The record sits at default._bimi.example.com: v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem. The logo must be a square SVG in the restricted SVG Tiny Portable/Secure profile, served over HTTPS. Mailbox providers show it only if the message passes DMARC and the domain's policy is quarantine or reject (where a legacy pct tag is present it must be 100).
Most large providers also require a mark certificate in a=: a Verified Mark Certificate (VMC) for a registered trademark, or for Gmail alternatively a Common Mark Certificate (CMC) for a logo the organization has used publicly. Gmail shows a verified check mark only with a VMC; Yahoo displays logos without a certificate for qualifying senders.
BIMI does not authenticate anything new; it rewards domains that already enforce DMARC. The BIMI and VMC decoder checks the record, the SVG profile and the certificate.