// Audit 2, email brand trust

Your logo belongs in the inbox.
Most domains already qualify and never find out.

BIMI puts your brand mark next to your mail in Yahoo, AOL, Apple Mail and Gmail. It never throws an error. When a gate fails it simply does not render, and nothing anywhere tells you why. Every one of those gates is checkable from outside, so we check them and hand you the exact fix.

Check my domain →The security checklist
The readiness ladder, five rungs
  1. BIMI T0
    Blocked
    DMARC is not enforcing, so BIMI cannot start at all.
  2. BIMI T1
    Unclaimed
    You already qualify. The logo slot is sitting there unclaimed.
  3. BIMI T2
    Broken
    The record is published and something downstream is failing silently.
  4. BIMI T3
    Live
    Renders in Yahoo, AOL and Apple Mail. Gmail is still holding back.
  5. BIMI T4
    Certified
    Live everywhere, Gmail included.

A rung requires every rung beneath it. A flawless logo file behind a DMARC record that does not enforce is still BIMI T0, because nothing downstream of that gate can render.

The two nobody finds on their own

pct=90 passes every DMARC checker on the internet and still kills BIMI forever. sp=none disqualifies a domain even at p=reject, so the most locked-down apex you can write is BIMI-dead. Neither reports an error anywhere. Both are one line to fix.

The DMARC gates

BIMI reads your DMARC record before it looks at anything else. Two of these fail silently.

BIMI T0~5 min
DMARC enforcement: the gate BIMI checks first
Move DMARC to p=quarantine or p=reject, BIMI reads that record before it ever looks at your logo
BIMI T0~5 min
DMARC pct=100: the tag that silently kills BIMI
Set pct=100 on your DMARC record, or the logo never renders and nothing tells you why
BIMI T0~5 min
sp=none: the strict domain that is quietly BIMI-dead
Delete the sp tag so subdomains inherit your enforcement, or the logo never renders

The BIMI record

One TXT record at default._bimi. This is the step most eligible domains never take.

BIMI T1~10 min
The BIMI record: claiming the logo slot you already qualify for
Publish one TXT record at default._bimi and your logo starts rendering in Yahoo, AOL, and Apple Mail

The logo file

SVG Tiny P/S. An ordinary export from any design tool satisfies almost none of it.

BIMI T2~30 min
SVG Tiny P/S: why your logo file is rejected
Rebuild your logo as SVG Tiny P/S, the only flavour of SVG BIMI accepts
BIMI T2~15 min
Serving the logo: HTTPS, content-type, and no redirects
Serve the mark over HTTPS as image/svg+xml, at the exact l= URL, with zero redirect hops

The certificate

Only Gmail requires one. Plenty of domains should rationally stop before this.

BIMI T2~45 min
VMC and CMC: what Gmail costs
Point a= at a valid CMC or VMC, the only thing Gmail accepts
BIMI T3~10 min
Dating your logo: when you become certificate-eligible
Date your mark's first archive.org capture and add 12 months, that is your CMC eligibility date