What has to be in place
BIMI lets a mailbox provider show a brand's logo in the inbox instead of the grey initial. Four things have to line up, and the checker goes through them in this order. A DMARC policy at enforcement. A BIMI record at default._bimi followed by the domain. An SVG logo in the restricted format the record points to. And for Gmail and Apple Mail, a certificate that ties the logo to the domain.
DMARC comes first because the logo is only shown on mail that passes it. The policy has to be quarantine or reject, with pct at 100 if the tag is there. p=none is not enough. Neither is sp=none: a subdomain policy of none in the record switches BIMI off for the whole domain, the main one included, which catches people who tightened p and left sp alone.
The logo file
The l= tag in the record holds an HTTPS link to an SVG file. Not every SVG works. It has to follow the SVG Tiny Portable/Secure profile, which means baseProfile="tiny-ps", a title element, no scripts, no links to other files and no embedded raster images. The image should be square, since providers crop it to a circle or a rounded square.
The checker downloads the file, checks the size and content type, and reads the SVG for the attributes and elements the profile rules out. Files exported from design tools can fail it, for example over a missing title, or the x and y attributes Illustrator leaves on the root element.
VMC, CMC or no certificate
The a= tag points to a certificate in PEM format. A Verified Mark Certificate needs a registered trademark for the logo. A Common Mark Certificate needs no trademark; the certificate authority asks for proof that the logo has been in use. Gmail shows the logo with either; Yahoo can show it without a certificate for senders it already trusts.
When the record has a certificate, you see who issued it, which domain it covers and when it expires. A certificate that has lapsed makes the logo disappear without any other sign.