BIMI T1BIMI T1Readiness tierHow far along the BIMI ladder a domain sits while this is unfixed: T1 means "unclaimed". This is a readiness rung, not a security grade, and it is separate from your posture score. A rung requires every rung beneath it.BIMI recordBIMI recordWhich gateBIMI is evaluated in a fixed order: the DMARC gates, then the record, then the logo file, then the certificate. Fail one and everything after it is unreachable, whatever else you have done.DNS · TXTWhere it livesImplementationThis fix is applied in: DNS · TXT.~10 minTime to fixEffortRoughly 10 minutes of hands-on work, DNS propagation aside.

The BIMI record: claiming the logo slot you already qualify for

Publish one TXT record at default._bimi and your logo starts rendering in Yahoo, AOL, and Apple Mail

The threat

Your mail lands in Yahoo, AOL, and Apple Mail with a grey initial where your logo should be. Nothing tells you. There is no bounce, no warning in your DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. panel, no line in a DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. aggregate report. The slot next to your sender name just stays generic, indefinitely, and the only way to discover it is to go looking.

Mailbox providers fill that slot by reading exactly one TXT record at default._bimi.yourdomain.com. No record, a malformed record, and an empty l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo. all resolve to the same instruction: show nothing. If your DMARC is already at p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. or p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes. with pct=100pct=DMARC policyA DMARC setting that applies your policy to only a share of your mail while you test, for example nine messages in ten. Anything below 100 quietly disqualifies you from BIMI even though every DMARC checker still calls the record valid., you cleared the hard gate long ago and have been sitting at BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. T1, eligible and unclaimed, ever since.

The exact fix

One record, at a dedicated host, not the apex.

FieldValue
TypeTXT
Namedefault._bimidefault._bimiEmail authThe exact DNS name a BIMI record has to live at, written as default._bimi.yourdomain.com. Publish the same text anywhere else and email apps will never find it. (resolves to default._bimi.yourdomain.com, not @)
Valuev=BIMI1; l=https://yourdomain.com/bimi/logo.svg
TTL3600

v=BIMI1v=BIMI1Email authThe opening line of every BIMI record, marking it as version 1 of the standard. If it is missing or misspelled the whole record is ignored and no logo ever appears. must be the first tag. l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo. is the public HTTPS URL of your logo, which has to answer with a direct 200 and Content-Type: image/svg+xml, no redirect hops, in the SVG Tiny P/S profile.

There is no a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag here on purpose. Without one you are self-asserted, which is BIMI T3 live: the logo renders in Yahoo, AOL, and Apple Mail immediately, and Gmail withholds it until you add a VMCVMCTLS / PKIVerified Mark Certificate: a paid certificate confirming that the logo in your BIMI record is your registered trademark. Gmail requires one before it will show your logo, and it is the only route to the verified badge. or CMCCMCTLS / PKICommon Mark Certificate: the cheaper certificate for businesses with no registered trademark, granted once the issuer confirms you have used the same logo publicly for at least twelve months. Apple Mail accepts it, Gmail still asks for the full trademark version.. Claim BIMI T3 first. The certificate is a purchase order, this is a DNS edit.

An empty l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo. is not a blank, it is a refusal. v=BIMI1; l=; is a perfectly valid record that tells every inbox to display no logo for you. It is almost always left over from testing. If you meant to show a logo, l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo. needs the URL.

Verify it

dig +short TXT default._bimi.yourdomain.com

You get back exactly one quoted string, starting with v=BIMI1v=BIMI1Email authThe opening line of every BIMI record, marking it as version 1 of the standard. If it is missing or misspelled the whole record is ignored and no logo ever appears. and carrying your full https:// logo URL. Two records back, or zero, and receivers treat your domain as having none.

Proof

dev3lop.com scans grade A, posture score 100. Its _dmarc reads v=DMARC1; p=quarantine; rua=mailto:dmarc@dev3lop.com; fo=1; pct=100. Every BIMI precondition passed, and the domain still sat at BIMI T1 unclaimed, purely because no tool ever mentioned the record.

Now dig +short TXT default._bimi.dev3lop.com returns v=BIMI1;l=https://dev3lop.com/bimi/dev3lop-mark.svg. The mark answers 200 as image/svg+xml, 15,472 bytes, zero redirect hops, baseProfile="tiny-ps"baseProfile="tiny-ps"BIMI assetA line inside the logo file declaring that it follows the strict BIMI image rules. Email apps and certificate issuers look for it, and a file without it is treated as the wrong format even when it looks identical., square at 400x400, <title> first. One TXT edit, and the domain is BIMI T3 live in Yahoo, AOL, and Apple Mail.

There is no a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag, so Gmail withholds until a certificate exists. The mark’s archive clock started 2026-05-04, putting CMC eligibility in May 2027. The logo renders for two more years of inboxes in the meantime.