Confirm that the test message qualifies technically

Open the original message at the mailbox provider where display is missing. Verify the visible From domain and trusted DMARC result. Record which aligned SPF or DKIM path passed and the applicable DMARC policy. BIMI program guidance expects enforcement; a p=none policy or failing alignment is not fixed by a valid BIMI record.

Check for a BIMI-Selector header. Construct the exact assertion name from its value or use default. Query that name through authoritative and recursive DNS and parse the returned record.

Test each referenced resource

Fetch the l= SVG and a= evidence document, when present, using a security-reviewed bounded client. Confirm HTTPS, valid public TLS, limited redirects, public access, expected content type, safe file size, and stable bytes. Validate SVG Tiny P/S locally and verify the certificate chain, dates, domains, and embedded/identified mark with approved tools.

CDN bot rules, geo restrictions, hotlink protection, authentication, and redirect loops can allow your browser while blocking provider retrieval. Test from an external controlled vantage point without weakening asset security broadly.

Check provider and client scope

Use the provider’s official current page to confirm whether it supports BIMI in the tested account type, client, message view, country, selector mode, certificate class, and issuer. Providers may apply non-public reputation and volume criteria. The same provider can show a logo in one client surface and not another.

Allow for DNS and image caches, but record observed TTLs and retest times rather than repeating “wait 48 hours” without evidence. Send a fresh message after configuration changes.

Exclude lookalike display systems

Some mailbox products show profile images or proprietary brand badges unrelated to BIMI. Confirm that the UI element under investigation is actually attributed to BIMI before changing DNS.

Escalate with a bounded evidence pack

Provide the provider with From domain, selector, timestamps, sanitized message authentication results, DNS record, asset status, certificate summary, account/client, and screenshots. Do not send private keys, customer content, or credentials.

Close the incident as “observed,” “configuration failure,” “provider criteria not met,” or “provider decision unknown.” A correct configuration can improve eligibility but cannot compel display.