Why Your BIMI Email Logo Fails to Display: 5 Authentication and SVG Traps Every Engineer Hits

You published your DNS TXT record for default._bimi.yourdomain.com, hosted your SVG logo over HTTPS, and sent a test email to Gmail and Apple Mail—only to see a generic circular letter avatar. No error logs appear in your mail transfer agent, no bounce notifications are triggered, and your email deliverability dashboards report normal status.

BIMI (Brand Indicators for Message Identification) provides verified brand logos in supported email clients. However, because BIMI operates at the intersection of cryptographic email authentication, DNS routing, and strict vector graphics constraints, even minor misconfigurations prevent mailbox providers from displaying your icon.

Here are the five most common reasons BIMI email logos fail in production and how to fix them.

---

1. DMARC Enforcement Is Missing or Incomplete (p=none or pct < 100)

BIMI is not a standalone protocol—it is an explicit trust layer built on top of DMARC (Domain-based Message Authentication, Reporting, and Conformance). Mailbox providers (such as Gmail, Apple Mail, and Yahoo) will completely ignore BIMI records if your domain does not enforce a strict DMARC quarantine or reject policy.

Common traps include:

• Policy set to monitoring only: If your DMARC record contains p=none, BIMI is immediately rejected.
• Percentage throttling: If pct is set to anything other than 100 (e.g., pct=50 during rollout testing), BIMI validation fails.
• Subdomain policy gaps: If sending from notifications.example.com but your root DMARC record lacks sp=reject or sp=quarantine, the subdomain fails validation.

Your root domain requires a fully enforced DMARC policy:

_dmarc.example.com. IN TXT "v=DMARC1; p=reject; sp=reject; pct=100; rua=mailto:[e-mail]"

---

2. The SVG Violates the "SVG Tiny PS" Profile Specification

You cannot simply export an SVG from Figma or Adobe Illustrator and point your BIMI record to it. Standard exports use SVG 1.1 or SVG 2.0 specifications containing features strictly forbidden by the BIMI standard for security reasons.

BIMI requires the SVG Tiny Portable/Secure (SVG Tiny PS) profile:

1. Attributes: The root element must explicitly specify version="1.2" and baseProfile="tiny-ps". It must not include x or y attributes.
2. Title: A <title> element containing your brand name is mandatory.
3. No Embedded Bitmaps or Scripts: Tags like <script>, <style>, <foreignObject>, or base64-encoded raster images (<image>) will cause immediate parsing rejection.
4. File Size: The uncompressed .svg file must remain strictly under 32 KB.

Here is a valid minimal SVG Tiny PS structure:

<svg xmlns="http://www.w3.org/2000/svg" version="1.2" baseProfile="tiny-ps" viewBox="0 0 512 512">
  <title>Acme Corporation</title>
  <rect width="512" height="512" fill="#0f172a"/>
  <path d="M128 384 L256 128 L384 384 Z" fill="#38bdf8"/>
</svg>

When building and checking your configuration, you can use the Nutilz BIMI Generator to construct valid DNS TXT syntax, verify DMARC enforcement prerequisites, and inspect your selector formatting.

---

3. DNS Selector and Subdomain Alignment Mismatches

By default, mail clients query the default selector at default._bimi.example.com. However, if your transactional emails are sent with an explicit BIMI-Selector SMTP header or sent from a subdomain, resolution breaks if the record is missing at that specific path.

If your email service provider sends from mail.example.com, mailbox providers evaluate the RFC 5322 From header domain. You must publish your record at:

default._bimi.mail.example.com. IN TXT "v=BIMI1; l=https://example.com/assets/logo.svg;"

Alternatively, if your outgoing mail server injects a custom header like BIMI-Selector: v=BIMI1; s=promo2026;, your DNS record must reside at promo2026._bimi.example.com.

---

4. Missing or Improperly Formatted VMC / CMC Certificates (a= tag)

While some providers (historically Yahoo) have permitted self-asserted BIMI records without digital certificates, major clients like Gmail and Apple Mail strictly require a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).

A self-asserted record looks like this:

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg;"

For Gmail and Apple Mail, the a= tag linking directly to the PEM-formatted certificate chain is required:

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem;"

Ensure that:

• The certificate URL points directly to the raw .pem file over HTTPS, not an HTML verification webpage.
• The intermediate certificate authority (CA) certificates are bundled in the PEM chain.

---

5. HTTP Redirects and Aggressive DNS Caching

Mailbox provider validation bots enforce strict security controls when fetching your SVG and VMC files:

• No Redirects Allowed: If https://example.com/logo.svg returns an HTTP 301, 302, or 307 redirect (for example, CDN URL normalization or language routing), the fetcher aborts immediately.
• Strict HTTPS: Plain HTTP URLs are completely disallowed.
• Cache Invalidation Delays: BIMI records and SVG assets are cached by providers for 24 to 72 hours. If you correct an SVG syntax error or update a DNS record, expect a delay before mail clients re-fetch the asset.

---

Verification Checklist

Before publishing your BIMI record, verify each layer:

1. Confirm your DMARC record has p=quarantine or p=reject with pct=100.
2. Format your SVG to Tiny PS 1.2 specifications with no scripts or raster elements.
3. Host the SVG directly on HTTPS with a 200 OK status and no redirects.
4. Validate your DNS syntax and record tags with the Nutilz BIMI Generator.
5. Query the TXT record with dig default._bimi.yourdomain.com TXT to ensure global propagation.