sp=none: the strict domain that is quietly BIMI-dead

The threat

Your _dmarc record says p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes.. Every DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. checker on the internet gives you a green tick. Your logo still does not appear in a single inbox, and no bounce, no report, and no error message ever tells you why. The cause is one tag people add once and forget: sp=nonesp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting..

spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. sets the policy for everything below your apex. Set to none, receivers apply nothing at all to mail.yourdomain.com, billing.yourdomain.com, or any other name under you. BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. reads the whole record, sees a domain that is not enforcing across its own tree, and disqualifies it outright, which floors you at BIMI T0, blocked, no matter how hard the apex looks. The second consequence is the worse one: an attacker who cannot spoof yourdomain.com sends from accounts.yourdomain.com instead, which reads as you to every customer, and your own DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. just told the receiver to deliver it.

The exact fix

Delete the spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. tag. With no spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting., subdomains inherit p automatically, which is what you wanted in the first place. Publish exactly one record:

Field	Value
Type	TXT
Name	_dmarc (→ _dmarc.yourdomain.com, not @)
Value	v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com; fo=1; pct=100
TTL	3600

If your policy is still p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox., keep it and drop spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. all the same. If a compliance reviewer wants the tag stated explicitly, write sp=reject (or sp=quarantine) so it matches p. The staged path to enforcement is in DMARC.

sp=nonesp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. is almost always there to stop one noisy subdomain from failing. Fix that host’s SPF and DKIM instead. Relaxing the whole tree to rescue a single sender costs you the logo everywhere and reopens spoofing on every other name you own.

Verify it

dig +short TXT _dmarc.yourdomain.com

Exactly one record comes back, carrying p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. or p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes., pct=100pct=DMARC policyA DMARC setting that applies your policy to only a share of your mail while you test, for example nine messages in ten. Anything below 100 quietly disqualifies you from BIMI even though every DMARC checker still calls the record valid. or no pctpct=DMARC policyA DMARC setting that applies your policy to only a share of your mail while you test, for example nine messages in ten. Anything below 100 quietly disqualifies you from BIMI even though every DMARC checker still calls the record valid. at all, and the string sp=nonesp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. nowhere in it. If spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. appears, it must match p.

Proof

On dev3lop.com the record reads v=DMARC1; p=quarantine; rua=mailto:dmarc@dev3lop.com; fo=1; pct=100, with no spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. tag, so every subdomain inherits quarantine. That omission is why the domain clears the gate and runs live at BIMI T3, self-asserted, rather than sitting at BIMI T0, blocked. default._bimidefault._bimiEmail authThe exact DNS name a BIMI record has to live at, written as default._bimi.yourdomain.com. Publish the same text anywhere else and email apps will never find it. publishes v=BIMI1;l=https://dev3lop.com/bimi/dev3lop-mark.svg, and the asset returns HTTP 200 as image/svg+xml, 15,472 bytes, zero redirect hops, tiny-psbaseProfile="tiny-ps"BIMI assetA line inside the logo file declaring that it follows the strict BIMI image rules. Email apps and certificate issuers look for it, and a file without it is treated as the wrong format even when it looks identical., square at 400x400. No a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag yet, so Yahoo, AOL and Apple Mail render it while Gmail waits for a certificate, which the mark cannot earn until May 2027 under the 12-month continuous-use clock. A live scan grades the domain A at 100. apecyber.com holds the other end: no MX, v=spf1 -all, p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes., again no spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting., a domain that sends no mail, so BIMI is simply not applicable and the audit rates it unrated. Neither record needs an spsp=DMARC policyThe DMARC setting that covers your subdomains, such as mail.yourdomain.com. Leaving it looser than your main policy lets people spoof a subdomain and blocks BIMI outright, even when the main domain is at the strictest setting. tag, and that is the point.