Treat BIMI as a set of dependencies
Brand Indicators for Message Identification helps a domain owner express which brand indicator it wants associated with authenticated messages. It does not add a new message-authentication method or oblige every receiver to show a logo. A deployment can have a valid DNS assertion while its artwork, evidence document or receiver eligibility remains unresolved.
The retained BIMI document used here is Internet-Draft version 15, dated 31 October 2026. It is a work in progress, not an RFC. Its overview separates BIMI from the underlying authentication mechanisms, and its introduction leaves mailbox providers and clients free to apply their own display policies. Current deployment decisions must therefore combine the draft's mechanics with receiver documentation. BIMI Internet-Draft 15, sections 1–2.
Separate domain policy from the message result
An enforcement policy expresses how the domain owner wants failures handled. It does not prove that a particular message passed DMARC. For each sending stream, retain the visible From domain, authenticated SPF identity, DKIM signing domain and trusted receiving-side results. Authentication that passes for an unrelated domain can still fail alignment with the Author Domain. RFC 9989, sections 4.3–4.4.
BIMI Group's implementation guidance calls for enforcement on the organizational domain and subdomains. That requirement should prompt an inventory of legitimate senders before policy changes. Payroll, support and transactional systems may share a domain with the marketing stream that requested the logo. The project must not sacrifice their delivery to meet an artwork deadline. BIMI implementation guide.
There is a standards-version wrinkle to preserve in the record. Google's current setup page and the retained BIMI draft still mention pct=100; RFC 9989 removed pct. Document the receiver's compatibility expectations separately from the current DMARC specification, and do not use percentage settings as a promise that only a chosen share of failures will be affected. Google BIMI setup; RFC 9989, Appendix A.6.
Distinguish the assertion, artwork and evidence
The DNS assertion advertises the relevant indicator or evidence locations. The logo is the visual asset. A mark certificate supplies evidence accepted under a receiver's rules. Those objects can be maintained by different teams and can fail independently. A successful DNS lookup does not prove that a public URL returns the intended bytes, and a public file does not establish that a certificate covers the intended domain.
The default assertion is associated with default._bimi beneath the relevant domain in the documented default-selector case. Draft 15 also describes other selectors and discovery behavior. Keep this introductory workflow on the default path unless the sending platform and target receivers have been verified for a more complex arrangement. BIMI Internet-Draft 15, sections 4.3–4.4.
For the asset, inspect SVG Tiny Portable/Secure conformance rather than relying on a browser preview. BIMI Group identifies required structural attributes and restrictions on scripts, external references and interactive content. The file that passes a review must be the file actually hosted or certified, not an earlier export with the same filename. BIMI SVG guidance.
Make eligibility receiver-specific
The proposed eligibility matrix accompanying this article has separate rows for Gmail, Apple Mail's BIMI path and any additional target receiver. Each row identifies a source, expected evidence type, relevant client or provider condition and the operational proof still missing. Unknown support stays unknown; it is not filled using another provider's policy.
Google currently requires a VMC or CMC for its BIMI implementation and uses a PEM-based path. Its VMC checkmark statement must not be generalized to CMCs or every mail application. An uncertified standalone SVG therefore cannot be assumed to satisfy Gmail merely because the generic assertion syntax permits a logo URL. Google BIMI setup.
Apple Mail's documented BIMI path depends on the mailbox provider performing the required checks and adding the appropriate headers. Apple describes VMCs and other evidence documents, but the actual receiving provider's trust policy still matters. Installing a supported Apple Mail version does not make every connected mailbox eligible. Apple BIMI server guidance.
Use observations to locate the failed dependency
Suppose a fictional team has published an assertion for example.com and can open its SVG in a browser. Its Gmail row lacks certificate evidence, and its Apple Mail row lacks the mailbox provider's participation confirmation. The next step is to complete those specific requirements, not to republish the same TXT record repeatedly. The fictional example reports no real DNS or display result.
For a real test, retain the exact message, sender identity, receiver, client version, UTC time and trusted authentication results. Capture a display observation separately from the authentication evidence. If the logo is absent, classify what is known: message authentication, assertion discovery, asset retrieval, evidence validation, or receiver display eligibility. A missing logo by itself does not identify which stage failed.
A visible logo is also a bounded observation. It does not prove every message from the domain is legitimate, prevent lookalike-domain attacks or certify the safety of links in the message. The brand team should describe the indicator accurately without turning it into a security guarantee.
Preserve the completion gate
The exact catalogue requirement is “A receiver-specific eligibility matrix and evidence for DNS, logo, certificate and message authentication.” This article supplies a documentary matrix and a proposed verification approach. No real DNS answers, candidate logo, mark certificate, tenant configuration, received message or display observation has been collected. Those original evidence items remain open alongside technical review and owner release approval. The article is a private educational draft, not a completed BIMI deployment.