Tips for progressing to BIMI: what most guides skip

Most BIMI guides explain what BIMI is and how to publish a BIMI DNS record. What they skip is everything that comes next. If you have set up the basics of BIMI and are wondering why your logo is not showing up in email clients, or what to do next to make progress, this post is for you.

The gap between "BIMI record published" and "BIMI logo visible in Gmail" is where most operators get stuck. Here is what actually matters in that gap.

DNS record timing: propagation is not instant

When you publish a BIMI DNS record, it does not become visible everywhere immediately. DNS propagation can take anywhere from a few minutes to 48 hours, depending on your DNS provider and the TTL you had set before the change. If you are checking your BIMI record within minutes of publishing, you may be checking a cached version that does not yet include it.

Before troubleshooting anything else, use a dedicated DNS lookup tool that queries authoritative nameservers directly, bypassing your local resolver cache. Check both the BIMI record itself and the underlying DKIM key that BIMI depends on. If either is missing or misconfigured at the authoritative level, BIMI will not work regardless of how long you wait.

Also check that your BIMI record is published at the same domain that appears in the From header of your emails. BIMI requires exact domain alignment, not just organizational domain matching.

Certificate requirements: VMC versus CMC and what most guides get wrong

BIMI requires a verified certificate to prove you control the domain that is sending the email. There are two types that matter: VMC (Verified Mark Certificate) and CMC (Certified Mail Certificate).

A VMC is issued by a Certificate Authority after they verify your organization's right to use the trademarked logo you are displaying. This is the original BIMI certificate type. The process is stricter and more expensive, and it is tied to a specific logo trademark.

A CMC is a lighter-weight option that does not require trademark verification. It was introduced to lower the barrier to BIMI adoption. Not all email receivers support CMC yet, so check the support matrix for your target audience before choosing.

Most guides get this wrong by not explaining the difference, or by suggesting you can skip certificates entirely. You cannot. BIMI requires either a VMC or CMC. Without it, receivers that require BIMI authentication will not display your logo.

The practical implication: if you do not have a registered trademark for your logo, the VMC path is blocked unless you are willing to register the trademark first. The CMC path may be more accessible in the near term, but verify receiver support for your specific use case.

SVG logo validation: the technical requirements that cause failures

BIMI requires SVG (Scalable Vector Graphics) format for logos. But not every SVG file works. There are specific constraints that cause validation to fail even when the file looks correct in a browser.

Your SVG must be exactly 128x128 pixels or smaller in viewBox dimensions. It cannot contain JavaScript, external references, animations, or raster image embedding. It must be a valid SVG 1.1 document. Some SVG files that are generated by design tools include elements that are valid in a browser but fail strict SVG 1.1 validation.

Use a BIMI record validator to test your SVG before publishing. This catches issues that are invisible to the eye but fatal to BIMI processing. If your SVG fails validation, simplify it to the minimum required elements and re-test.

Also ensure the logo is served over HTTPS from a location that does not require authentication. If the logo URL returns a redirect or an authentication wall, BIMI validation will fail.

Handling legacy mail flows when you enable BIMI

BIMI only works when the From header domain matches the domain used to sign with DKIM. Any mail flow that changes the From header or routes mail through systems that modify headers will break BIMI.

Common culprits include:

• Mailing lists that repurpose the From address
• Forwarding services that wrap or modify headers
• Internal mail systems that route outgoing mail through a third-party gateway
• Email marketing platforms that send on your behalf with their own From addresses

When you enable BIMI, audit your mail flows first. If you have systems that alter From headers, you need to either fix those flows or accept that BIMI will only work for the mail flows that maintain proper alignment.

This is one of the most commonly skipped steps in BIMI deployment, and it is why BIMI works for some emails but not others from the same domain.

Testing and verifying your BIMI deployment

Testing BIMI requires a multi-step approach because there is no single tool that validates the entire chain.

First, verify the DNS record is published and resolvable using a direct authoritative lookup. Second, validate the certificate is accessible and not expired. Third, validate the SVG logo is accessible over HTTPS and passes SVG 1.1 validation. Fourth, send a test email to a receiver that supports BIMI and check whether the logo appears.

DMARC aggregate reports are the most reliable way to verify that BIMI-aligned mail is actually passing DMARC at scale. If you see DMARC failures in aggregate reports after enabling BIMI, the underlying authentication is not working and BIMI will not fix it.

Unlike a single test email to Gmail, aggregate reports show you what is happening across all receivers over time. This matters for BIMI because some receivers validate the BIMI certificate chain silently and only show a logo when everything is correct. You may not get any visible error when something is wrong, only silence.

DMARCFlow provides ongoing aggregate report monitoring so you can track whether your BIMI-eligible mail is actually authenticating correctly, even for receivers that do not give visual feedback. Set up DMARC report monitoring before deploying BIMI if you do not already have it, and check the reports after enabling BIMI to confirm alignment is passing consistently.

Receiver support: which mail providers actually show BIMI logos

BIMI support varies significantly across email receivers. As of 2026, Gmail and Google Workspace support BIMI. Apple Mail supports BIMI for some account types. Microsoft Outlook support is limited. Most other receivers either do not support BIMI or only support it partially.

Before investing significantly in BIMI, check whether the receivers your audience actually uses are on the support list. If you primarily send to corporate environments running Microsoft Exchange with Outlook, BIMI will not add much value for your recipients. If you primarily send to Gmail and consumer-facing audiences, BIMI is worth pursuing.

BIMI receiver support lists change. What is accurate today may not be accurate in six months. Treat receiver support as a factor to revisit periodically, not a one-time checklist item.

What BIMI does not do: the DMARC relationship explained

BIMI is often misunderstood as an anti-spoofing tool. It is not. BIMI is a visual authentication indicator. It tells receiving mail systems "this logo belongs to this sending domain," which can help recipients recognize legitimate mail visually.

But BIMI does not prevent someone from sending email that spoofs your domain. Only DMARC with a reject policy does that. BIMI requires valid DMARC alignment to function at all, but BIMI itself does not block or filter mail.

Think of it this way: DMARC decides whether mail is legitimate enough to potentially show a logo. BIMI decides whether to actually display that logo. You need both, but they serve different purposes.

If your goal is to protect your domain from spoofing, deploy DMARC with p=reject first. BIMI is a layer on top of an already-functioning DMARC deployment, not a replacement for it.

FAQ

How long does BIMI take to show up after publishing the DNS record?

DNS propagation typically takes a few minutes to 48 hours depending on your DNS provider and the TTL of your previous records. Use an authoritative DNS lookup tool to check the actual published state rather than relying on local resolver cache.

Do I need a VMC or CMC certificate for BIMI?

You need one of them. A VMC requires trademark verification and is more expensive. A CMC is lighter weight and does not require trademark registration, but receiver support for CMC is not yet universal. Choose based on your trademark status and your recipient base.

What SVG format does BIMI require?

BIMI requires SVG 1.1 format with a viewBox of 128x128 pixels or smaller. The file cannot contain JavaScript, external references, animations, or embedded raster images. Use a BIMI validator to test your SVG before publishing.

Which email clients support BIMI logos?

Gmail and Google Workspace fully support BIMI. Apple Mail supports it for some account types. Microsoft Outlook support is limited. Support varies across other receivers and changes over time.

Can BIMI prevent email spoofing?

No. BIMI is a visual indicator, not an authentication mechanism. Only DMARC with p=reject prevents spoofing. BIMI requires valid DMARC alignment to function, but it does not block or filter mail on its own.

How do I test if my BIMI record is correct?

Use a dedicated BIMI record validator to check DNS, certificate, and SVG accessibility in one pass. Then send a test email to a BIMI-supporting receiver like Gmail to verify the logo actually appears.

What happens to BIMI when mail is forwarded?

Forwarding typically breaks BIMI because forwarding services often modify the From header or add their own routing that breaks DKIM alignment. BIMI only works for direct-delivery mail flows that preserve header integrity.

Does BIMI work with all email providers?

No. BIMI support varies by receiver. The major consumer providers (Gmail, Apple Mail) support it to varying degrees. Most enterprise email systems do not yet support BIMI display.