Why Your BIMI Record Is Not Showing: The Prerequisites That Must Be Met

What is BIMI and why it matters

BIMI stands for Brand Indicators for Message Identification. It lets you display your company logo inside the recipient's email inbox next to your messages, before the user opens anything. In clients that support it, a BIMI logo works like a verified sender badge: it signals to the recipient's mail program that the sending domain has a verifiable identity, which can reduce phishing friction and increase open rates for brands that care about email credibility.

The catch is that getting a BIMI logo to appear is not as simple as publishing a DNS record. It requires a specific chain of prerequisites, and any single break in that chain silently kills the logo. Unlike SPF or DKIM failures, BIMI produces no bounce, no NDR, and no warning. It just does not appear.

The prerequisite chain for BIMI

BIMI works only when all of the following are true. If any step is missing or misconfigured, the logo will not display.

1. DMARC policy set to p=quarantine or p=reject

BIMI requires your domain to have a published DMARC record with a policy of quarantine or reject. A policy of p=none (monitoring only) is not sufficient. This is the first gate.

1. SPF or DKIM (or both) passing for your own outbound mail

Your sending infrastructure must produce mail that passes SPF or DKIM authentication aligned with your domain. BIMI checks this at send time.

1. A valid Verified Mark Certificate (VMC) or Certified Mark Certificate (CMC)

This is the step most guides skip or mention only in passing. A BIMI record that points to a logo URL without a corresponding certificate will not display in most clients. The certificate proves to the receiving mail client that you own the trademark for the logo you are trying to display. VMCs are issued by Certificate Authorities and are not free.

1. A BIMI DNS record published with correct syntax

The record must follow the BIMI specification: default._bimi.yourdomain.com with values for v (version), l (logo URL), and a (certificate URL). A malformed record or a logo URL that returns an error will silently fail.

1. The recipient's email client supports BIMI

This is the step completely outside your control. Gmail, Apple Mail, and some other clients support BIMI. Many do not yet. If your recipients primarily use a client that has not implemented BIMI, your logo will not appear for them no matter how correctly you have configured everything else.

1. For Gmail specifically: additional eligibility requirements may apply

Google maintains its own BIMI eligibility criteria beyond the RFC standard. These include domain-level reputation requirements and other signals Google does not fully document publicly. Even a correctly configured BIMI setup may not display in Gmail if Google's internal checks are not satisfied.

Why the VMC is the step most guides skip

The Verified Mark Certificate requirement trips up more implementations than any other. A VMC is an x.509 certificate that binds your domain to a trademarked logo image. Certificate Authorities charge for them, and the process requires proving trademark ownership of the logo. This is not a free or automatic step, and it is the reason you cannot set up BIMI with DNS alone.

Without a VMC, you can publish a BIMI record pointing to any image URL. Most mail clients that support BIMI will ignore it. The certificate requirement exists because mail clients need a trustworthy way to confirm the sender has the right to use that logo. An unsigned logo file proves nothing about ownership.

If you are using a CMC (Certified Mark Certificate) instead, note that this is a newer certificate type with lower barriers to issuance than a VMC. However, client support for CMC is currently limited. Gmail does not currently render CMC-based BIMI logos. If you want your BIMI logo to appear in Gmail or Apple Mail today, a VMC is the more reliable path.

How to diagnose which prerequisite is failing

BIMI failures produce no visible error. Here is how to check each prerequisite systematically.

Step 1: Verify your DMARC policy

Check your domain's DMARC record. If the policy is p=none, you must raise it to p=quarantine or p=reject before BIMI can work. Moving to p=reject without first reviewing your aggregate reports risks breaking legitimate mail. Use monitoring mode first to see what is actually sending using your domain.

Step 2: Confirm SPF or DKIM is passing for your own mail

Send a test message from your domain to a DMARC testing service or check your own DMARC aggregate reports. If neither SPF nor DKIM is aligned with your domain, BIMI cannot activate.

Step 3: Check your VMC or CMC certificate

Your BIMI DNS record contains an "a=" field pointing to your certificate URL. Verify that URL is accessible and that the certificate has not expired. Certificate expiration policies vary by CA. An expired certificate will break BIMI display even if everything else is configured correctly.

Step 4: Validate your BIMI DNS record

Use a BIMI lookup tool to check your record syntax. Confirm the v=BIMI1 label, the l= field pointing to a reachable logo image (PNG or SVG format), and the a= field pointing to your certificate. A 404 on either URL will silently prevent display.

Step 5: Test across multiple email clients

Check whether the logo appears in Gmail, Apple Mail, and any other clients you care about. If it appears in one but not another, the issue is likely client-side support rather than your configuration.

What to do when your logo was showing and then stopped

A working BIMI logo that suddenly stops appearing usually points to one of two causes: a certificate expiration or a change in SPF or DKIM alignment.

VMC certificates expire. If your certificate lapses, your BIMI logo stops showing in all supporting clients. This is one of the most common BIMI failures in production, and it is easy to miss because there is no alert when it happens. Monitoring your VMC expiration date should be part of your regular email operations.

Changes to your mail infrastructure can also break SPF or DKIM alignment silently. A new email gateway, a different sending domain, or a misconfigured DKIM selector can break the authentication step that BIMI depends on, without producing any warning in your normal mail flow.

The BIMI and MTA-STS connection

For domains that have implemented MTA-STS (Mail Transfer Agent Strict Transport Security) for encrypted inbound mail delivery, BIMI works alongside it as a separate layer. MTA-STS tells receiving mail servers that your domain requires encrypted connections. BIMI tells receiving mail clients that your domain has a verified brand identity worth displaying. They address different parts of the email pipeline and do not conflict. If you are running MTA-STS, implementing BIMI does not require any changes to that configuration.

FAQ

Does BIMI require a certificate?

Yes, in practice. A VMC or CMC is required for most mail clients to display your logo. BIMI records without a corresponding certificate are ignored by Gmail and Apple Mail. The certificate is what proves the logo is legitimately yours.

Why is my BIMI record not showing in Gmail?

Start with the prerequisite checklist: is DMARC at p=quarantine or higher, is SPF or DKIM passing, is your VMC valid and not expired, and does your BIMI DNS record have correct syntax? If all of those check out, Google may have additional eligibility criteria for your domain that are not publicly documented.

Can I use BIMI without a VMC?

Not reliably. Some theoretical BIMI implementations allow logo-only records without a certificate, but production mail clients including Gmail and Apple Mail require the certificate for the logo to render.

How long does it take for BIMI to start displaying after setup?

Once all prerequisites are in place and your BIMI DNS record is published, most mail clients begin displaying the logo within hours to a few days. DNS propagation for TXT records is usually fast. Gmail may take longer due to its own caching and eligibility checks.

Does BIMI work with subdomains?

BIMI is configured per-domain. A BIMI record on example.com does not automatically cover subdomains like mail.example.com. Each subdomain that needs BIMI must be configured separately, with its own certificate.

How DMARCFlow helps with BIMI readiness

BIMI is easy to get wrong and easy to stop maintaining. The prerequisites span multiple systems: DMARC policy, email authentication, DNS records, and certificate expiration. If you manage BIMI across multiple domains, tracking each prerequisite in a spreadsheet or DNS check is error-prone at scale.

DMARCFlow monitors BIMI readiness across your domains, alerting you when a prerequisite breaks or a VMC is approaching expiration. It also surfaces DMARC authentication failures that affect whether your mail can trigger BIMI display at all. For teams managing email branding across dozens of domains, automated monitoring catches BIMI regressions before they affect what recipients see.

If you are troubleshooting why your BIMI logo is not showing, the first practical step is to work through the checklist above systematically. Once all prerequisites are confirmed in place, the logo should appear in supporting clients within a few days at most.