# BIMI: VMC vs CMC, and which mailboxes show your logo

BIMI (Brand Indicators for Message Identification) lets mailbox providers
show your logo next to your email instead of a grey initial. You publish
the logo in DNS, and most providers also want a certificate proving the
logo is yours. There are two kinds: the **Verified Mark Certificate (VMC)**
and the newer **Common Mark Certificate (CMC)**.

## First: DMARC at enforcement

No certificate helps until DMARC is enforced. Gmail requires a policy of
`p=quarantine` or `p=reject` with `pct=100`; the BIMI Group's definition
is the same: not `p=none`, and not a percentage below 100. If you're still
at `p=none`, start with [DMARC from none to reject](/guides/dmarc-none-to-reject).

You also need the logo as a square SVG in the "SVG Tiny PS" profile: no
scripts, no external files, no embedded images.

## VMC vs CMC

| | VMC | CMC |
|---|---|---|
| What the logo must be | A **registered trademark** (or a government mark) | A logo you've **used publicly for at least 12 months** (or a modified or pending trademark) |
| How it's proved | Trademark office record | The logo on your website today, and in archive.org snapshots of the same domain from at least 12 months earlier |
| Gmail | Logo **and** the blue verified checkmark | Logo, no checkmark |
| Apple Mail | Yes | Apple's documentation names only VMC |
| Yahoo | Not needed | Not needed |

The CMC exists for the many companies with a logo but no registered
trademark. The archive.org rule is strict: if your current logo wasn't
on the same domain a year ago, according to the Wayback Machine, you can't
get a CMC yet.

## Which mailboxes show what

- **Gmail** accepts both since September 2024. With a VMC it shows your
  logo with a verified checkmark; with a CMC, the logo alone. Google
  recommends VMC.
- **Apple Mail** documents BIMI with a VMC. Until Apple says otherwise,
  assume a CMC won't show your logo there.
- **Yahoo** shows BIMI logos without any certificate, for bulk mail from
  senders with enforced DMARC and good reputation.

## Who issues them, and the price

DigiCert, GlobalSign, Sectigo and SSL.com issue both VMCs and CMCs.
Entrust used to, but stopped in May 2025 and moved its customers to
Sectigo. Certificates last one year and need revalidating each year.

Published prices are around **$1,000–1,500 a year**. SSL.com lists its
CMC at $1,150 for one year, and less per year for two or three. DigiCert
lists $1,416 for a 12-month VMC subscription. Others quote on request.

## Setting it up

1. Get DMARC to `p=quarantine` or `p=reject` at 100%.
2. Make the SVG Tiny PS version of your logo and host it over HTTPS.
3. Buy the VMC or CMC; the CA validates your organisation and the mark.
4. Host the certificate file (PEM) over HTTPS.
5. Publish the BIMI record:

```
default._bimi.example.com  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"
```

Logos can take a while to appear, and Gmail and Yahoo also weigh sender
reputation, so a correct setup doesn't guarantee the logo on every message.

## Is it worth it?

For a brand sending marketing email to consumers, the logo and Gmail's
checkmark help mail stand out and look genuine. For a small company
sending mostly business mail, the real protection comes from the
requirement, not the logo: DMARC at enforcement stops others spoofing your
domain, and that's free.

## Check your domain

The [DMARC checker](/tools/dmarc-checker) shows whether your policy is
strict enough for BIMI. The [free scan](/#scan) checks SPF and DMARC and
the lookalike domains that could send email as you.

## Sources

- [Google Workspace: Set up BIMI](https://knowledge.workspace.google.com/admin/security/set-up-bimi)
- [Google Workspace Updates: Gmail accepts Common Mark Certificates (Sept 2024)](https://workspaceupdates.googleblog.com/2024/09/gmail-additional-bimi-protections.html)
- [BIMI Group: FAQs for senders](https://bimigroup.org/faqs-for-senders-esps/)
- [BIMI Group: Mark Certificate Requirements v1.8 (PDF)](https://bimigroup.org/resources/VMC_Requirements_latest.pdf)
- [Apple: BIMI for developers](https://developer.apple.com/support/bimi/)
- [Yahoo Sender Hub: BIMI](https://senders.yahooinc.com/bimi/)
- [SSL.com: Common Mark Certificate](https://ssl.com/products/email-brand-trust/brand-trust/cmc/)
- [DigiCert: Verified Mark Certificates](https://www.digicert.com/tls-ssl/verified-mark-certificates)
- [GlobalSign: Mark certificates](https://www.globalsign.com/en/verified-mark-certificate)
- [Sectigo: Mark certificates](https://www.sectigo.com/mark-certificates)

---
Source: https://nameward.app/guides/bimi-vmc-vs-cmc (updated 2026-10-31)