[ BIMI & brand ]

BIMI logo not showing: separate DNS, certificate and display problems

Investigate a missing BIMI logo one layer at a time, preserving message, DNS, asset, certificate and receiver evidence before changing the configuration.

By the EmailAuth research team · 5 min read

[ Key points ]

  • Ask for a scoped recovery claim
  • Use a layered worksheet
  • Avoid weakening controls to hide symptoms
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Investigate a missing BIMI logo one layer at a time, preserving message, DNS, asset, certificate and receiver evidence before changing the configuration.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Use a layered worksheet

Independent checks prevent false confidence.

Next steps

  1. Preserve message evidence.
  2. Check public files separately.
  3. Repeat the same conditions after repair.

CISO / SecOps

Avoid weakening controls to hide symptoms

Visual issues should not remove authentication protection.

Next steps

  1. Review risky remediation proposals.
  2. Keep certificate roles separate.
  3. Retain incident evidence.

Founder / Non-technical

Ask for a scoped recovery claim

One fixed message does not establish universal display.

Next steps

  1. Define affected surfaces.
  2. Require a cause before broad changes.
  3. Track unresolved observations.

[ FAQs ]

Frequently asked questions

Where should investigation start?

With a specific affected message, actual From domain and exact receiver/client surface.

Can a passed DNS validator close the incident?

No. Other layers can still fail or remain unknown.

Is the asset-host TLS certificate the mark certificate?

No. They serve different roles and must be checked separately.

Should a missing PEM be fixed by weakening DMARC?

No. Repair the file or URL and preserve appropriate authentication controls.

Does a missing checkmark always mean the logo failed?

No. Expected indicators vary with certificate category and receiver.

Google Workspace: Set up BIMI

Should several settings be changed at once?

Prefer the smallest evidence-based repair so its effect can be verified.

Can every delayed result be blamed on caching?

No. Treat caching as a hypothesis requiring evidence.

Was a production incident investigated?

No. The evidence worksheet is synthetic and live checks remain pending.

[ Sources ]

Sources

  1. Apple: Prepare your email server for BIMI

    Sections Relevant setup, lifecycle or display guidance

  2. Google Workspace: Set up BIMI

    Sections VMC and CMC logo and checkmark eligibility

  3. BIMI individual Internet-Draft revision 15 (not an RFC)

    Sections Relevant setup, lifecycle or display guidance

[ Glossary ]

Glossary

Layered diagnosis
Investigation that tests independent dependencies separately.
Unknown result
A check without enough evidence to classify as passed or failed.
Recovery observation
A specific post-repair result under recorded test conditions.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base