BIMI: showing your logo in the inbox

What BIMI requires (a DMARC enforcement policy, an SVG and, for some providers, a certificate) and what it does not do.

BIMI (Brand Indicators for Message Identification) lets mailbox providers show your logo next to authenticated messages. It is not an authentication method itself; it is a reward for having authentication done properly.

Prerequisites

DMARC at enforcement: p=quarantine (with pct=100) or p=reject on the organisational domain. p=none disqualifies you.
Aligned SPF or DKIM on the mail you send, so it actually passes DMARC.
A logo in SVG Tiny Portable/Secure format: square, solid background, no scripts or external references.

The record

A TXT record at default._bimi.example.co.uk:

v=BIMI1; l=https://example.co.uk/brand/logo.svg; a=https://example.co.uk/brand/vmc.pem

l= points to the logo over HTTPS. a= is optional and points to a Verified Mark Certificate (VMC) or Common Mark Certificate, which Gmail and Apple Mail require before they display the logo; Yahoo and Fastmail display logos without one. Certificates are issued by a small number of authorities and require a registered trade mark (VMC) or twelve months of prior use (CMC).

What the Mail facet checks

That the record exists and parses, that the logo URL answers over HTTPS with an SVG, and that DMARC is at enforcement. It does not validate the certificate chain of a VMC.

Is it worth it

Without a certificate BIMI is a free change and works with several providers. With a certificate it costs a few hundred pounds a year. Either way, getting DMARC to enforcement first is the part that protects your domain; the logo is the visible bonus.