DMARC enforcement: the gate BIMI checks first
Move DMARC to p=quarantine or p=reject, BIMI reads that record before it ever looks at your logo
The threat
Your logo never appears in a single inbox, and nothing tells you why. No bounce, no error, no warning in your DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. panel. BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. does not fail loudly, it silently declines to render, and the most common reason has nothing to do with your logo. If you have no _dmarc record, or your policy is still p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes., every mailbox provider stops reading before it looks for a BIMI record at all. You can publish a perfect record and host a perfect SVG and get exactly nothing back.
That is BIMI T0, blocked. Receivers will not put your brand next to a message until you have first committed to blocking mail that fails authentication. p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes. is monitoring, it tells receivers to observe the failures and deliver anyway. Enforcement, meaning p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. or p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes., is the entry ticket, and it is the entire gate.
The exact fix
The staged rollout lives in DMARC. Start there if you have no record at all: monitor, then quarantine, then reject. This is the record that clears the BIMI gate, published once your aggregate reports confirm your real mail passes.
| Field | Value |
|---|---|
| Type | TXT |
| Name | _dmarc (→ _dmarc.yourdomain.com, not @) |
| Value | v=DMARC1; p=quarantine; rua=mailto:dmarc@yourdomain.com; fo=1; pct=100 |
| TTL | 3600 |
p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. is enough for BIMI. p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes. is stronger and also passes. Keep pct=100pct=DMARC policyA DMARC setting that applies your policy to only a share of your mail while you test, for example nine messages in ten. Anything below 100 quietly disqualifies you from BIMI even though every DMARC checker still calls the record valid. and publish no spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. tag, because either one disqualifies BIMI on its own even while the policy still looks strict to every DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. checker. Publish exactly one _dmarc record, since two are treated as none and drop you straight back to BIMI T0.
p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes. with a workingrua=address is not DMARC finished. It is where most domains stop, it passes every validator on the internet, and it blocks BIMI completely.
Turning the policy up starts dropping your own mail if SPF and DKIM are not aligned first. Fix those, read a week of reports, then enforce.
Verify it
dig +short TXT _dmarc.yourdomain.comExactly one record comes back and its p= reads quarantine or reject. Empty output, p=nonep=noneDMARC policyDMARC monitor mode: observe and report only, failing mail is still delivered. The safe place to start while you confirm your real mail passes., or two lines means the gate is still shut.
Proof
On our own property, dev3lop.com, _dmarc publishes v=DMARC1; p=quarantine; rua=mailto:dmarc@dev3lop.com; fo=1; pct=100. That one record is what moved the domain off BIMI T0. It now runs at BIMI T3, live: default._bimidefault._bimiEmail authThe exact DNS name a BIMI record has to live at, written as default._bimi.yourdomain.com. Publish the same text anywhere else and email apps will never find it. publishes v=BIMI1;l=https://dev3lop.com/bimi/dev3lop-mark.svg, and the mark answers HTTP 200 as image/svg+xml, 15,472 bytes, zero redirect hops, on a live scan that also graded its posture A at a score of 100. No a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag means the logo is self-asserted, so it renders in Yahoo, AOL and Apple Mail while Gmail withholds until a certificate exists, and dev3lop cannot buy one until May 2027. apecyber.com runs the same lever to the far end: no MX, v=spf1 -all, p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes., a domain that declares it sends no mail, so BIMI does not apply and the audit rates it unrated rather than inventing a rung.