Check BIMI readiness without overclaiming logo display
If Flash reports a BIMI readiness warning, start with the exact From domain and the authentication result. Flash checks the BIMI DNS shape and DMARC foundation; it does not fetch the referenced SVG or PEM, validate a certificate or guarantee that a mailbox provider will display a logo.
BIMI is a brand assertion layered on authenticated mail, not an inbox-placement guarantee. The BIMI Group requires aligned SPF, DKIM and DMARC with an enforced policy, plus an SVG Tiny PS logo; a VMC or CMC is optional in the general guide but matters for providers that require certificate-backed display. Gmail's own setup guidance says supported clients need a PEM-backed mark, while participating providers apply their own display criteria.
Primary sources for this guidance
- BIMI Group Implementation Guide
- BIMI Group — All about BIMI
- Google Workspace Admin — Set up BIMI
- Gmail email sender guidelines
How to fix it
- Read the Flash finding for the exact From domain. A missing record, duplicate record, missing l= logo URL, unenforced DMARC policy or missing a= pointer is a different repair path; a temporary DNS lookup is reported as unknown rather than a penalty.
- Confirm that the received message passes SPF, DKIM and DMARC with an aligned domain. The one-point BIMI subcheck is separate from those message verdicts and cannot turn a failed authentication result into a pass.
- Move DMARC to p=quarantine or p=reject with 100 percent coverage only after every legitimate sending stream is aligned and monitored. A p=none policy may satisfy Gmail's bulk-sender minimum, but it is not BIMI-ready.
- Publish exactly one record at default._bimi.yourdomain with v=BIMI1 and an HTTPS l= logo URL. Add an HTTPS a= PEM URL when the target provider requires a VMC or CMC; do not publish duplicate TXT records.
- Prepare an SVG Tiny PS logo and verify its dimensions, profile and safe contents against the BIMI requirements. Flash reads the DNS pointer but does not download or validate the logo asset.
- Obtain VMC or CMC evidence when the target provider requires certificate-backed BIMI. Treat trademark, certificate issuance, PEM chain and provider eligibility as owner or provider checks, not as a Flash pass.
- Fetch the HTTPS SVG or PEM yourself, verify the certificate and URL response, then check a participating provider after DNS propagation. Provider display can lag or remain unavailable even when DNS is correct.
- Preserve the baseline and send one comparable production-path message after the DNS, asset and provider state is observable. Recheck BIMI plus SPF, DKIM, DMARC and placement evidence; a BIMI pass does not prove inbox placement.
Limitations
Flash checks one default._bimi TXT record for the From domain, its l= logo URL and a= certificate pointer, plus the DMARC policy and pct coverage used by the auth audit. It does not fetch or validate SVG or PEM contents, HTTPS responses, certificate chains, trademarks, provider eligibility, logo rendering, inbox placement or all BIMI selectors.