BIMI T3BIMI T3Readiness tierHow far along the BIMI ladder a domain sits while this is unfixed: T3 means "live". This is a readiness rung, not a security grade, and it is separate from your posture score. A rung requires every rung beneath it.CertificateCertificateWhich gateBIMI is evaluated in a fixed order: the DMARC gates, then the record, then the logo file, then the certificate. Fail one and everything after it is unreachable, whatever else you have done.Web host · static fileWhere it livesImplementationThis fix is applied in: Web host · static file.~10 minTime to fixEffortRoughly 10 minutes of hands-on work, DNS propagation aside.

Dating your logo: when you become certificate-eligible

Date your mark's first archive.org capture and add 12 months, that is your CMC eligibility date

The threat

You budget for the cheap BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. certificate, pay the application fee, and the issuer refuses you. Not because your logo is wrong, because it is too young. A Common Mark CertificateCMCTLS / PKICommon Mark Certificate: the cheaper certificate for businesses with no registered trademark, granted once the issuer confirms you have used the same logo publicly for at least twelve months. Apple Mail accepts it, Gmail still asks for the full trademark version. is the no-trademark path to a logo in Gmail, roughly $650 to $1,150 a year, and short of registering a trademark for a VMCVMCTLS / PKIVerified Mark Certificate: a paid certificate confirming that the logo in your BIMI record is your registered trademark. Gmail requires one before it will show your logo, and it is the only route to the verified badge. it is the only way into the one inbox that ignores a self-asserted mark. Refusals are not free. You pay again on the next attempt.

The rule behind the refusal is simple and almost nobody publishes it: the certificate authority requires the exact mark in continuous public use for twelve months, and it verifies that claim against public web archives, principally archive.org. Your eligibility date is therefore already written down, in public, by a crawler you do not control. You can read it today.

The exact fix

Pin the mark. One file, one URL, no versioned filename, no build hash that changes on every deploy:

https://yourdomain.com/bimi/mark.svg

Put a dated capture on the record now, so the clock has a starting gun the issuer can see:

curl -sI "https://web.archive.org/save/https://yourdomain.com/bimi/mark.svg"

Do the same for the page the mark is displayed on, usually your homepage. Issuers are evidencing public use of the mark, not the existence of one SVG file, and a captured page carrying the logo is the stronger record of the two.

Then do the arithmetic. First capture plus twelve months is the earliest week you can apply and be approved. Put that date in the calendar and do not apply before it. If the same mark was already on your site under an older URL before you moved it into /bimi/, date that older URL instead. Continuous use follows the artwork, not the path, and you are often further along than the new file suggests.

Any pixel change restarts the clock. A recolour, an added wordmark, a re-export with different path data, all of it is a new mark to the issuer and the twelve months begin again from that day. Freeze the mark before you start counting, not after.

Verify it

curl -s "https://web.archive.org/cdx/search/cdx?url=yourdomain.com/bimi/mark.svg&fl=timestamp&limit=1"

You get back one 14-digit timestamp, oldest capture first, in the shape 20260504120000: four digits year, two month, two day. That date plus twelve months is your eligibility date. An empty response means no capture exists yet, so your clock has not started and today is day zero.

Proof

dev3lop.com runs at BIMI T3 today. The record is live, l=https://dev3lop.com/bimi/dev3lop-mark.svg returns HTTP 200 as image/svg+xml, 15,472 bytes, tiny-ps, 400x400, zero redirect hops. DMARC sits at p=quarantine; pct=100, posture grade A, score 100. There is no a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag, so the mark is self-asserted: Yahoo, AOL and Apple Mail draw it, Gmail withholds it until a certificate exists.

That certificate cannot be bought yet. The mark’s first archived appearance dates to 2026-05-04, so CMC eligibility lands in May 2027, known to the week rather than discovered by a refusal letter. The only thing standing between BIMI T3 and BIMI T4 is a date on a calendar.