Four live records, each showing a different arrangement. Reading them is the fastest way to see what a working deployment looks like and where a broken one would show.
Certificate authority hosting
"v=BIMI1;l=https://vmc.digicert.com/9e57aa28-...svg;a=https://vmc.digicert.com/9e57aa28-...pem" "v=BIMI1; l=https://vmc.globalsign.com/CEVMC250919868720/logo.svg; a=https://vmc.globalsign.com/CEVMC250919868720/vmc.pem"
Both point at their issuing authority. The advantage is that the two files cannot drift apart — the CA serves the certificate and the logo it contains from the same place. The cost is a dependency on the CA’s availability for something a mail client fetches.
Self-hosting
"v=BIMI1; l=https://media.licdn.com/media/AAYQAQQhAAg...svg; a=https://media.licdn.com/media/AAYABAQhAAg...pem;" "v=BIMI1;l=https://www.dhl.com/dhl-email-logo/dhl-bimi.svg; a=https://www.dhl.com/dhl-email-logo/dhl-vmc_20250916.pem"
LinkedIn serves both from its own CDN. DHL serves them from its main web estate, and the certificate filename carries a date — dhl-vmc_20250916.pem — which is the visible trace of an annual renewal. That is a sound convention: the next renewal gets a new filename and a record change, rather than a file replaced in place while clients hold the old one.
Checking one yourself
# 1. The record parses and both URLs are HTTPS dig +short TXT default._bimi.<domain> # 2. Both fetch, with a valid TLS certificate curl -sI <the l= URL> | head -1 curl -sI <the a= URL> | head -1 # 3. The DMARC policy is at enforcement with pct absent or 100 dig +short TXT _dmarc.<domain> # 4. The SVG is square, has a <title>, and no script or # external reference
Every failure is silent
- A logo that does not meet the profile is not rendered, and nothing tells you.
- An expired VMC stops the logo, and nothing tells you.
- A DMARC policy that slips to
p=noneduring an incident stops the logo, and nothing tells you. - A client that does not implement BIMI shows nothing either, which is indistinguishable from all of the above.
The only test is a delivered message
Send to an account at a provider that implements BIMI and look. Validators check the record and the file; only a real message exercises the whole chain, including the DMARC result on that specific stream — which is the part most likely to be the problem.