BIMI T2BIMI T2Readiness tierHow far along the BIMI ladder a domain sits while this is unfixed: T2 means "broken". This is a readiness rung, not a security grade, and it is separate from your posture score. A rung requires every rung beneath it.Logo fileLogo fileWhich gateBIMI is evaluated in a fixed order: the DMARC gates, then the record, then the logo file, then the certificate. Fail one and everything after it is unreachable, whatever else you have done.Web host · static fileWhere it livesImplementationThis fix is applied in: Web host · static file.~30 minTime to fixEffortRoughly 30 minutes of hands-on work, DNS propagation aside.

SVG Tiny P/S: why your logo file is rejected

Rebuild your logo as SVG Tiny P/S, the only flavour of SVG BIMI accepts

The threat

You export the logo, upload it, publish the record, and nothing happens. No bounce, no warning, no error in any dashboard. Your mail keeps arriving with the same grey initial it always had, and every checker you run says the record is fine. That is what a rejected logo file looks like from your side: receivers fetch it, discard it in silence, and fall back to the default avatar. Nothing ever tells you why.

BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. does not accept SVG. It accepts one narrow profile called SVG Tiny Portable/Secure, and no design tool exports it by default. Illustrator, Figma, Sketch, and every online converter produce a file that renders perfectly in a browser and fails the profile on the first attribute. A domain stuck here sits at BIMI T2 broken: the DMARC work is done, the record is published, and the asset throws all of it away.

The exact fix

Rebuild the file by hand. This is the complete skeleton, valid tiny-ps, ready to paste:

<?xml version="1.0" encoding="UTF-8"?>
<svg xmlns="http://www.w3.org/2000/svg"
     version="1.2" baseProfile="tiny-ps"
     viewBox="0 0 512 512" width="512" height="512">
  <title>Your Brand, Inc.</title>
  <rect width="512" height="512" fill="#0B1220"/>
  <path d="M256 104 L424 408 L88 408 Z" fill="#FFFFFF"/>
</svg>

Six rules, all enforced, all fixed in that one file:

  1. Profile. The root <svg> carries version="1.2" and baseProfile="tiny-ps"baseProfile="tiny-ps"BIMI assetA line inside the logo file declaring that it follows the strict BIMI image rules. Email apps and certificate issuers look for it, and a file without it is treated as the wrong format even when it looks identical., both, spelled exactly. The root also carries no x or y attributes.
  2. Title. A <title> naming your brand is the very first child of <svg>. Not the second, not after <defs>, first.
  3. Dimensions. width and height are absolute pixels, equal to each other, and 96 or larger. Percentages fail. Non-square fails. Gmail reads this rule the most strictly, and 512 is a safe number.
  4. Nothing that runs or reaches out. No <script>, <a>, <animate>, <image>, <foreignObject>, no xlink:href or external href, no @import, no linked fonts. Convert every text element to paths.
  5. Flat fills only. No <linearGradient> or <radialGradient>, no opacity or fill-opacity below 1, no alpha channel in any colour. Solid hex fills. Certificate authorities reject gradients and transparency during VMCVMCTLS / PKIVerified Mark Certificate: a paid certificate confirming that the logo in your BIMI record is your registered trademark. Gmail requires one before it will show your logo, and it is the only route to the verified badge. and CMCCMCTLS / PKICommon Mark Certificate: the cheaper certificate for businesses with no registered trademark, granted once the issuer confirms you have used the same logo publicly for at least twelve months. Apple Mail accepts it, Gmail still asks for the full trademark version. review even when inboxes tolerate them, so a gradient you keep today is a file you re-cut later.
  6. Under 32KB. Delete <metadata>, editor namespaces, comments, and unused id attributes, and round path coordinates to one decimal. Exports routinely run ten times larger than the drawing needs.

Work your artwork into the skeleton, do not edit an export down to it. Open the export, copy out the <path> and <rect> elements only, paste them between the <title> and the closing tag, and throw the rest away. That is faster than hunting attributes one by one, and it is the only way to be certain nothing from the exporter survived.

Position, not presence. Exporters put <defs>, <style>, or a generator comment ahead of <title>. A perfectly good title in the wrong place fails exactly like no title at all.

Serve the result over HTTPS at the exact URL in your record’s l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo. tag, with Content-Type: image/svg+xml, and no redirect in front of it.

Verify it

curl -s https://yourdomain.com/bimi/logo.svg | grep -oE 'baseProfile="[a-z-]+"|<title>|<(script|animate|image|linearGradient|radialGradient)'

You want exactly two lines back, baseProfile="tiny-ps"baseProfile="tiny-ps"BIMI assetA line inside the logo file declaring that it follows the strict BIMI image rules. Email apps and certificate issuers look for it, and a file without it is treated as the wrong format even when it looks identical. then <title>, in that order and nothing else. A third line names the element to delete. An empty result means the profile attributes are missing entirely, which is the normal state of a fresh export.

Proof

On dev3lop.com the mark was cut to this profile before the record went out. The file that ships today is version="1.2", baseProfile="tiny-ps"baseProfile="tiny-ps"BIMI assetA line inside the logo file declaring that it follows the strict BIMI image rules. Email apps and certificate issuers look for it, and a file without it is treated as the wrong format even when it looks identical., <title> first child, 400x400 square, no gradients, no scripts, 15,472 bytes against the 32KB ceiling. It answers HTTP 200 as image/svg+xml with zero redirect hops, so receivers fetch it and keep it. The domain is live at BIMI T3 on DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox., pct=100pct=DMARC policyA DMARC setting that applies your policy to only a share of your mail while you test, for example nine messages in ten. Anything below 100 quietly disqualifies you from BIMI even though every DMARC checker still calls the record valid., with a posture grade of A, score 100. Yahoo, AOL, and Apple Mail draw the mark now. Gmail holds the self-asserted mark until a certificate exists, and the file’s first public archive dates to 2026-05-04, which puts CMC eligibility at May 2027. Re-cutting the file restarts that clock, which is why the profile rules are worth getting right before anything ships.