bonus.bimi.dmarc_not_enforced

BIMI Published Without DMARC Enforcement

What we check

We check whether the domain's DMARC policy meets BIMI's prerequisite: enforcement (p=quarantine or p=reject) at 100%. BIMI requires DMARC at enforcement before a client will show the logo; a monitoring-only policy or a partial pct does not qualify.

What this finding means

The domain publishes a BIMI record, but its DMARC policy isn't at enforcement — it's p=none, or it's quarantine/reject with a pct below 100. Clients that support BIMI won't display the logo without an enforced DMARC policy, so the BIMI record does nothing until DMARC is tightened.

The order matters: BIMI sits on top of DMARC enforcement. Publishing the BIMI record first is putting the roof up before the walls.

Why it matters

The logo won't show. BIMI's own requirement is DMARC at p=quarantine or p=reject on the organizational domain and subdomains, at 100%. Below that, no supporting provider displays the logo.
Effort in the wrong order. Time (and possibly certificate money) spent on BIMI is wasted until the DMARC prerequisite is met. The valuable work is getting DMARC to enforcement.
A signal to finish DMARC. This finding is really a nudge: the BIMI record shows the intent, but the foundation — enforced DMARC — isn't there yet.

How to fix

Advance DMARC to enforcement. Using your aggregate (rua) reports, confirm every legitimate sender is aligned, then move to p=quarantine and on to p=reject at full coverage:
```
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
```
Remove any pct below 100 — enforcement must apply to all failing mail, not a fraction.
Re-check BIMI afterward. Once DMARC is enforcing, a valid BIMI record and logo can display at supporting providers (subject to their VMC/CMC requirement).

How it's graded

BIMI published without DMARC enforcement costs 5 points in the optional Bonus category. See Grading Methodology for the full scoring model.

Evidence example

BIMI record:  "v=BIMI1; l=https://example.com/logo.svg"
DMARC record: "v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com"
                          ^^^^ not at enforcement — BIMI logo will not display

References

RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance (DMARC)