BIMI, VMC and CMC certificates: requirements and Gmail rules

BIMI shows a logo; it does not change delivery

Brand Indicators for Message Identification (BIMI) lets a domain publish a logo assertion in DNS. After a message authenticates and aligns with DMARC, an inbox provider that supports BIMI can look up the record and decide whether to show the logo. The logo usually appears near the sender in the message view; the exact display is the provider’s choice. ^[1]

BIMI is not a new authentication protocol or a deliverability switch. BIMI Group says it does not change message delivery: it is a display signal layered on strong authentication. It also says BIMI is not itself a security solution. DMARC enforcement is a separate email-authentication control, and moving to enforcement can affect mail that fails alignment. A logo cannot make an unwanted or failing message reach the inbox. ^{[1] [3]}

DMARC enforcement is the real readiness gate

Before creating a BIMI record, inventory every system that sends with your domain in the visible From address. Configure SPF or DKIM so legitimate messages pass DMARC alignment. A DMARC record at p=none is monitoring, not enforcement, and does not meet either BIMI Group’s or Google’s published BIMI requirements. ^{[1] [2] [3]}

BIMI Group’s guide requires enforcement for the organizational domain and subdomains. Its examples pair p=quarantine with sp=quarantine, or p=reject with sp=reject, and reject pct below 100. Google’s current Gmail guide separately requires p=quarantine or p=reject and pct=100. It does not specify sp or a separate subdomain rule, so do not read that silence as an exemption from BIMI Group’s guidance. ^{[2] [3]}

The safe sequence is to identify every sender, align SPF or DKIM, review DMARC reports, and fix legitimate mail that fails before changing policy. Then confirm the organizational policy and each sending subdomain are covered. If your inventory is incomplete or many services still depend on p=none, pause the BIMI project rather than applying enforcement just to obtain a logo. ^{[1] [2]}

Create the record and a valid SVG Tiny PS logo

BIMI uses a DNS TXT record at a selector name, usually default._bimi.example.com. The v=BIMI1 tag identifies the record version, l= points to the SVG logo, and optional a= points to a certificate file. Keep the files publicly reachable over HTTPS. The server must return an appropriate image type for a standalone SVG. ^{[1] [2]}

The image format is SVG Tiny Portable/Secure, usually shortened to SVG Tiny PS. Google’s current Gmail requirements specify baseProfile="tiny-ps" and version 1.2; they prohibit scripts, external links, animation and interactive elements. Gmail also requires absolute pixel dimensions of at least 96 by 96. Centering the mark in a square and using a solid background are Google recommendations, not the required DMARC policy. ^[3]

VMC or CMC: what each certificate proves

A Verified Mark Certificate (VMC) is for a logo registered with an intellectual-property office recognized by certificate issuers. A Common Mark Certificate (CMC) is an alternative for some logos without a registered trademark. CMC eligibility is issuer-specific; published criteria include a prior-use path requiring the logo to have been used for at least 12 months. Confirm the evidence rules with the issuing authority before applying. ^{[3] [9]}

For Gmail, either certificate can support the BIMI brand avatar, but only a VMC enables the verified checkmark. Google states that a CMC shows the sender’s logo without the checkmark. Do not call a CMC a blue-checkmark certificate or assume that a logo display means the same thing as Gmail’s verification mark. ^{[3] [4]}

Other inboxes set their own certificate rules. Yahoo says a VMC is not required for a logo there; if a record includes one, Yahoo uses it in BIMI eligibility. Apple says its Mail providers must validate a BIMI evidence document, such as a provider-trusted VMC, but Apple’s public page does not say whether it accepts CMCs. ^{[5] [6]}

Where logos appear—and where the rules differ

The BIMI Group provider-support page currently lists Apple, AU (KDDI), Comcast, Cloudmark, Fastmail, Google, La Poste, NTT docomo, Onet Poczta, Yahoo Inc., Zoho Mail, Zone and Zoner under “Supports BIMI.” The page is marked last updated May 2025, so treat it as the latest list posted there, not a newly verified 2026 rollout. It also says providers decide their own display criteria. ^[7]

Yahoo’s own BIMI page is more specific about its implementation: it shows logos for bulk mail, not personal email, when the DMARC policy is quarantine or reject, the SVG is valid, and the sending address has sufficient reputation and engagement. Yahoo honors subdomain BIMI but prefers BIMI and DMARC at the organizational domain. ^[5]

BIMI Group’s current issuer table lists DigiCert, GlobalSign and SSL.com as Mark Verifying Authorities. That is an issuer list, not a recommendation or a promise that every mailbox provider trusts every certificate on it. BIMI Group says providers can apply separate vetting. Certificate prices vary by issuer; no universal price is published here. ^{[1] [8]}

When to involve a specialist

Get help before changing policy if many services remain outside DMARC enforcement, reports show legitimate mail failing alignment, or you cannot trace who owns a sender or subdomain. Also consider help if providers disagree on display, a certificate application is blocked by evidence requirements, or valid DNS, hosting and SVG checks still produce no logo. A valid record does not prove every inbox will display it. ^{[1] [5] [6]}

Before asking for help, gather monthly volume, ESP or MTA, affected providers, start date, recent changes, and evidence such as SMTP errors, provider dashboards, message headers or DNS results.