Why does a logo published in DNS show up for one recipient and stay invisible for another, when the email tool reports “BIMI active” across the entire list? The answer comes down to a word few guides actually explain: self-asserted. A self-asserted BIMI record publishes only the logo’s SVG file, with no brand certificate attached. The sender declares its own legitimacy, with no certificate authority confirming anything. The final rendering then depends entirely on the mailbox provider receiving the message. A good chunk of the market simply ignores it.
What a record without a certificate contains (and doesn’t contain)
A standard BIMI record publishes two resources in DNS: a link to an SVG file, the logo expected in the inbox, plus a link to a PEM file carrying the brand certificate. Self-asserted mode drops the second piece. Only the SVG remains. The sender itself asserts that the logo and domain genuinely belong to the company claiming them, with no third party verifying it. The file still has to follow the format the spec requires, a point already covered in detail in the guide to creating an SVG file that meets BIMI specs. This mode costs nothing and requires no application to a certificate authority.
Yahoo Mail and Fastmail show the logo without asking for anything more
Two major players accept the self-asserted record as is. Yahoo Mail and Fastmail display the logo as soon as a valid BIMI record is published in DNS, even without a certificate. No VMC, no CMC, no external check. For a sender who just wants to see what their logo looks like under real conditions before investing in a paid certificate, these two mailboxes are enough to run the test. That’s actually the fastest way to check the rendering: a seed test through a tool like GlockApps on a Yahoo or Fastmail address shows within minutes whether the SVG displays correctly, without waiting several weeks for certificate validation.
Gmail and Apple Mail show nothing until a certificate exists
Gmail and Apple Mail work the opposite way. Without a VMC (Verified Mark Certificate) or CMC (Common Mark Certificate), the logo stays absent, no matter how well-crafted the published SVG is; both of these mail services treat self-asserted as if it didn’t exist. Gmail has accepted both certificate types since the CMC arrived, a shift detailed in the article on Gmail’s launch of the Common Mark Certificate. Apple Mail remains more restrictive about the type of proof it accepts. The choice between the two certificates comes down to cost and the process for obtaining one, a trade-off detailed in the VMC vs. CMC comparison, which won’t be repeated here. Without one of the two, all the effort put into the SVG produces exactly zero display with these two providers. And before certificates even enter the picture, the DMARC record already needs to be set to quarantine or reject, a prerequisite covered in the authentication requirements (SPF, DKIM, DMARC) before publishing a BIMI record.
Why some providers tolerate an unverified logo anyway
Instead of a certificate authority guaranteeing your identity, you’re the one asserting that the logo, the domain, and the company are legitimate.
This line from Al Iverson, a deliverability expert at Valimail, sums up the whole mechanism in an analysis published on Spam Resource in July 2026. His reading of Yahoo’s and Fastmail’s choice is direct: accepting self-asserted means betting that DMARC alignment already does most of the work filtering out impersonation. The risk of abuse stays manageable given their user volume. Gmail reasons differently. The platform builds its display policy on broader sender reputation signals, the same ones tracked by Google Postmaster Tools; a misattributed logo could end up displayed next to a phishing email, and the complaint rate reported back from Gmail inboxes weighs directly on that caution. Apple applies a similar logic with its own verification. None of these choices are set in stone: the BIMI spec keeps evolving under the working group that maintains it.
Some ESPs turn it on by default without saying so
One detail often goes unnoticed. Several sending platforms, including Twilio SendGrid, document BIMI configuration in their advanced settings without necessarily flagging the distinction between self-asserted and certified for the sender. The customer publishes their SVG following the documentation, sees the logo appear in their Yahoo test, and wrongly concludes that BIMI “works” everywhere. That’s exactly the blind spot: a positive result with one provider says nothing about how the logo behaves everywhere else.
Who this mode actually serves
Self-asserted has a legitimate use case. For a sender who wants to validate their SVG before paying for a VMC or CMC, it’s a free, immediate test. For a B2C audience with a meaningful share on Yahoo Mail or Fastmail, even a partially visible logo can already move the click-to-open rate (CTOR): the visual presence reassures part of the audience. It’s also a useful piece of indirect list hygiene: a clean domain, already set to DMARC reject, is exactly what self-asserted piggybacks on for free.
Who it’s useless for
For a customer file made up mostly of Gmail and Google Workspace addresses, very common in French B2B, the self-asserted BIMI logo won’t change anything. The logo will stay invisible no matter how carefully the SVG file or DNS configuration is put together. The test still holds up on a Yahoo or Fastmail mailbox. It says nothing about the rest of the inbox providers: for most B2B traffic, only a VMC or CMC opens the door to Gmail and Apple Mail. Publishing just the SVG in that context amounts to decorating a mailbox nobody will open.
The choice between VMC and CMC, meanwhile, comes down to entirely different factors: price and the time it takes to get one from the certificate authority. The brand proof required also differs depending on which certificate you’re going for.
