox instead.
No gradient fills or filters that reference external resources.

The most common mistake is exporting an SVG from Figma, Illustrator, or Inkscape with default settings. These tools often include embedded images, used fonts, or CSS that fail Tiny P validation.

#### How to check if your SVG complies

The most reliable way to check is to run your SVG through a validator. DMARCFlow's BIMI Checker validates SVG Tiny P compliance as part of its full Gmail-ready check, and it reports which specific element in your SVG is causing the failure. You can also use the W3C SVG Tiny P validator directly.

If you are comfortable reading SVG source, open the file and look for script tags, use elements, style blocks with @import, and any element that references an external URL.

HTTPS logo URL requirements that trip people up

Your BIMI record contains an l= parameter that points to your SVG logo over HTTPS. Gmail validates this URL strictly.

#### MIME type must be exactly image/svg+xml

Your web server must serve the SVG with the Content-Type header set to image/svg+xml. Not text/xml. Not application/xml. Not text/html. If your server is misconfigured and serves the SVG with the wrong MIME type, Gmail rejects it.

This is a common mistake with sites that use PHP, Node, or ASP.NET to serve files, because the default MIME type detection may not handle SVG files correctly.

To check: use curl -I on your logo URL and look for the Content-Type header.

curl -I https://your-cdn.example.com/logo.svg

Look for:

Content-Type: image/svg+xml

Anything else means Gmail will not load your logo.

#### Redirects and certificate mismatches

Your logo URL must be served directly without HTTP redirects. A 301 or 302 redirect from HTTP to HTTPS, or from one domain to another, breaks BIMI validation in Gmail.

Your HTTPS certificate must also cover the domain serving the logo. If your certificate is for www.example.com but your l= parameter points to cdn.example.com, Gmail will reject it due to a certificate name mismatch.

Step-by-step Gmail BIMI checklist

Work through these items in order. Stop at the first failure - that is your fix.

1. Your DMARC policy is p=quarantine or p=reject. If it is p=none, this is why Gmail is not showing your logo.

2. You have a VMC from a supported CA. A CMC or self-signed certificate will not work in Gmail. If you are not sure, check with your certificate provider.

3. Your SVG logo passes Tiny P profile validation. Run it through DMARCFlow's BIMI Checker or the W3C validator and fix every flagged element.

4. Your logo URL serves over HTTPS with no redirects. Check the URL directly and verify the certificate covers the exact hostname used.

5. The Content-Type header on your logo URL is exactly image/svg+xml. Fix your web server configuration if it is wrong.

6. Your BIMI TXT record has v=BIMI1 and the correct l= parameter pointing to your logo URL.

How to test your BIMI setup before Gmail

Before sending a test email to Gmail, run your domain through DMARCFlow's BIMI Checker. It validates all of the above in a single pass: TXT record syntax, VMC presence, SVG Tiny P compliance, HTTPS availability and MIME type, and DMARC policy level. If the checker shows green across all items, your setup is Gmail-ready.

If the checker flags something, fix it and run it again. Gmail is slow to update its BIMI cache, so catching and fixing issues before you send test emails saves you from waiting for cache expiry before you can retest.

Gmail caches BIMI data aggressively. After fixing a configuration issue, wait up to 24 hours before testing again. Gmail may show your old result even after you have corrected the problem.

FAQ

Does Gmail require a VMC for BIMI?
Yes. Gmail requires a Verified Mark Certificate (VMC), not a CMC or self-signed certificate. This is the most commonly missed Gmail-specific requirement.

Can I use a CMC certificate for BIMI in Gmail?
No. Gmail does not accept CMC certificates for BIMI display. Only VMC certificates from supported Certificate Authorities meet Gmail's requirements.

Why does my SVG logo fail validation even though it looks correct in a browser?
Most design tools export SVGs with features that fail the Tiny P profile: embedded images, external fonts, CSS animations, or script tags. A logo can look perfect in a browser and still fail Tiny P validation. Run your SVG through a validator to find the specific issue.

Does p=none DMARC policy affect BIMI in Gmail?
Yes. Unlike some mailbox providers, Gmail requires DMARC to be at p=quarantine or p=reject before it will display a BIMI logo. If your policy is p=none, your logo will not appear in Gmail regardless of how correct your BIMI record is.

How long does it take Gmail to show my BIMI logo after I fix the configuration?
Gmail caches BIMI data for up to 24 hours. If you have fixed a configuration issue, wait a full day before testing again. In some cases the cache TTL can be longer.

---

Last updated: 2026-07-29