Why Is DMARC Enforcement Mandatory for BIMI and a VMC?

DMARC enforcement is mandatory because a logo is a trust signal, and a trust signal on an unprotected domain would be worse than no signal at all. If anyone could spoof your domain, a displayed logo would help the spoofer, not the recipient.

That is the whole reasoning in one sentence. It is also the requirement that stops more BIMI projects than every other requirement combined, so it is worth understanding properly rather than treating as a box to tick.

What enforcement means

DMARC policies come in three levels, set by the p= tag in your DMARC record.

• p=none tells receiving servers to do nothing when a message fails authentication. It is a monitoring mode. It generates reports and changes no outcomes.
• p=quarantine tells them to treat failing mail as suspicious, typically routing it to spam.
• p=reject tells them to refuse failing mail outright.

Only the second and third count as enforcement. A domain at p=none is not protected, it is merely observed, and no mailbox provider will display a logo for it. Enforcement is one of five prerequisites, listed together in the technical requirements for a VMC.

There is a subtlety worth knowing. If you use the pct= tag to apply your policy to a percentage of mail while you phase in, anything below pct=100 is treated as not being fully at enforcement for BIMI purposes. Partial enforcement does not earn a partial logo.

Why mailbox providers insist

Put yourself on the receiving side. Gmail is deciding whether to draw a recognizable logo, and in some cases a blue checkmark, next to a sender name. That mark tells hundreds of millions of people "this is really them".

If the domain is spoofable, that promise is unsafe. An attacker sends a convincing invoice from your unprotected domain, the recipient's inbox helpfully renders your logo beside it, and your brand has just lent its credibility to a phishing message. The logo would actively increase the damage.

So the providers made the sequence non-negotiable. Prove the domain cannot be casually impersonated, then get the visual reward. Enforcement is the proof.

This is also why we tell brands that the DMARC work is worth doing on its own terms. Even if you never pursue a certificate, reaching enforcement stops your domain being used against your customers.

Why it is the hard part

Publishing a DMARC record is trivial. Reaching enforcement safely is not, and the reason is a discovery problem.

p=reject instructs the world to discard mail that fails authentication for your domain. If a legitimate system is sending as you and has not been brought into SPF or DKIM, that system's mail starts disappearing. Not bouncing visibly to the marketing team, disappearing, often for weeks before anyone connects the symptom to the cause.

The systems that get missed are always the same kinds of things. The invoicing platform finance set up directly with the vendor. The recruitment tool HR runs. The survey tool one team uses once a quarter. A regional office's separate mail relay. An old application server that still sends password resets. None of these appear on any list, because no list exists.

That is what the work actually is: finding every sender before you turn enforcement on.

How to get there without breaking mail

The safe path is unglamorous and takes weeks rather than days.

1. Publish p=none with reporting. Add a rua= address so aggregate reports start arriving. This changes nothing about mail flow and starts the clock on discovery.
2. Read the reports for several weeks. Aggregate reports are XML, so use a processing tool rather than reading raw files. What you are building is a complete inventory of every IP and system sending as your domain.
3. Authenticate every legitimate sender. Add each to SPF, keeping within the ten lookup limit, and enable DKIM signing on every platform that supports it. Signing is the more durable of the two, since it survives forwarding better than SPF does.
4. Investigate the rest. Some of what remains is spoofing, which is exactly what you are about to stop. Some is a legitimate system you have not identified yet. You need to know which is which before proceeding.
5. Move to p=quarantine. Watch the reports and your support channels closely.
6. Move to p=reject once quarantine has been stable and nothing legitimate is failing.

Rushing this is the expensive mistake. Skipping straight to p=reject because the certificate is waiting is how a company discovers, three weeks later, that its customers stopped receiving order confirmations.

The subdomain trap

One detail worth calling out separately. The sp= tag sets the policy for your subdomains, and if it is absent, subdomains inherit the parent policy.

Where this goes wrong is a domain at p=reject with sp=none set, usually added at some point to stop a subdomain breaking. The organizational domain looks enforced, but a permissive subdomain policy leaves an obvious gap, and it affects whether logos display on mail from those subdomains. If you send from several subdomains, read can one VMC cover multiple domains and subdomains alongside this.

The upside nobody plans for

Brands come to us wanting a logo in the inbox. They usually leave with something they valued more.

A domain at enforcement is a domain that cannot be trivially impersonated. Phishing that uses your exact domain stops landing. And because mailbox providers treat well-authenticated mail more favourably, legitimate mail tends to place better once the underlying authentication is clean. We look at how much of that is real and how much is overstated in do VMCs improve deliverability.

The certificate is the visible outcome. Enforcement is the valuable one.

How Signume handles it

This is the part of a BIMI project we spend the most time on, because it is the part with real risk attached.

We publish the reporting policy, process the aggregate reports, and build the inventory of every system sending as your domain. We bring each legitimate sender into SPF and DKIM, then step the policy up through quarantine to reject while watching for anything that breaks. Only then does the certificate work start.

For EU and UK brands, that means you reach enforcement without a period of quietly lost mail, and the VMC application succeeds first time.

Frequently asked questions

Why does BIMI require DMARC enforcement? Because a logo is a trust signal. If a domain can be spoofed, displaying its logo would lend credibility to phishing, so mailbox providers require proof the domain is protected before showing any mark.

Is p=none enough for BIMI? No. p=none is monitoring only and changes no outcomes. BIMI requires p=quarantine or p=reject, and a pct= value below 100 is treated as not fully enforced.

Is quarantine or reject better for a VMC? Both satisfy the requirement. p=reject offers stronger protection against spoofing, but p=quarantine is a legitimate destination if your organization prefers to keep failing mail recoverable.

How long does it take to reach DMARC enforcement? Usually several weeks to a few months. The time goes into discovering every legitimate sender through aggregate reports, not into publishing records, which takes minutes.

What happens if I move to p=reject too quickly? Legitimate mail from any system you have not authenticated starts being discarded, often silently. This is the main risk in a BIMI project and the reason the discovery phase should not be shortened.