BIMI render check

What's confirmed good

• DMARC at p=quarantine (pct=100) — at enforcement, which BIMI requires.
• BIMI record is published and valid — default._bimi.carepatron.com points to a logo + VMC.
• The logo is a valid SVG Tiny-PS with a <title>, and the VMC certificate resolves (HTTP 200, real PEM chain).
• DKIM is set up for the apex — selectors k2 and k3 sign as carepatron.com (an ESP, almost certainly Customer.io). That means DMARC passes on DKIM alignment, so the ~all SPF doesn't matter for BIMI.

The one thing to confirm (inside Customer.io)

BIMI does not inherit to subdomains — it only renders for mail whose From domain matches the BIMI record domain and passes DMARC.

1. Open the marketing sender identity in Customer.io.
2. Confirm the From is exactly @carepatron.com (not a subdomain like e.carepatron.com).
3. Confirm CIO is DKIM-signing with d=carepatron.com.

If both are true — which the DNS strongly implies — the logo renders in Gmail and Apple Mail. If CIO sends from a subdomain, that's the only failure mode, and BIMI would need publishing on that subdomain too.

Optional hygiene (non-blocking)

SPF is v=spf1 include:_spf.google.com ~all (softfail). Could harden to -all later, and add the ESP's SPF include for belt-and-braces. Neither affects whether BIMI renders.