Why Your Logo Is Not Showing in Gmail Even Though You Set Up BIMI

BIMI fails silently, and that is the whole problem

You published the DNS record. You paid for the certificate. You sent a test email to your own Gmail account. There is still a gray circle with a letter in it where your logo should be.

BIMI stands for Brand Indicators for Message Identification. It is the standard that puts your logo next to your name in the inbox. When any part of it is wrong, mailbox providers do not tell you. They do not bounce the message. They do not flag anything in Postmaster Tools. They just quietly fall back to the default avatar and deliver the mail.

This is not a rare situation. In January 2025, URIports scanned the top one million domains and found 9,661 with a BIMI record published. Of those, 5,174 had at least one error. That is 53.6%. Over the prior year, BIMI adoption grew 28% while error rates grew 64%. A broken BIMI record is closer to the normal state than the exception.

We ran this stack on our own business first. Bench Clearers is a hockey apparel store we operate, and its VMC came through GlobalSign with BIMI now live in Gmail. Most of the failure points below are ones we hit ourselves before we hit them on anyone else's behalf. Work through them in this order.

Start with DMARC, because it breaks BIMI in three separate ways

DMARC is the policy record that tells receiving mail servers what to do with messages that fail authentication checks. BIMI will not run at all unless that policy is at enforcement. Google states this plainly: the policy option must be set to quarantine or reject, and the percent option must be set to 100.

Three distinct DMARC problems produce the identical symptom of no logo.

• p=none. This is the most common cause by volume. In the URIports scan, 1,287 BIMI-enabled domains, or 13.3%, were sitting at p=none. The record validates. Checkers report a valid DMARC record. It is monitoring only, not enforcement, and BIMI will not display. Move to p=quarantine first, then p=reject.
• pct less than 100. The pct tag sets what percentage of your mail the policy applies to. A record reading p=reject; pct=25 is not enforcement in Gmail's eyes. Google requires pct=100. The tag is being retired from newer revisions of the DMARC specification, so the cleanest fix is to remove it entirely rather than set it to 100.
• sp= that is not aligned. The sp tag sets the policy for your subdomains. A record reading p=reject; sp=none puts every subdomain back at monitoring only. If you send marketing from news.yourdomain.com or mail.yourdomain.com, that subdomain is not at enforcement and your logo will not show, no matter how correct everything else is. Either remove sp or set it to quarantine or reject.

The record is published on the wrong host name

The BIMI record is a TXT record and it belongs at default._bimi.yourdomain.com. Not _bimi.yourdomain.com. Not bimi.yourdomain.com. Not the root domain. The underscore is required and default is the selector name.

The syntax looks like this: v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/cert.pem

Two host name traps account for most of these failures. First, DNS control panels differ on whether they append your domain automatically. Enter the full default._bimi.yourdomain.com into a panel that appends, and you have just published default._bimi.yourdomain.com.yourdomain.com. Query the record with dig or an online lookup and read back what actually resolves rather than trusting what you typed.

Second, a stale record on the sending subdomain will override the one at your organizational domain. Subdomains inherit the organizational domain record only when the subdomain has no BIMI record of its own. An old test record at default._bimi.news.yourdomain.com pointing at a logo you deleted will win, and it will win silently.

Custom selectors are supported through a BIMI-Selector header on the message, but the header needs a matching DNS record at that selector name. Set the header without publishing the record and you get nothing.

The SVG is the single most common failure

Non-compliant logo files were the largest error category in that scan, affecting 2,656 domains, or 27.5% of everyone with a BIMI record.

BIMI does not accept ordinary SVG. It requires SVG Tiny 1.2 Portable/Secure, usually written as Tiny PS. This is a deliberately restricted subset of SVG that strips out anything that could carry a security risk. No mainstream design tool exports it correctly by default, which is why so many of these files are wrong.

Open your SVG in a plain text editor. It is XML and you can read it. Check each of these.

• Wrong root attributes. The svg element must carry version="1.2" and baseProfile="tiny-ps". A file exported as generic SVG will have neither.
• Missing title element. The specification says the title element MUST be present, its contents MUST NOT be empty, and it must appear exactly once as a child of the svg element. Contents should stay under 64 characters. Put your company name there.
• x or y attributes on the root svg element. Adobe Illustrator adds these on export and they are explicitly not permitted. You have to delete them by hand.
• An embedded raster image. The image element is prohibited outright. Exporting a PNG or JPG logo "as SVG" often just wraps the raster file inside an SVG shell. It opens fine in a browser and looks identical to a real vector. It fails BIMI every time. The artwork has to be genuine vector paths.
• Scripts, animation, or interactivity. The script, animate and animateTransform elements and all interactive features are prohibited.
• External references. Any link out of the file, other than the declared XML namespace, invalidates it. That includes externally hosted fonts.
• Over 32KB. The specification says the file should not exceed 32 kilobytes, which is 32,768 bytes. Complex gradients and unnecessary path detail are the usual reason a logo blows past this.
• Not square. The aspect ratio must be 1:1. Google additionally requires a minimum height and width of 96 pixels, specified in absolute pixels. A wide wordmark will not work and needs a redraw as a square mark.
• Transparent background. The specification permits it, but transparent backgrounds may not render as expected in the inbox. Use a solid background color.

The certificate does not match the logo you are serving

A Verified Mark Certificate, or VMC, is the credential a certificate authority issues after verifying that you own the trademark on your logo. It embeds a copy of your logo inside the certificate file.

Gmail fetches the SVG at your l= URL and compares it against the logo baked into the certificate at your a= URL. If those two files differ by a single byte, the logo does not display. Nobody tells you.

This is the classic post-launch break. Someone re-exports the artwork, runs it through an SVG optimizer, adjusts the title text, or lets a build pipeline minify it. The DNS record still resolves. The certificate is still valid and unexpired. The logo simply stops appearing. Once your certificate is issued, that exact file is frozen. Put it in version control and exclude it from any asset optimization step. Changing the logo means re-issuing the certificate.

Other certificate-side failures worth checking:

• Expired certificate. In that same scan, of the 2,996 domains that specified a certificate, 245 had expired certificates and 291 had otherwise invalid ones. Mark certificates are annual. Put the renewal in your calendar.
• Redirects on the l= or a= URL. Both URLs must serve the file directly over HTTPS. A 301 or 302 breaks the check. A CDN rule, a forced www redirect, or a trailing slash normalization will cause this without anyone noticing.
• Incomplete PEM chain. The PEM file needs the full issuance chain, not just your leaf certificate.
• Covered domain mismatch. The domain listed inside the certificate has to match the domain the BIMI record sits on.
• A certificate from an unauthorized issuer. The BIMI Group lists exactly three authorized issuers: DigiCert, GlobalSign and SSL.com. Entrust stopped issuing mark certificates in May 2025. Sectigo does not appear on that list, but it is issuing: as of August 2026 the live mark certificate on tjx.com is signed by "Sectigo Limited VMC Issuing RSA CA 1". The BIMI Group directory lags reality, so verify the issuer inside the certificate rather than trusting the directory. Inclusion on the list does not guarantee a mailbox provider will honor the certificate, but absence from it is close to a guarantee they will not.

Everything checks out and there is still no logo

If you have cleared all of the above, four things remain.

Wait 48 hours. Google states it can take up to 48 hours after the record is added for the logo to appear.

Test in a Gmail account that has never corresponded with the sending address. If that address exists in the recipient's Google Contacts with a photo attached, the contact photo takes precedence over BIMI in the interface. You can spend a long time debugging a working setup this way.

Consider reputation. Gmail can decline to display a logo for a sender whose reputation is not yet established, even with a technically perfect configuration. There is no published threshold and no appeal process. If authentication, complaint rate and sending consistency are in good order, this usually resolves with time rather than with changes.

Test in Gmail specifically. Provider support for BIMI is uneven and each one applies its own additional conditions. A logo that does not appear in one client tells you very little on its own.

When the honest answer is that you should not buy the certificate

Not every business asking about this should spend the money, and we would rather say so here than after you have paid.

If your DMARC is still at p=none, buying a VMC today is premature. The certificate does nothing until enforcement is in place, and reaching enforcement safely on a domain with several sending systems takes weeks of reporting and remediation. That work is the real project. The certificate is the last step, not the first.

If you have no registered trademark, you cannot get a VMC. The alternative is a Common Mark Certificate, or CMC, which requires roughly 12 months of documented continuous public use of the logo instead of a registration. A CMC will display your logo in Gmail. It will not produce the blue verified checkmark, which remains VMC only. If the checkmark is your actual reason for wanting this, a CMC will disappoint you and registering the mark first is the better sequence.

Budget realistically. VMCs run roughly $749 to $1,750 per year depending on issuer and reseller, before any trademark registration costs. CMCs run roughly $650 to $1,100. If your logo is a horizontal wordmark, add design time to redraw it as a square mark. If you send a low volume of mail to a list that already recognizes your name, that annual spend is very likely better placed in list hygiene and deliverability work than in an inbox avatar.

Working with us

Verified Everywhere handles BIMI, DMARC enforcement and mark certificates through official channels only. We built and debugged this exact stack on our own store before offering it to anyone, so the failure points above are ones we have already paid for in our own time. We never ask for your passwords, your ID documents or your card details, and if we look at your setup and do not believe a certificate will produce a logo for you, we will tell you that instead of taking the fee. Platforms make the final decision on every verification, and we do not promise outcomes we do not control.