Email infrastructure
BIMI: the verified logo, and what it really takes to earn it.
BIMI puts your brand logo next to authenticated mail in supported inboxes — but it is the visible payoff of work done first, not a standalone feature. The gating requirement is DMARC at enforcement (p=quarantine or p=reject, pct=100), held for roughly 30 days. Then the logo needs an SVG Tiny PS file and, for Gmail and Apple Mail, a certificate: a VMC if you hold a registered trademark and want the blue checkmark, or a CMC if you do not but can prove 12 months of logo use. The checkmark itself is VMC-only.
In short
- DMARC enforcement comes first. No p=quarantine or p=reject, no logo — at p=none BIMI simply does not light up.
- The logo must be SVG Tiny PS. Not ordinary SVG/PNG/JPEG; under 32 KB, 1:1 square, no scripts.
- VMC unlocks the blue checkmark. It needs a registered trademark; a CMC shows the logo without the checkmark.
- Provider behaviour differs. Gmail needs a certificate; Yahoo and Fastmail can show a self-asserted logo; Apple Mail is certificate territory.
- It is a trust signal, not a magic lift. Vendor engagement numbers are directional; the honest case is narrower.
What is BIMI, and why does it sit on top of DMARC?
A DNS-based standard that lets a sender display a verified brand logo next to authenticated mail in supported inboxes. BIMI itself is the instruction set in DNS; the certificate is what proves the logo is really yours. Defined as BIMI — Brand Indicators for Message Identification (RFC 9495); logos in SVG Tiny PS profile., BIMI is best understood as the visible cherry on an invisible base: the base is solid email authentication, and the logo is the reward for having built it. That is why it cannot be bought as a shortcut. A receiving provider only reaches for your logo after it has confirmed that your mail is genuinely yours, which it establishes through DMARC.
The gating requirement, stated plainly by Google and every certificate authority, is DMARC at enforcement. Your policy must be p=quarantine or p=reject with pct=100; BIMI does not support p=none, because a monitoring-only policy tells the provider you are still watching rather than actively rejecting spoofed mail. Most providers also want to see roughly thirty consecutive days at enforcement before they will display a logo, so this is not a same-afternoon project even once the policy flips.
This sequencing is the single most important thing to internalise, because it reframes BIMI entirely. It is not a marketing add-on you bolt on at the end; it is the visible confirmation that the unglamorous authentication work — SPF and DKIM aligned, DMARC moved to enforcement without breaking legitimate senders — is actually done. If you have read our pieces on moving DMARC to enforcement and keeping SPF under its lookup limit, BIMI is the thing those efforts finally make possible.
What goes in DNS, and what the logo file must be
BIMI lives in a single TXT record at the default._bimi subdomain. It carries two tags
that matter: l=, the HTTPS URL of your logo, and a=, the HTTPS URL of your
certificate PEM. For a self-asserted setup with no certificate, you leave a= blank.
# The BIMI assertion — a TXT record at default._bimi
default._bimi.example.com. TXT "v=BIMI1;
l=https://example.com/bimi/logo.svg;
a=https://example.com/bimi/cert.pem"
# l = the SVG Tiny PS logo · a = the VMC/CMC PEM (omit a= for self-asserted)The logo is where most setups stumble, because BIMI does not accept ordinary image files. It requires the SVG Tiny Portable/Secure profile, which deliberately strips scripts and external references so the file cannot carry anything harmful, and it must be a 1:1 square under 32 KB with absolute pixel dimensions and a title element.
# The logo must be SVG Tiny PS — not ordinary SVG, PNG, or JPEG
<svg xmlns="http://www.w3.org/2000/svg"
baseProfile="tiny-ps" version="1.2"
width="96" height="96" viewBox="0 0 96 96">
<title>Example Inc</title> # required
<!-- no <script>, no external refs, < 32 KB, 1:1 square -->
</svg>VMC or CMC: which certificate do you actually need?
Both certificates do the same core job — they prove to a provider that the logo in your BIMI record is legitimately yours — and both arrive as an X.509 PEM file. The difference is what they verify against, and what they unlock. A Verified Mark Certificate is tied to A registered figurative trademark, validated by an accredited CA against government IP records. It unlocks The Gmail blue verified checkmark, plus logo display in Gmail, Yahoo, and Apple Mail. The catch is the trademark: The trademark process alone can take 6-12 months if you do not already have one.
A Common Mark Certificate was introduced by Google in early 2025 to widen eligibility. It requires No registered trademark — proof of public logo use on your domain for at least 12 months (archive verification). Introduced by Google in early 2025. It unlocks Logo display in Gmail (and other supporting inboxes), but NOT the blue checkmark. In other words, a CMC gets your logo into Gmail without the bureaucracy and cost of a registered mark, at the price of the blue checkmark. The pragmatic path for SaaS and e-commerce brands without a registered mark.
The decision is therefore simpler than the vendor pages make it sound. If you already hold a registered figurative trademark and the checkmark is strategically valuable, get a VMC. In every other case — no registered mark, or the checkmark is not worth a year of trademark work — a CMC is the pragmatic choice: cheaper, faster, and enough to show the logo in Gmail. Both still require the same DMARC enforcement and the same SVG Tiny PS logo underneath.
Provider support
Who shows what?
BIMI is not one uniform experience; each provider decides what it displays and under what evidence.
| Provider | Behaviour |
|---|---|
| Gmail | Requires a VMC or CMC for logo display; the blue verified checkmark is reserved for VMC only. |
| Apple Mail | Certificate-backed territory — plan for a VMC; do not budget on self-asserted display. (Apple's separate Branded Mail via Business Connect is a different channel.) |
| Yahoo / Fastmail | Can display a self-asserted logo without a certificate, though their own reputation and authentication checks still gate it. Useful for a low-risk first test. |
The practical implication is to start from your recipient mix, not from the certificate. A consumer brand with heavy Gmail and Apple Mail traffic should plan for a certificate from the outset, because self-asserted display will not reach the inboxes that matter to it. A sender whose early audience is mostly Yahoo or Fastmail can publish a self-asserted record first as a low-risk test, then add a certificate when Gmail reach becomes worth it.
Setup
From enforcement to logo, step by step
Six steps in dependency order. The first one is the one most projects underestimate.
- 1
Get DMARC to enforcement first
BIMI does nothing at p=none. Move your DMARC policy to p=quarantine or p=reject with pct=100, confirm every legitimate sender still passes, and plan to stay at enforcement for about 30 consecutive days, which is roughly what providers want to see before they display a logo.
- 2
Decide VMC or CMC
If you have a registered figurative trademark and the Gmail blue checkmark matters to you, choose a VMC. If you do not have a registered mark but can show at least 12 months of public logo use, a CMC displays the logo in Gmail without the checkmark — it is the pragmatic path for most brands without a trademark.
- 3
Produce an SVG Tiny PS logo
Convert your logo to the SVG Tiny Portable/Secure profile, not ordinary SVG. It must be a 1:1 square, under 32 KB, centred, with absolute pixel dimensions and a title element, and it must contain no scripts or external references, which providers reject for safety.
- 4
Obtain the certificate and assemble the PEM
Apply to a BIMI-approved CA with your SVG. When the VMC or CMC is issued you receive an entity certificate; append the intermediate and root CA certificates in the issued order to build the PEM file the BIMI record will reference.
- 5
Host the assets and publish the BIMI record
Serve the SVG and the PEM over HTTPS where they are reachable externally, then publish a TXT record at default._bimi with the l= tag pointing to the SVG and the a= tag pointing to the PEM. For a self-asserted test, leave a= blank.
- 6
Test, then monitor
Confirm DNS resolution, check the SVG and PEM URLs load externally, send test mail to Gmail, Apple Mail, and Yahoo, and allow a few days for the logo to appear. Keep reading DMARC reports afterwards, because a new misaligned sender can quietly break the alignment BIMI depends on.
The whole sequence is gated by the first step, which is why teams that already run DMARC at enforcement can reach a logo in days while teams starting from p=none are looking at weeks — most of it spent watching reports to be sure the policy change does not strand a legitimate sender.
When it doesn't appear
The chain a provider checks before showing your logo
Each link must pass before the next is even evaluated — which is why the order of debugging matters.
When a logo does not appear, debug in this order, because a later link is never reached if an earlier one fails. The overwhelming first cause is DMARC not actually being at enforcement; after that, a logo that is not true SVG Tiny PS, an asset URL that is unreachable from outside, an expired or wrongly-ordered certificate chain, and — a quiet one — expecting a checkmark from a CMC, which never produces it.
BIMI as an anti-impersonation signal, not just decoration
It is easy to file BIMI under branding, but its more durable rationale is defensive. Phishing and brand impersonation are a constant, and a recipient scanning a crowded inbox has very little to go on when deciding whether a message is genuinely from a company they trust. A verified logo, backed by a certificate that a certificate authority checked against trademark or usage records, is a signal that is genuinely hard for an impersonator to reproduce, because the impersonator cannot pass the DMARC alignment and certificate validation that sit behind it.
That reframes who BIMI is for. The brands that benefit most are exactly the ones most impersonated: banks, retailers, large consumer services — senders whose name is worth faking. For them, the logo is not vanity; it is a way to make the authentic message visibly distinct from the spoof, in the one place the recipient is actually looking. The trust signal and the security control are the same thing seen from two angles, which is part of why providers tie the logo so tightly to enforcement.
It also means the value is asymmetric across sender types, and worth being honest about. A business-to-business sender whose mail lands mostly in corporate inboxes, or a low-volume internal sender, gets far less from a verified logo than a high-volume consumer brand does, because the recipient context is different and the impersonation risk is lower. The technology is the same; the return on the certificate cost is not.
What keeps BIMI working after it goes live
BIMI is not a set-and-forget record, and the maintenance burden is worth understanding before you commit. The certificate has an expiry, and a lapsed VMC or CMC removes the logo until it is renewed, so the renewal date belongs on a calendar with real ownership rather than in someone's memory. The same is true of the assets: if the SVG or PEM URL stops resolving over HTTPS — a server migration, a path change, an expired TLS certificate on the host — the logo quietly disappears with no error reaching you.
The subtler ongoing risk is alignment drift, and it ties BIMI back to the rest of your authentication. Because the whole thing depends on DMARC staying at enforcement with every legitimate sender passing, a new marketing tool or vendor added without proper SPF and DKIM setup can reintroduce alignment failures, weaken your DMARC results, and indirectly take the logo down. This is why the same DMARC report monitoring that got you to enforcement remains useful afterwards: it is the early warning that a new sender is about to undermine both your authentication and your logo.
None of this is onerous, but it is real, and it argues for treating BIMI as part of an ongoing authentication practice rather than a one-time deployment. The teams that keep their logo showing are the ones that kept reading their DMARC reports, kept their asset hosting stable, and put the certificate renewal somewhere it would not be forgotten.
Where we stand
We will be honest about the value, because the marketing around BIMI runs hot. Vendor-reported figures put BIMI's effect at roughly 4-10% higher open rates and large brand-recall gains; these come from CA and platform marketing, so treat them as directional rather than independently verified. So we would not sell BIMI as a growth lever on the strength of those numbers. The defensible case is narrower and, we think, more useful: if you already run DMARC at enforcement and send real volumes of consumer mail to Gmail, Yahoo, and Apple Mail, a verified logo is a trust signal that is genuinely hard to fake, and it makes the authentication you have already built visible to the people receiving your mail. That is worth something — but it is the reward for the prior work, not a substitute for it.
For a low-volume or business-to-business sender, the calculus is different: the certificate cost is real, the trademark route for a VMC is months of effort, and the visible payoff is smaller because your recipients are not scanning a crowded consumer inbox. Our advice is unglamorous. Get DMARC to enforcement for its own sake first, because that is where the security and deliverability value actually lives. Then, if your audience is Gmail-heavy and consumer-facing, add a CMC or VMC as the visible finish. We host the sending side and can make sure the authentication underneath BIMI is correct; the certificate itself you buy from a CA, and we would rather tell you when you do not need one.
Questions
Answered plainly
The questions teams ask before committing to a BIMI certificate.
Do I need a certificate for BIMI at all?
It depends on which inboxes you care about. Publishing a BIMI TXT record without a certificate — a self-asserted record with a blank a= tag — is valid DNS and can light up Yahoo and Fastmail, subject to their own reputation checks. But Gmail and Apple Mail will not display a self-asserted logo: Gmail requires a VMC or CMC, and Apple Mail should be treated as certificate-backed territory. So for a Gmail-heavy or B2C program, plan for a certificate; for an early Yahoo-only test, self-asserted is a legitimate first step.
What is the difference between a VMC and a CMC?
A Verified Mark Certificate is tied to a registered figurative trademark, validated by an accredited certificate authority against government IP records, and it is the only thing that unlocks the Gmail blue verified checkmark. A Common Mark Certificate, introduced by Google in early 2025, does not require a registered trademark — it accepts proof of at least 12 months of public logo use instead — and it displays your logo in Gmail but without the checkmark. Both are X.509 certificates delivered as a PEM file; the practical choice comes down to whether you have a registered mark and whether the checkmark matters to you.
What exactly does the Gmail blue checkmark require?
A VMC, specifically. The checkmark is reserved for senders verified with a Verified Mark Certificate, which in turn requires a registered figurative trademark and DMARC at enforcement. A CMC will show your logo in Gmail but will not produce the checkmark, and a self-asserted record produces neither in Gmail. If the checkmark is the goal and you do not yet have a registered trademark, the trademark process itself can take 6 to 12 months, so that is usually the long pole in the project.
Why isn't my BIMI logo showing up?
The most common cause by far is that DMARC is not actually at enforcement — if your policy is still p=none, most providers will not display the logo no matter how good the rest of the setup is. After that, the usual culprits are a logo that is ordinary SVG rather than SVG Tiny PS, or that exceeds 32 KB or is not a 1:1 square; an SVG or PEM URL that is not reachable over HTTPS from outside your network; a certificate that has expired or whose chain was assembled in the wrong order; and expecting the checkmark from a CMC, which never produces one. Work through those in order, because the later checks depend on the earlier ones.
What does BIMI actually cost?
The certificate itself runs roughly from $749 to around $3,000 per year depending on the certificate authority, with Sectigo at the lower end and DigiCert, Entrust, and GlobalSign higher. If you are going the VMC route and do not already hold a registered trademark, add the trademark filing cost — on the order of a few hundred dollars at the USPTO or around 850 euros at the EUIPO — plus the months it takes to register. Hosting the SVG and PEM can be free. A CMC avoids the trademark cost but still carries the annual certificate fee.
Is BIMI worth it, honestly?
It depends entirely on your sender profile. The engagement figures that vendors cite — open-rate lifts in the 4 to 10 percent range, large brand-recall gains — come from certificate authorities and BIMI platforms marketing their own product, so treat them as directional rather than independently proven. The more defensible case is narrower: if you already run DMARC at enforcement and send high volumes of consumer mail to Gmail, Yahoo, and Apple Mail, a verified logo is a visible trust signal that is hard to fake and reinforces the authentication work you have already done. If you are a low-volume or B2B sender, the certificate cost and trademark effort are real and the visible payoff is smaller.
Want the authentication under BIMI done right?
Tell us how you send. We will get DMARC to enforcement cleanly and make sure SPF and DKIM align — so that when you add a VMC or CMC, the logo actually appears.