BIMI logo URL cannot be fetched
What this check looks for
The logo your BIMI record points at could not be downloaded. Mailbox providers that cannot fetch it simply show no logo.
Why it matters
Everything else in the setup is correct and the visible result is nothing at all, which is hard to diagnose from the inbox side.
When the check passes, your report says: “The BIMI logo downloads from the URL in the record”.
What it costs your score
When this check fails it removes 5 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.bimi family ceiling of 10 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- high
- Status when triggered
- fail
- Deduction
- 5 points
- Family cap
- email-auth.bimi · 10
- Category
- Email authentication
- Module
- Email bimi
- Fix owned by
- user
- In the ruleset since
- 2026.09
How to fix it
Serve the logo over HTTPS from a URL that anyone can fetch without authentication.
A logo that cannot be downloaded is not displayed, so the whole BIMI setup produces nothing.
Open
‹logo url›in a private browser window to confirm it loads without a login.Check the host's TLS certificate is valid and publicly trusted.
Remove any bot filtering or hotlink protection that blocks the mailbox providers' fetchers.
How to confirm it worked
curl -sI ‹logo url› — expect HTTP 200 and Content-Type: image/svg+xml
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Fetching ‹logo url› failed: ‹fetch error›. The BIMI specification requires the logo to be served over HTTPS with a publicly trusted certificate, with no authentication and no redirect to a different origin. A common cause is a logo behind a CDN rule that blocks unknown user agents.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.