BIMI DMARC Requirements: Exactly What Your Policy Must Say

Your DMARC record can pass on every message you send, and Gmail will still skip your logo. That is the part of the BIMI DMARC requirements most guides gloss over: BIMI gates on the policy you publish, not on whether individual messages pass. The short answer: BIMI requires p=quarantine or p=reject on both the organizational domain and the From domain, pct=100 (or no pct tag), and no sp=none. Anything weaker means no logo — silently.

BIMI is still an IETF Internet-Draft (draft-brand-indicators-for-message-identification-14, 2026-05-01), not a published RFC, so each mailbox provider’s documentation is the operative rulebook. DMARC itself is RFC 9989. This post gives you the exact requirements table, the per-provider rules, and how to read bimi=skipped reason="insufficient dmarc" when it shows up in your headers.

What DMARC policy does BIMI require?

BIMI requires DMARC at enforcement — a passing message is necessary but not sufficient. Five conditions, all from the draft itself:

The draft’s language is unambiguous: “To participate in BIMI, Domain Owners MUST have a strong [DMARC] policy (quarantine or reject) on both the Organizational Domain, and the RFC5322.From Domain of the message.”

In record terms, the line between a logo and a silent skip looks like this:

# BIMI-ready — enforcement, full coverage, no sp=none
v=DMARC1; p=reject; rua=mailto:[email protected];

# Disqualified — each one skips the logo
v=DMARC1; p=none; rua=mailto:[email protected];
v=DMARC1; p=quarantine; pct=100; sp=quarantine; rua=mailto:[email protected];
v=DMARC1; p=quarantine; pct=25; rua=mailto:[email protected];
v=DMARC1; p=reject; sp=none; rua=mailto:[email protected];

Two rows deserve a closer look, because they are where working configurations quietly disqualify themselves.

The sp= trap. Receiver rule §7.1 step 8 says that if your DMARC record publishes a subdomain policy of sp=none, “BIMI processing MUST NOT be performed” — even when the parent is at p=reject. Publishing sp=none to shield subdomains silently forfeits the logo. If you use sp= at all, it must be quarantine or reject; the mechanics are covered in our DMARC subdomain policy guide.

The pct nuance. DMARCbis — RFC 9989, published 2026-05-19 — removed the pct tag from DMARC entirely (Appendix A.6). But the BIMI draft and Google’s documentation still enforce pct=100 where the tag is present. A leftover pct=25 from a phased rollout is treated as partial enforcement and skips the logo. The practical rule: delete the tag, or set it to 100.

Why do receivers gate on the policy rather than the pass? Because a logo is a trust mark. Displaying it on a domain that anyone can spoof — which is what p=none means in practice — would be worse than showing no logo at all. DMARCguard’s BIMI validator checks all five rows in the table above against your live DNS before it ever looks at your logo file, for the same reason.

Which email providers show BIMI logos in 2026?

Four major providers render BIMI logos; one conspicuously does not. Each row below is sourced from the provider’s own documentation:

Google’s own wording (doc updated 2026-06-04) matches the draft exactly: “The policy option (p) must be set to quarantine or reject… The percent option (pct) must be set to 100.” Gmail also layers sender reputation on top, and logos can take up to 48 hours to appear — a technically valid record does not guarantee display.

The other providers add their own conditions. Yahoo and AOL show logos only for bulk mail from senders with “sufficient reputation and engagement,” and require no certificate. Fastmail requires none either, and fetches logos at its MX servers when mail arrives — so BIMI cannot be used as an open-tracking pixel. Apple’s receiver docs never state “quarantine or reject” verbatim; that bar comes from the BIMI standard, and in practice Apple Mail displays logos for iCloud-hosted mailboxes with a VMC.

One distinction worth a paragraph: Apple’s “Branded Mail” is not BIMI. It is configured through Apple Business Connect, uses a bitmap logo approved by Apple, requires DKIM, and needs no VMC. A BIMI DNS record does not drive Branded Mail, and vice versa. And the Microsoft gap is the biggest coverage hole in BIMI today: as of mid-2026 there is no receiver-side support and no announced date. The per-client walkthrough — and the record and logo mechanics — live in our BIMI record setup guide; this post stays on the policy side.

VMC vs CMC: which certificate do you need?

Once your DMARC policy clears the bar, the certificate question decides where your logo appears. The BIMI Group’s official issuer list (bimigroup.org/vmc-issuers/, verified 2026-07-28) names exactly three Mark Verifying Authorities: DigiCert, GlobalSign, and SSL.com. Entrust — an original issuer — stopped issuing VMCs on 2025-05-12; existing Entrust certificates run until natural expiry.

GlobalSign does not publish pricing on its own site, and no issuer cleanly lists a standalone CMC price — treat any CMC figure you see as a reseller quote, not a list price. Both certificate types require DMARC enforcement first: no certificate activates BIMI on a p=none domain.

The zero-cost row is legitimate, not a consolation prize. If your audience reads mail in Yahoo, AOL, or Fastmail, a self-asserted record displays your logo with no certificate at all — a reasonable way to prove the pipeline works before spending four figures.

One operational detail that bites a year later: maximum certificate validity is 397 days. Set a renewal reminder, because an expired certificate breaks logo display silently while your DNS stays unchanged. The deeper buying decision — validation steps, trademark offices, lead times — is covered in the setup guide’s certificate section; the table above is the decision in one screen.

Why does Gmail say “bimi=skipped (reason: insufficient dmarc)”?

The good news first: this state is diagnostic, not destructive. Nothing is wrong with your mail delivery — the message may even show dmarc=pass. The receiver is telling you one specific thing: your published policy is below the BIMI bar, so the logo evaluation stopped before it started. Three policy settings trigger it — p=none, a pct below 100, or sp=none — and every one of them has the same fix path: bring the organizational domain to p=quarantine or p=reject at pct=100, with no sp=none published. Once the policy clears that bar, the same header flips to bimi=pass with no other change.

A provenance aside, because no other guide gives you this: the parenthesized string people search for is a paraphrase. The verified verbatim header in the wild is iCloud’s, stamped by bimi.icloud.com:

Authentication-Results: bimi.icloud.com; bimi=skipped reason="insufficient dmarc"

No raw Gmail header containing a bimi= token has surfaced in public support threads or deliverability writeups — Gmail surfaces its authentication verdicts in the “Show original” summary box and in Postmaster Tools instead. The diagnosis is identical either way.

Here is the state taxonomy, restricted to verified states:

For “insufficient dmarc” specifically, work through the causes in this order — it matches how the failure chain actually breaks:

1. p=none on the organizational domain — the most common cause. Community reports of this exact pattern show dmarc=pass alongside bimi=skipped because the org domain never left monitoring mode.
2. Subdomain enforced, org domain at none — the newsletter trap. Yahoo historically checks the sending subdomain and shows the logo; Gmail and the draft require the organizational domain too, so Gmail skips.
3. Leftover pct<100 — a phased-rollout artifact like p=reject; pct=25 is partial enforcement. Remove the tag or set 100.
4. sp=none — disqualifies the logo even at p=reject (§7.1 step 8).
5. One sending source failing alignment — the policy is fine, but a specific ESP stream fails SPF/DKIM alignment, so BIMI is skipped for those messages only.

Only after these five come the certificate and SVG checks. That ordering matters: it stops you buying a VMC for a domain whose policy would skip the logo anyway. Run the free BIMI checker to see where your domain sits — it validates all five requirement rows against your live DNS in one pass.

The road from p=none to your logo: enforcement as the BIMI journey

Reframe the project: you do not “do BIMI.” You finish DMARC, and the logo is the milestone marker. Seth Blank, Chair of the AuthIndicators Working Group, put the design intent plainly — BIMI exists so that “DMARC benefits from the providers’ additional incentive to implement the DMARC enforced standard,” and it is “an exciting case where marketers and security professionals are aligned.” The reward was built to pull you through enforcement.

The path, with the decision gate at each stage:

1. p=none — monitor. Collect RUA data for 2–4 weeks and inventory every sending source. Your DMARC aggregate reports are the evidence base for every advance decision that follows.
2. Fix alignment. Every legitimate stream must pass DMARC in alignment before you tighten anything. Prefer DKIM alignment — it survives forwarding, so it is the durable path.
3. p=quarantine — at pct=100. A pct ramp is a valid DMARC rollout tactic, but it keeps the logo off until you reach 100. For BIMI, quarantine only counts at full coverage.
4. p=reject, with any sp= at enforcement. This is the BIMI-complete state. Publish the BIMI record per the setup guide, then the certificate if your audience needs one.

The cautionary tale from the other direction: among domains with valid BIMI records, 4.60% were still at p=none — a published logo, a hosted SVG, and nothing to show for it (Validity, “The BIMI Battle,” 13,000 domains, 2025). The record was never the hard part. The policy is.

A word on ROI, honestly. The defensible claim: BIMI puts your verified logo where a spoofer’s mail shows a generic initial — and it certifies, visibly, that your DMARC enforcement is done. The widely quoted engagement numbers deserve more caution. They trace to two sources: a 2021 Red Sift/Entrust consumer survey (1,026 participants, vendor-funded, self-reported — average open-rate lift of 21%, with the famous “+39%” being a single best-brand result) and a 2018 Yahoo Mail pilot that measured a 10% engagement increase. Both are dated, and no independent 2024–2026 study has replicated them.

Frequently asked questions

Does BIMI work with p=quarantine or only p=reject?

Both qualify. The BIMI draft requires a DMARC policy of quarantine or reject on the organizational domain and the From domain; a quarantine policy must carry pct=100. A p=none policy never displays a logo, even when every message passes DMARC.

Does BIMI require DMARC on subdomains?

Yes. The BIMI draft requires enforcement on the organizational domain and the From domain, and any published sp= tag must not be none. A domain that enforces only on a sending subdomain may show a logo in Yahoo but will be skipped by Gmail.

What does “bimi=skipped reason insufficient dmarc” mean?

Your message may pass DMARC, but the published policy is below the BIMI bar: p=none, a pct value under 100, or sp=none. The verified verbatim header comes from iCloud. The fix is moving to p=quarantine or p=reject with pct=100 and no sp=none.

Will pct=50 work for BIMI?

No. The BIMI draft states a quarantine policy must not have a pct below 100, and Google requires pct=100 explicitly. RFC 9989 removed the pct tag from DMARC entirely, so the practical guidance is to delete the tag or set it to 100.

Do I need a VMC for BIMI to work in Gmail?

Gmail requires a mark certificate — either a VMC or a CMC — referenced in your BIMI record. A VMC adds the verified checkmark; a CMC shows the logo without it. Yahoo, AOL, and Fastmail display BIMI logos with no certificate at all.

Does Outlook show BIMI logos?

No. Microsoft does not render BIMI in Exchange Online, Outlook, Outlook.com, or Microsoft 365 as of 2026, and has announced no date to. A valid BIMI record and VMC have no display effect in Microsoft-hosted inboxes.

The short version

The BIMI DMARC requirements fit on one line: enforcement — p=quarantine or p=reject — on the organizational domain and the From domain, pct=100 or no pct tag, no sp=none, and mail that passes DMARC in alignment. Then the certificate, then the logo. The requirements table at the top of this post is the checklist; if every row passes, the logo is an implementation detail. If any row fails, no certificate or SVG will save it. BIMI is proof that your DMARC job is finished — which is exactly why it is worth having.

Prefer to start further back? Start monitoring your DMARC reports — free plan, no credit card required.