Serve the mark over HTTPS as image/svg+xml, at the exact l= URL, with zero redirect hops

The threat

Your logo appears in Apple Mail and never in Gmail. Or it renders for two weeks, you move the site behind a new host, and it quietly stops. Nothing bounces, nothing warns you, no log line anywhere says why. You are left comparing screenshots from other people’s phones.

The mechanism is that receivers fetch your l= URL themselves, from their own infrastructure, with no browser leniency. Plain http, a 404, a login wall, a Content-Type: text/plain, or a single 301 from apex to www, and the fetch is discarded silently. Everything above the asset can be perfect and the domain still caps at BIMI T2, broken.

The exact fix

Three rules, one file. Put the SVG on the same host and path your l= tag names, so it answers 200 with no hop.

Nginx:

location = /bimi/logo.svg {
    types { }
    default_type image/svg+xml;
    add_header Cache-Control "public, max-age=86400";
}

Apache, in .htaccess:

<Files "logo.svg">
  ForceType image/svg+xml
</Files>

Netlify or Cloudflare Pages, in _headers:

/bimi/logo.svg
  Content-Type: image/svg+xml
  Cache-Control: public, max-age=86400

Then point l= at whichever hostname answers directly. If your host 301s the apex to www, write l=https://www.yourdomain.com/bimi/logo.svg. If it redirects www to the apex, drop the www. Do not let the tag ride a redirect that looks harmless.

A single apex to www 301 is the one that bites. Every browser follows it, so the URL looks fine to you, and some evaluators refuse it outright. That is exactly why the logo renders in one inbox and not another.

Verify it

curl -sIL -o /dev/null -w '%{num_redirects} %{http_code} %{content_type}\n' https://yourdomain.com/bimi/logo.svg

Expect exactly 0 200 image/svg+xml. A first column above 0 is a hop to remove, and text/plain or application/octet-stream in the third means your host is still guessing at the file type.

Proof

On dev3lop.com the mark answers at the exact l= URL: HTTP 200, image/svg+xml, zero redirect hops, 15,472 bytes. Hosting it correctly is what puts the domain at BIMI T3 today, with p=quarantine; pct=100 above it and a posture grade of A, score 100. There is no a= tag yet, so the logo is self-asserted, which is why it renders in Yahoo, AOL and Apple Mail while Gmail withholds it. Staging the file early started the other clock: its first public web archive snapshot is dated 2026-05-04, making the mark CMC-eligible in May 2027 under the 12-month continuous-use rule. Move the URL and that clock restarts.

Fix the DMARC gates first if you have not, see DMARC, and make sure the host itself is clean on HTTPS and HSTS while you are in the config.

Serving the logo: HTTPS, content-type, and no redirects

The threat

The exact fix

Verify it

Proof