Will my logo show if DMARC is at p=none?

No. BIMI requires DMARC at quarantine or reject; enforcement is a hard requirement, not a recommendation. A BIMI record on a domain at p=none is inert until the policy is raised.

Do I have to buy a Verified Mark Certificate?

It depends on the provider. Gmail requires one, and a VMC also requires a registered trademark for the logo, which is a longer process than the certificate itself. Some other providers have shown logos without one, but requirements change, so treat the VMC as needed if Gmail matters to you.

ConceptBIMI

What is BIMI?

BIMI (Brand Indicators for Message Identification) is the standard that displays your logo next to your messages in supporting mailbox providers. It is a reward for enforced authentication, not a setting on its own: BIMI only works once your domain has DMARC at quarantine or reject, and some providers additionally require a Verified Mark Certificate proving you own the trademark on the logo. A BIMI record on a domain that is not yet enforcing DMARC has no effect.

See it on your own domainBIMI checker

What has to be true before a logo appears

BIMI sits at the top of a stack. The message must pass DMARC; the domain's DMARC policy must be quarantine or reject at full coverage; a BIMI record must publish an SVG logo in the restricted SVG Tiny Portable/Secure profile, served over HTTPS; and for Gmail and some others a Verified Mark Certificate is required. Most domains that publish BIMI early are blocked at the enforcement step, because p=none does not qualify.

Why enforcement is the real work

The logo is the easy part; reaching DMARC enforcement is the actual project, and it is worth doing for deliverability and anti-spoofing regardless of whether you ever display a logo. Treat BIMI as the incentive that finally gets DMARC to reject, not as a task in itself: the checker will tell you whether your DMARC policy currently qualifies.

Common questions

Will my logo show if DMARC is at p=none?: No. BIMI requires DMARC at quarantine or reject; enforcement is a hard requirement, not a recommendation. A BIMI record on a domain at p=none is inert until the policy is raised.
Do I have to buy a Verified Mark Certificate?: It depends on the provider. Gmail requires one, and a VMC also requires a registered trademark for the logo, which is a longer process than the certificate itself. Some other providers have shown logos without one, but requirements change, so treat the VMC as needed if Gmail matters to you.