BIMI logo is not a valid SVG Tiny Portable/Secure file
What this check looks for
Your logo is not in the restricted SVG format BIMI requires. Mailbox providers reject anything else, so the logo is not shown.
Why it matters
The format is deliberately narrow because the file is rendered inside a mail client; anything outside it is discarded rather than adapted.
When the check passes, your report says: “The logo is a valid SVG Tiny Portable/Secure file”.
What it costs your score
When this check fails it removes 5 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.bimi family ceiling of 10 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 5 points
- Family cap
- email-auth.bimi · 10
- Category
- Email authentication
- Module
- Email bimi
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Convert the logo to SVG Tiny P/S and re-upload it.
Anything outside the profile is rejected outright, so the logo never renders.
Export the mark as SVG with a square viewBox, so it is not cropped in the circular or square slot mailbox providers draw it in.
Set both root attributes exactly:
version="1.2"andbaseProfile="tiny-ps". The profile pins both values, and a file missing either is rejected however good the artwork is.Add a single non-empty
<title>naming your brand. Keep it to 64 characters or fewer, which is what the profile recommends.Keep
widthandheighton the root element, in absolute pixels and at least 96 — Gmail requires them and rejects relative values such as100%. Do not strip them.Remove any
xoryattributes from the root<svg>element. Illustrator adds these on export and they are the commonest reason a hand-exported logo fails.Strip scripts, event handlers, animation,
<image>,<switch>,<a>, external references and any DTD subset or entity declaration.Keep the file under 32 kilobytes uncompressed, and re-upload it to the same HTTPS URL the
l=tag points at.
How to confirm it worked
curl -sS ‹logo url› | head -c 400 — confirm version="1.2", baseProfile="tiny-ps", a non-empty <title>, and no x= or y= on the root element
curl -sSI ‹logo url› | grep -i content-length — confirm the file is under 32768 bytes
Re-run the BIMI checker and confirm the logo validation passes.
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
‹logo url› failed SVG Tiny P/S validation: ‹validation error›.
The profile pins two root attributes — version="1.2" and baseProfile="tiny-ps" — and requires a single non-empty <title>. It forbids scripts, event handlers, animation, <image>, <switch>, <a>, external references and an internal DTD subset, and it does not permit x or y on the root <svg> element. A logo over 32 kilobytes uncompressed is rejected here too: the profile states that as a SHOULD NOT and Gmail states it flatly.
**Two things commonly misreported elsewhere.** width and height on the root element are permitted, and Gmail requires them in absolute pixels — at least 96 — so do not strip them. <use> is permitted as well. What Illustrator adds on export, and what has to come back out, is the x/y pair.
We additionally require a square viewBox. That is not in the specification: the BIMI Group gives square aspect ratio as compatibility advice, because the indicator is drawn in a circular or square avatar slot and anything else is cropped.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.