Will my logo show if DMARC is at p=none?

No. Enforcement is a hard requirement, not a recommendation. A BIMI record on a domain at p=none is inert.

Is quarantine enough, or do I need reject?

Quarantine at pct=100 satisfies the requirement for the major providers. Reject is stronger and is the better end state for other reasons, but it is not required specifically for BIMI.

Do I have to buy a Verified Mark Certificate?

It depends on the provider, and on when you ask. Gmail currently expects a mark certificate; the accepted types have widened over time, and other providers have varied. Treat any specific requirement you read (including this one) as a point-in-time statement and check the provider's own documentation before spending. The slow part is not the certificate but the registered trademark it attests to, so start that early if the logo matters to you.

Why does my SVG get rejected?

Because BIMI accepts only SVG Tiny PS, a deliberately restricted profile with no scripting, no external references and no animation. Ordinary SVG exports include features outside that profile and are refused.

MediumPolicy

BIMI record published without DMARC enforcement

BIMI requires DMARC at quarantine or reject. A domain publishing a BIMI record while sitting at p=none will not have its logo displayed anywhere, because BIMI is a reward for enforced authentication rather than a setting of its own. The BIMI record is not wrong: it simply has no effect until the DMARC policy is raised.

Check your own domainBIMI checker

What causes this

BIMI is only honoured for domains at DMARC enforcement, because the logo is a trust signal and it would be actively harmful to display it for a domain anyone can forge. With p=none the BIMI record is published but no provider will act on it.

What it breaks

The logo is not displayed. The BIMI record has no effect until the DMARC policy is raised.

What the receiving server does

A participating mailbox provider checks that the message passed DMARC, then checks that the domain's DMARC policy is quarantine or reject with full coverage. Only then does it fetch the BIMI record and display the logo. At p=none the check stops at the policy and the logo is never requested, so nothing about the BIMI record is validated and no error surfaces. Some providers additionally require a Verified Mark Certificate, which is a paid attestation that you own the trademark on the logo.

What has to be true before a logo appears

BIMI sits at the top of a stack, and every layer below it has to be in place. The order is not optional, and most domains that publish BIMI early are blocked at the third line.

1SPF or DKIM passing with alignmentDMARC needs at least one aligned pass

2DMARC published and reportingwith a rua address you actually read

3p=quarantine or p=reject, pct=100enforcement is the gate (this is where p=none stops)

4BIMI record with an SVG logoSVG Tiny PS, square, hosted over HTTPS

5VMC for some providersa paid certificate attesting trademark ownership

How to fix it

Raise the DMARC policy to quarantine or reject.

Work through DMARC aggregate reports until every legitimate sender authenticates with alignment.
Raise p= to quarantine, then reject.
BIMI then takes effect with no further change to the BIMI record.

If you send with

Gmail: Requires DMARC enforcement, and currently a mark certificate as well: historically a Verified Mark Certificate, with Common Mark Certificates accepted for some marks since. The logo appears in the avatar position in the message list. Certificate requirements are provider policy rather than protocol, and they have changed more than once, so confirm the current rule with Google before buying anything.
Yahoo and Apple Mail: Also require enforcement. Support and certificate requirements vary between them and change over time, so treat the enforcement work as the durable investment and the certificate as provider-specific.
The logo file itself: BIMI requires SVG Tiny Portable/Secure, a restricted SVG profile with no scripts, no external references and no animation. A standard export from design software will usually be rejected, so the file needs converting and validating specifically for this purpose.

Confirming the fix worked

Move DMARC to quarantine or reject with pct=100, following the staged rollout rather than jumping straight there.
Confirm aggregate reports show your legitimate mail passing before enforcing, since BIMI is not worth losing mail over.
Publish the BIMI record at default._bimi.yourdomain.com pointing at an SVG Tiny PS file served over HTTPS.
Obtain a VMC if you need the logo shown in Gmail, then send test mail to accounts at each provider you care about.

Common questions

Will my logo show if DMARC is at p=none?: No. Enforcement is a hard requirement, not a recommendation. A BIMI record on a domain at p=none is inert.
Is quarantine enough, or do I need reject?: Quarantine at pct=100 satisfies the requirement for the major providers. Reject is stronger and is the better end state for other reasons, but it is not required specifically for BIMI.
Do I have to buy a Verified Mark Certificate?: It depends on the provider, and on when you ask. Gmail currently expects a mark certificate; the accepted types have widened over time, and other providers have varied. Treat any specific requirement you read (including this one) as a point-in-time statement and check the provider's own documentation before spending. The slow part is not the certificate but the registered trademark it attests to, so start that early if the logo matters to you.
Why does my SVG get rejected?: Because BIMI accepts only SVG Tiny PS, a deliberately restricted profile with no scripting, no external references and no animation. Ordinary SVG exports include features outside that profile and are refused.