--- title: "BIMI DMARC Requirements: The Policy Your Logo Needs" description: "BIMI requires DMARC at enforcement: p=quarantine or reject, pct=100, sp not none. See the exact requirements and fix bimi=skipped insufficient dmarc." publishedAt: 2026-08-27 lastUpdatedAt: 2026-08-27 tags: ["bimi", "dmarc", "dmarc-policy", "vmc", "cmc", "email-authentication"] faq: - question: "Does BIMI work with p=quarantine or only p=reject?" answer: "Both qualify. The BIMI draft requires a DMARC policy of quarantine or reject on the organizational domain and the From domain; a quarantine policy must carry pct=100. A p=none policy never displays a logo, even when every message passes DMARC." - question: "Does BIMI require DMARC on subdomains?" answer: "Yes. The BIMI draft requires enforcement on the organizational domain and the From domain, and any published sp= tag must not be none. A domain that enforces only on a sending subdomain may show a logo in Yahoo but will be skipped by Gmail." - question: "What does \"bimi=skipped reason insufficient dmarc\" mean?" answer: "Your message may pass DMARC, but the published policy is below the BIMI bar: p=none, a pct value under 100, or sp=none. The verified verbatim header comes from iCloud. The fix is moving to p=quarantine or p=reject with pct=100 and no sp=none." - question: "Will pct=50 work for BIMI?" answer: "No. The BIMI draft states a quarantine policy must not have a pct below 100, and Google requires pct=100 explicitly. RFC 9989 removed the pct tag from DMARC entirely, so the practical guidance is to delete the tag or set it to 100." - question: "Do I need a VMC for BIMI to work in Gmail?" answer: "Gmail requires a mark certificate — either a VMC or a CMC — referenced in your BIMI record. A VMC adds the verified checkmark; a CMC shows the logo without it. Yahoo, AOL, and Fastmail display BIMI logos with no certificate at all." - question: "Does Outlook show BIMI logos?" answer: "No. Microsoft does not render BIMI in Exchange Online, Outlook, Outlook.com, or Microsoft 365 as of 2026, and has announced no date to. A valid BIMI record and VMC have no display effect in Microsoft-hosted inboxes." --- # BIMI DMARC Requirements: Exactly What Your Policy Must Say Your DMARC record can pass on every message you send, and Gmail will still skip your logo. That is the part of the BIMI DMARC requirements most guides gloss over: BIMI gates on the _policy_ you publish, not on whether individual messages pass. The short answer: [BIMI](/learn/bimi/) requires `p=quarantine` or `p=reject` on both the organizational domain and the From domain, `pct=100` (or no `pct` tag), and no `sp=none`. Anything weaker means no logo — silently. BIMI is still an IETF Internet-Draft ([draft-brand-indicators-for-message-identification-14](https://datatracker.ietf.org/doc/html/draft-brand-indicators-for-message-identification-14), 2026-05-01), not a published RFC, so each mailbox provider's documentation is the operative rulebook. DMARC itself is RFC 9989. This post gives you the exact requirements table, the per-provider rules, and how to read `bimi=skipped reason="insufficient dmarc"` when it shows up in your headers. ## What DMARC policy does BIMI require? BIMI requires DMARC at enforcement — a passing message is necessary but not sufficient. Five conditions, all from the draft itself: | Requirement | Value | Spec source | | ------------------ | ---------------------------------------------------------------------------------- | -------------------- | | Policy level | `p=quarantine` or `p=reject` — never `p=none` | draft-14 Intro | | Domains covered | Organizational domain AND the From domain recipients actually see (`RFC5322.From`) | draft-14 Intro | | Subdomain coverage | a published `sp=` must NOT be `none` | draft-14 §7.1 step 8 | | pct | `pct=100` (or tag absent); quarantine + `pct<100` = skip | draft-14 §7.1 step 9 | | Authentication | message must PASS DMARC — SPF and/or DKIM in alignment | draft-14 §7.1 | The draft's language is unambiguous: "To participate in BIMI, Domain Owners MUST have a strong [DMARC] policy (quarantine or reject) on both the Organizational Domain, and the RFC5322.From Domain of the message." In record terms, the line between a logo and a silent skip looks like this: Two rows deserve a closer look, because they are where working configurations quietly disqualify themselves. **The `sp=` trap.** Receiver rule §7.1 step 8 says that if your DMARC record publishes a subdomain policy of `sp=none`, "BIMI processing MUST NOT be performed" — even when the parent is at `p=reject`. Publishing `sp=none` to shield subdomains silently forfeits the logo. If you use `sp=` at all, it must be `quarantine` or `reject`; the mechanics are covered in our [DMARC subdomain policy guide](/blog/dmarc-subdomain-policy/). **The `pct` nuance.** DMARCbis — [RFC 9989](https://datatracker.ietf.org/doc/html/rfc9989), published 2026-05-19 — removed the `pct` tag from DMARC entirely (Appendix A.6). But the BIMI draft and Google's documentation still enforce `pct=100` where the tag is present. A leftover `pct=25` from a phased rollout is treated as partial enforcement and skips the logo. The practical rule: delete the tag, or set it to 100. Why do receivers gate on the policy rather than the pass? Because a logo is a trust mark. Displaying it on a domain that anyone can spoof — which is what `p=none` means in practice — would be worse than showing no logo at all. DMARCguard's BIMI validator checks all five rows in the table above against your live DNS before it ever looks at your logo file, for the same reason. ## Which email providers show BIMI logos in 2026? Four major providers render BIMI logos; one conspicuously does not. Each row below is sourced from the provider's own documentation: | Provider | Shows BIMI | DMARC bar (provider's words) | Certificate | | ----------------------- | ---------- | ------------------------------------- | -------------------------------- | | Gmail (GA 2021-07-12) | Yes | p=quarantine/reject, pct=100 | VMC or CMC required (PEM) | | Apple Mail (iCloud) | Yes | not stated verbatim by Apple | VMC in practice; CMC unconfirmed | | Yahoo / AOL | Yes | "quarantine or reject" | none required; bulk mail only | | Fastmail | Yes | enforcement per the BIMI standard | none required | | Microsoft 365 / Outlook | **No** | n/a — no receiver support, no GA date | n/a | [Google's own wording](https://knowledge.workspace.google.com/admin/security/set-up-bimi) (doc updated 2026-06-04) matches the draft exactly: "The policy option (p) must be set to quarantine or reject… The percent option (pct) must be set to 100." Gmail also layers sender reputation on top, and logos can take up to 48 hours to appear — a technically valid record does not guarantee display. The other providers add their own conditions. Yahoo and AOL show logos only for bulk mail from senders with "sufficient reputation and engagement," and require no certificate. Fastmail requires none either, and fetches logos at its MX servers when mail arrives — so BIMI cannot be used as an open-tracking pixel. Apple's receiver docs never state "quarantine or reject" verbatim; that bar comes from the BIMI standard, and in practice Apple Mail displays logos for iCloud-hosted mailboxes with a VMC. One distinction worth a paragraph: Apple's "Branded Mail" is not BIMI. It is configured through Apple Business Connect, uses a bitmap logo approved by Apple, requires DKIM, and needs no VMC. A BIMI DNS record does not drive Branded Mail, and vice versa. And the Microsoft gap is the biggest coverage hole in BIMI today: as of mid-2026 there is no receiver-side support and no announced date. The per-client walkthrough — and the record and logo mechanics — live in our [BIMI record setup guide](/blog/bimi-record-setup/); this post stays on the policy side. ## VMC vs CMC: which certificate do you need? Once your DMARC policy clears the bar, the certificate question decides where your logo appears. The BIMI Group's official issuer list ([bimigroup.org/vmc-issuers/](https://bimigroup.org/vmc-issuers/), verified 2026-07-28) names exactly three Mark Verifying Authorities: DigiCert, GlobalSign, and SSL.com. Entrust — an original issuer — stopped issuing VMCs on 2025-05-12; existing Entrust certificates run until natural expiry. | Certificate | Eligibility | Unlocks (2026) | Issuer-direct price (verified 2026-07-28) | | ----------- | ----------------------------------------------------- | ------------------------------------------- | --------------------------------------------------------------------------------- | | VMC | registered trademark | Gmail logo + verified checkmark; Apple Mail | DigiCert $1,416.00/yr; SSL.com $1,500 / $1,350 / $1,275 per yr for 1/2/3-yr terms | | CMC | 12 months provable public logo use (archive-verified) | Gmail + Yahoo logo; no checkmark; no Apple | no issuer list price published — reseller quotes run ~$649–$1,089/yr | | None | — | Yahoo, AOL, Fastmail | $0 | GlobalSign does not publish pricing on its own site, and no issuer cleanly lists a standalone CMC price — treat any CMC figure you see as a reseller quote, not a list price. Both certificate types require DMARC enforcement first: no certificate activates BIMI on a `p=none` domain. The zero-cost row is legitimate, not a consolation prize. If your audience reads mail in Yahoo, AOL, or Fastmail, a self-asserted record displays your logo with no certificate at all — a reasonable way to prove the pipeline works before spending four figures. One operational detail that bites a year later: maximum certificate validity is 397 days. Set a renewal reminder, because an expired certificate breaks logo display silently while your DNS stays unchanged. The deeper buying decision — validation steps, trademark offices, lead times — is covered in the [setup guide's certificate section](/blog/bimi-record-setup/); the table above is the decision in one screen. ## Why does Gmail say "bimi=skipped (reason: insufficient dmarc)"? The good news first: this state is diagnostic, not destructive. Nothing is wrong with your mail delivery — the message may even show `dmarc=pass`. The receiver is telling you one specific thing: your _published policy_ is below the BIMI bar, so the logo evaluation stopped before it started. Three policy settings trigger it — `p=none`, a `pct` below 100, or `sp=none` — and every one of them has the same fix path: bring the organizational domain to `p=quarantine` or `p=reject` at `pct=100`, with no `sp=none` published. Once the policy clears that bar, the same header flips to `bimi=pass` with no other change. A provenance aside, because no other guide gives you this: the parenthesized string people search for is a paraphrase. The verified verbatim header in the wild is **iCloud's**, stamped by `bimi.icloud.com`: No raw Gmail header containing a `bimi=` token has surfaced in public support threads or deliverability writeups — Gmail surfaces its authentication verdicts in the "Show original" summary box and in Postmaster Tools instead. The diagnosis is identical either way. Here is the state taxonomy, restricted to verified states: | Header state | Trigger | Fix | | ------------------------------------------ | -------------------------------------------------- | ------------------------------------- | | `bimi=pass header.d=… header.selector=…` | DMARC enforced + record/logo/cert valid | none | | `bimi=skipped reason="insufficient dmarc"` | p=none, `pct<100`, or sp=none | enforce: p=quarantine/reject, pct=100 | | skipped — no VMC/CMC (Gmail) | no PEM certificate in `a=` | obtain a VMC or CMC | | skipped — SVG/asset failure | not SVG Tiny P/S, wrong MIME, redirect, broken PEM | validate logo + HTTPS hosting | | skipped — reputation/anti-abuse | low sender reputation despite valid config | improve sender reputation | For "insufficient dmarc" specifically, work through the causes in this order — it matches how the failure chain actually breaks: 1. **`p=none` on the organizational domain** — the most common cause. Community reports of this exact pattern show `dmarc=pass` alongside `bimi=skipped` because the org domain never left monitoring mode. 2. **Subdomain enforced, org domain at none** — the newsletter trap. Yahoo historically checks the sending subdomain and shows the logo; Gmail and the draft require the organizational domain too, so Gmail skips. 3. **Leftover `pct<100`** — a phased-rollout artifact like `p=reject; pct=25` is partial enforcement. Remove the tag or set 100. 4. **`sp=none`** — disqualifies the logo even at `p=reject` (§7.1 step 8). 5. **One sending source failing alignment** — the policy is fine, but a specific ESP stream fails SPF/DKIM alignment, so BIMI is skipped for those messages only. Only after these five come the certificate and SVG checks. That ordering matters: it stops you buying a VMC for a domain whose policy would skip the logo anyway. Run the [free BIMI checker](/tools/bimi-checker/) to see where your domain sits — it validates all five requirement rows against your live DNS in one pass.
## The road from p=none to your logo: enforcement as the BIMI journey Reframe the project: you do not "do BIMI." You finish DMARC, and the logo is the milestone marker. Seth Blank, Chair of the AuthIndicators Working Group, put the design intent plainly — BIMI exists so that "DMARC benefits from the providers' additional incentive to implement the DMARC enforced standard," and it is "an exciting case where marketers and security professionals are aligned." The reward was built to pull you through enforcement. The path, with the decision gate at each stage: 1. **`p=none` — monitor.** Collect RUA data for 2–4 weeks and inventory every sending source. Your [DMARC aggregate reports](/blog/dmarc-aggregate-report/) are the evidence base for every advance decision that follows. 2. **Fix alignment.** Every legitimate stream must pass DMARC in alignment before you tighten anything. Prefer DKIM alignment — it survives forwarding, so it is the durable path. 3. **`p=quarantine` — at `pct=100`.** A `pct` ramp is a valid DMARC rollout tactic, but it keeps the logo off until you reach 100. For BIMI, quarantine only counts at full coverage. 4. **`p=reject`, with any `sp=` at enforcement.** This is the BIMI-complete state. Publish the BIMI record per the setup guide, then the certificate if your audience needs one.
The cautionary tale from the other direction: among domains with _valid_ BIMI records, 4.60% were still at `p=none` — a published logo, a hosted SVG, and nothing to show for it (Validity, "The BIMI Battle," 13,000 domains, 2025). The record was never the hard part. The policy is. A word on ROI, honestly. The defensible claim: BIMI puts your verified logo where a spoofer's mail shows a generic initial — and it certifies, visibly, that your DMARC enforcement is done. The widely quoted engagement numbers deserve more caution. They trace to two sources: a 2021 Red Sift/Entrust consumer survey (1,026 participants, vendor-funded, self-reported — average open-rate lift of 21%, with the famous "+39%" being a single best-brand result) and a 2018 Yahoo Mail pilot that measured a 10% engagement increase. Both are dated, and no independent 2024–2026 study has replicated them. ## Frequently asked questions ### Does BIMI work with p=quarantine or only p=reject? Both qualify. The BIMI draft requires a DMARC policy of quarantine or reject on the organizational domain and the From domain; a quarantine policy must carry `pct=100`. A `p=none` policy never displays a logo, even when every message passes DMARC. ### Does BIMI require DMARC on subdomains? Yes. The BIMI draft requires enforcement on the organizational domain and the From domain, and any published `sp=` tag must not be `none`. A domain that enforces only on a sending subdomain may show a logo in Yahoo but will be skipped by Gmail. ### What does "bimi=skipped reason insufficient dmarc" mean? Your message may pass DMARC, but the published policy is below the BIMI bar: `p=none`, a `pct` value under 100, or `sp=none`. The verified verbatim header comes from iCloud. The fix is moving to `p=quarantine` or `p=reject` with `pct=100` and no `sp=none`. ### Will pct=50 work for BIMI? No. The BIMI draft states a quarantine policy must not have a `pct` below 100, and Google requires `pct=100` explicitly. RFC 9989 removed the `pct` tag from DMARC entirely, so the practical guidance is to delete the tag or set it to 100. ### Do I need a VMC for BIMI to work in Gmail? Gmail requires a mark certificate — either a VMC or a CMC — referenced in your BIMI record. A VMC adds the verified checkmark; a CMC shows the logo without it. Yahoo, AOL, and Fastmail display BIMI logos with no certificate at all. ### Does Outlook show BIMI logos? No. Microsoft does not render BIMI in Exchange Online, Outlook, Outlook.com, or Microsoft 365 as of 2026, and has announced no date to. A valid BIMI record and VMC have no display effect in Microsoft-hosted inboxes. ## The short version The BIMI DMARC requirements fit on one line: enforcement — `p=quarantine` or `p=reject` — on the organizational domain and the From domain, `pct=100` or no `pct` tag, no `sp=none`, and mail that passes DMARC in alignment. Then the certificate, then the logo. The requirements table at the top of this post is the checklist; if every row passes, the logo is an implementation detail. If any row fails, no certificate or SVG will save it. BIMI is proof that your DMARC job is finished — which is exactly why it is worth having. Prefer to start further back? [Start monitoring your DMARC reports](https://app.dmarcguard.io/register) — free plan, no credit card required.