Skip to content

Guides · Email and DMARC

BIMI: VMC vs CMC, and which mailboxes show your logo

BIMI shows your logo next to your emails. What VMC and CMC certificates require, which of Gmail, Apple Mail and Yahoo accept each, and what they cost.

Updated 31 October 2026 · 4 min read

BIMI (Brand Indicators for Message Identification) lets mailbox providers show your logo next to your email instead of a grey initial. You publish the logo in DNS, and most providers also want a certificate proving the logo is yours. There are two kinds: the Verified Mark Certificate (VMC) and the newer Common Mark Certificate (CMC).

First: DMARC at enforcement

No certificate helps until DMARC is enforced. Gmail requires a policy of p=quarantine or p=reject with pct=100; the BIMI Group's definition is the same: not p=none, and not a percentage below 100. If you're still at p=none, start with DMARC from none to reject.

You also need the logo as a square SVG in the "SVG Tiny PS" profile: no scripts, no external files, no embedded images.

VMC vs CMC

VMC CMC
What the logo must be A registered trademark (or a government mark) A logo you've used publicly for at least 12 months (or a modified or pending trademark)
How it's proved Trademark office record The logo on your website today, and in archive.org snapshots of the same domain from at least 12 months earlier
Gmail Logo and the blue verified checkmark Logo, no checkmark
Apple Mail Yes Apple's documentation names only VMC
Yahoo Not needed Not needed

The CMC exists for the many companies with a logo but no registered trademark. The archive.org rule is strict: if your current logo wasn't on the same domain a year ago, according to the Wayback Machine, you can't get a CMC yet.

Which mailboxes show what

  • Gmail accepts both since September 2024. With a VMC it shows your logo with a verified checkmark; with a CMC, the logo alone. Google recommends VMC.
  • Apple Mail documents BIMI with a VMC. Until Apple says otherwise, assume a CMC won't show your logo there.
  • Yahoo shows BIMI logos without any certificate, for bulk mail from senders with enforced DMARC and good reputation.

Who issues them, and the price

DigiCert, GlobalSign, Sectigo and SSL.com issue both VMCs and CMCs. Entrust used to, but stopped in May 2025 and moved its customers to Sectigo. Certificates last one year and need revalidating each year.

Published prices are around $1,000–1,500 a year. SSL.com lists its CMC at $1,150 for one year, and less per year for two or three. DigiCert lists $1,416 for a 12-month VMC subscription. Others quote on request.

Setting it up

  1. Get DMARC to p=quarantine or p=reject at 100%.
  2. Make the SVG Tiny PS version of your logo and host it over HTTPS.
  3. Buy the VMC or CMC; the CA validates your organisation and the mark.
  4. Host the certificate file (PEM) over HTTPS.
  5. Publish the BIMI record:
default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

Logos can take a while to appear, and Gmail and Yahoo also weigh sender reputation, so a correct setup doesn't guarantee the logo on every message.

Is it worth it?

For a brand sending marketing email to consumers, the logo and Gmail's checkmark help mail stand out and look genuine. For a small company sending mostly business mail, the real protection comes from the requirement, not the logo: DMARC at enforcement stops others spoofing your domain, and that's free.

Check your domain

The DMARC checker shows whether your policy is strict enough for BIMI. The free scan checks SPF and DMARC and the lookalike domains that could send email as you.

Sources

Free scan

No signup. Only scan domains you own or manage.

More in Email and DMARC