Troubleshooting BIMI and VMC Certificate Errors

Brand Indicators for Message Identification (BIMI) allows organizations to display official brand logos next to authenticated emails in supported inboxes (such as Gmail, Apple Mail, and Yahoo). When a logo fails to appear or a DNS validation tool returns BIMI errors, the issue is usually caused by an unaligned DMARC enforcement policy, an improperly formatted SVG image, or an invalid Verified Mark Certificate (VMC).

Quick Answer

BIMI requires an active DMARC policy of p=quarantine (with pct=100) or p=reject. In addition, your logo must be formatted as an SVG Tiny Portable/Secure file, and your VMC certificate PEM file must include the full intermediate certificate chain hosted at a publicly accessible HTTPS URL.

---

How BIMI Works

BIMI does not function as an isolated visual enhancement; it is built on top of rigorous email authentication:

1. Authentication: The incoming email must pass both SPF and DKIM, and both protocols must achieve identifier alignment under DMARC.
2. DMARC Enforcement: The sender’s domain must enforce strict anti-spoofing via DMARC. A permissive policy (p=none) will cause BIMI to fail immediately.
3. BIMI DNS Record Lookup: The receiving server queries DNS at default._bimi.yourdomain.com.
4. Validation: The server fetches the SVG logo and the accompanying Verified Mark Certificate (VMC) specified in the DNS record.
5. Display: If the certificate is cryptographically valid, matches the registered trademark, and the sender maintains a high reputation, the inbox displays the official logo.

[Outbound Email] ──► [DMARC Check: p=reject or quarantine pct=100?]
                                   │
                                  YES
                                   ▼
[BIMI DNS Lookup: default._bimi.example.com]
                                   │
      ┌────────────────────────────┴────────────────────────────┐
      ▼                                                         ▼
[Fetch SVG Logo (l=tag)]                  [Fetch VMC Certificate (a=tag)]
• Must be SVG Tiny P/S                    • Must be valid X.509 PEM
• Square aspect ratio                     • Full CA chain included
• No external links or scripts            • Domain name SAN match
      │                                                         │
      └────────────────────────────┬────────────────────────────┘
                                   ▼
                  [Inbox Displays Verified Logo]

---

Common BIMI and VMC Failure Points

1. DMARC Policy Deficiencies

The most frequent cause of BIMI failure is a DMARC record that does not meet the minimum required enforcement threshold. BIMI will be completely ignored if:

• Your DMARC record uses p=none.
• Your DMARC record uses p=quarantine but has a percentage tag lower than 100% (pct=50).
• The subdomain sending the mail has an explicit policy of sp=none.
  For instructions on transitioning your policy to an enforceable state, see How to Resolve DMARC Policy Rejects: Reject vs. Quarantine.

2. SVG Image Profile Non-Compliance

BIMI does not support standard web SVGs. The image must conform to the SVG Tiny Portable/Secure (SVG Tiny P/S) profile:

• The file must be a square aspect ratio (e.g., viewBox="0 0 500 500").
• It cannot contain external links, bitmaps, or embedded fonts (<image>, <text>, or CSS @import).
• It must not contain scripts (<script>), animations, or external references.
• The file size must generally be under 32 KB.

3. VMC File and Hosting Issues

A Verified Mark Certificate proves ownership of a registered trademark. Common errors include:

• Incomplete PEM Chain: The .pem file hosted on your web server contains only the end-entity certificate, omitting the intermediate CA and root certificates.
• Inaccessible URL: The URL in the a= tag returns a 404, redirects via HTTP, or is blocked by a firewall or Cloudflare challenge page.
• Domain Mismatch: The Subject Alternative Name (SAN) in the VMC does not match the exact domain sending the message.

4. Reputation Gatekeeping

Even with a flawless BIMI record and valid VMC, providers like Gmail will not display your logo if your domain lacks sufficient reputation or volume. For strategies on diagnosing poor domain standing, see Resolving “Message blocked due to domain reputation”.

---

Diagnostic Steps

Step 1: Query the BIMI Record

Run a DNS query for your domain’s BIMI selector:

dig default._bimi.example.com TXT +short

A valid record looks like this:

"v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/cert.pem;"

Confirm that both URLs begin with https:// and can be retrieved directly via curl:

curl -ILs <https://example.com/bimi/cert.pem> | head -n 5

Ensure the HTTP status code is 200 OK with no redirects.

Step 2: Validate the Certificate Chain

Inspect the certificate chain using OpenSSL:

openssl crl2pkcs7 -nocrl -certfile cert.pem | openssl pkcs7 -print_certs -noout

Ensure the output displays your organization’s certificate followed by the issuing Intermediate CA.

---

Technical Fixes

Fix 1: Upgrade DMARC to Full Enforcement

Verify your apex domain’s DMARC TXT record at _dmarc.example.com. Update it to enforce full quarantine or rejection:

v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com;

Or, if using quarantine:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@example.com;

Fix 2: Re-export and Convert the SVG to SVG Tiny P/S

If your SVG fails format validation:

1. Open the original vector artwork in Illustrator or Inkscape.
2. Ensure the canvas is a perfect square (e.g., 512×512 pixels).
3. Convert all text, strokes, and shapes into outlined paths.
4. Remove all metadata, embedded raster graphics, and external references.
5. Use the official BIMI Group conversion script or an SVG Tiny P/S conversion tool to generate compliant XML headers: <svg xmlns="<http://www.w3.org/2000/svg>" version="1.2" baseProfile="tiny-ps" viewBox="0 512 512"> <title>Company Logo</title> <path d="M..."/> </svg>

Fix 3: Assemble the Full Certificate Chain

If your certificate authority (such as DigiCert or Entrust) delivered your VMC as separate files:

1. Open a text editor.
2. Paste the contents of your primary VMC certificate.
3. Immediately below it, paste the contents of the Intermediate CA certificate.
4. Save the file as a single .pem file and upload it to your public HTTPS web directory.

To ensure your underlying DNS records meet all prerequisites before reapplying for VMC verification, review The Workspace Email Authentication Master Checklist.