Work from the message outward: check the receiving environment, authentication, DNS, file access, certificate evidence, and provider behaviour. A passing record checker is only one part of the investigation.
- Use a real message and its exact From domain.
- Verify publicly retrievable files and the issued certificate.
- Separate configuration errors from display discretion and caching.
First: confirm the test environment
Write down the recipient provider, app, account, and view where you expected the logo. Check whether that combination supports BIMI. Distinguish a logo from a contact avatar, and repeat the test without relying on a saved contact picture.
Check the message, not just the domain
Inspect the receiving service’s authentication results for the actual email. Look for DMARC pass and an aligned SPF or DKIM identity. A domain can have valid DNS records while a particular sending service signs with the wrong domain.
Compare a working stream with a failing one: visible From domain, signing domain, envelope domain, and sending service. Change one variable at a time.
Check the precise DNS name
Confirm the record exists at the expected selector and domain. Look for duplicate records, a duplicated domain suffix in the hostname, typographic quotes, missing separators, or outdated asset URLs.
Check the relevant DMARC policy too. The existence of a policy is not the same as full enforcement.
Fetch the assets as a public visitor
Open the exact URLs from the record. Verify that the response is the SVG or PEM file, rather than a sign-in screen, bot challenge, error page, or expired link. Check TLS validity and the full certificate chain.
Then validate the actual SVG bytes. A successful HTTP response does not prove the logo meets Tiny PS requirements.
Inspect certificate evidence
Confirm that the certificate is issued, currently valid, accepted by the target provider, and appropriate for the domain and logo. Follow the issuer’s instructions for including any required intermediates in the public PEM file.
Check whether a recent rebrand replaced the SVG without coordinating the certificate. If evidence is inconsistent, contact the issuer before making further artwork changes.
If everything checks out
Account for DNS and receiver caching, then re-test after an appropriate interval. Consider sender reputation and provider-specific criteria. Avoid promising that waiting a fixed number of hours will always solve the problem.
Build a support packet with the domain, selector, public URLs, timestamps, authentication results, client details, and validation output. Redact personal message content and credentials before sharing it with a provider or issuer.
Go to the source
Provider policies and specifications can change. These primary sources informed this guide, reviewed on 1 November 2026.