What Is BIMI? VMC vs CMC Certificates Explained

BIMI (Brand Indicators for Message Identification) is an email standard that lets supporting inboxes show your brand logo next to messages that pass authentication. A VMC certificate (Verified Mark Certificate) proves that the logo is a registered trademark owned by your organization. A CMC (Common Mark Certificate) proves the same for a logo you have used publicly but not registered.

Both certificates are issued by a certificate authority after strict identity checks, and both let Gmail display your logo. Only a VMC adds Gmail’s blue verified checkmark. Neither one works until your domain enforces DMARC.

BIMI is a DNS-based standard that tells mailbox providers which logo belongs to your sending domain, so they can show it beside authenticated messages. It rewards senders who have locked down their domain against spoofing with a visible brand mark.

The mechanism is simple. You publish a TXT record at default._bimi.yourdomain.com. It points to your logo file (the l= tag) and, for providers that require one, to a PEM file containing your mark certificate (the a= tag). When a message arrives, the provider checks DMARC, fetches the record, validates the certificate and decides whether to show the logo.

DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy that tells receivers what to do with mail that fails SPF and DKIM checks. BIMI requires that policy to be enforced: p=quarantine or p=reject, applied to all messages. A monitoring-only policy (p=none) does not qualify.

A VMC certificate is a digital certificate that binds your logo to your organization after a certificate authority has verified both your identity and your trademark. It is the strongest proof you can attach to a BIMI record.

To qualify, the logo must be a registered trademark from an intellectual property office that VMC issuers recognize, or a government mark. The CA then validates your organization to a level based on the Extended Validation rules used for EV SSL, and confirms the identity of the person requesting the certificate, for example through notarized documents or a live video session. The trademarked logo itself is embedded in the certificate.

In Gmail, a VMC unlocks the blue checkmark next to your sender name. Registering a trademark can take many months, so start that process early if you want a VMC.

Common reasons a VMC order or BIMI setup stalls

• Logo does not match the registration: the SVG must show the mark as registered, not a newer redesign.
• Wrong SVG profile: a normal design-tool export is not SVG Tiny PS and is rejected by validators.
• DMARC moved too fast: if a newsletter or CRM tool is not aligned, enforcement sends its legitimate mail to spam.
• Incomplete PEM file: host the full certificate chain over HTTPS at the URL in your BIMI record.

Choose a VMC if you hold a registered trademark and want the checkmark; choose a CMC if your logo is established but not registered. The table compares both as of October 2026.

Both are available as VMC certificates for BIMI and CMC certificates from DigiCert, the same CA behind our DigiCert SSL certificates.

As of October 2026, Gmail, Apple Mail and Yahoo Mail are the largest inboxes that display BIMI logos, and Microsoft Outlook does not show them in normal recipient inboxes. Support and rules change, so check each provider’s current documentation before you rely on it.

Do not confuse BIMI with Apple Branded Mail. Branded Mail is a separate Apple program, managed through Apple Business Connect, with its own domain verification and DMARC requirements. It only applies to Apple Mail and does not affect Gmail, Yahoo or any other inbox – BIMI remains the cross-provider standard.

Tip: A logo is never guaranteed. Even with a valid certificate, each provider decides whether to show it, often based on sending volume and reputation.

BIMI shows your brand logo; it does not sign or encrypt individual messages. If you need to prove that a specific email came from a specific person, or keep its content private, you need S/MIME email certificates – our guide to S/MIME email signing covers setup in Outlook, Apple Mail and Gmail.

Many organizations use both: DMARC and BIMI for the domain and brand, S/MIME for the people who send sensitive mail.

Is BIMI worth it for your brand?

BIMI pays off most for brands that send a lot of email to consumer inboxes and are already close to DMARC enforcement. The enforcement work itself protects your domain against spoofing, and the logo makes your messages easier to recognize. For a small sender with no trademark and mail that rarely reaches Gmail or Apple Mail, the effort may outweigh the benefit for now.