You've seen it: some senders show a little logo next to their name in Gmail, and a blue checkmark. That's BIMI — Brand Indicators for Message Identification — and companies want it because it looks legitimate and it is legitimate. What most people don't realize is that BIMI isn't something you turn on. It's something you earn, and the price of admission is the one thing this whole field keeps circling back to: DMARC at enforcement.
The prerequisite is the whole story
Before a single logo appears, BIMI demands that your domain already be fully authenticated and enforcing. Specifically: SPF or DKIM aligned and passing, and a DMARC policy at p=quarantine or p=reject — with pct=100, applied to all your mail. p=none does not qualify. There is no BIMI for a domain that only monitors.
That single rule is why BIMI matters even to people who don't care about logos. It's a public, visible incentive to finish the migration from p=none to enforcement that so many domains start and abandon. You can't cheat it. The logo is the receipt for having done the work.
Only once you're enforcing do you publish the BIMI record itself — a DNS entry pointing at your logo:
default._bimi.yourdomain.com TXT v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem
The logo has to be a specific, locked-down flavor of SVG (the "SVG Tiny Portable/Secure" profile), square, on a solid background. Not the SVG your designer exports by default — a stripped, restricted subset built for safety.
The certificate is where it gets expensive
The l= part — the logo — is the easy half. The a= part is a certificate that proves the logo is really yours, and this is where BIMI stops being free. There are two paths, and they are not equal:
- VMC (Verified Mark Certificate). Requires a registered trademark for your logo, filed with one of the recognized trademark offices. It's the widely-supported path: Gmail, Yahoo, and Apple Mail all honor it, and in Gmail a VMC is what unlocks the blue verified checkmark. It's a paid certificate, renewed annually, issued by a qualified authority after they verify the trademark.
- CMC (Common Mark Certificate). Gmail's newer option, introduced in early 2025, for logos that aren't registered trademarks. Instead of a trademark, you prove the logo has been publicly displayed on your domain for at least twelve consecutive months, verified through web archives. Lower barrier — but narrower support. Notably, Apple Mail still requires a VMC; a CMC won't light up your logo there.
And one gap worth knowing before you invest: Microsoft Outlook has not adopted BIMI as of mid-2026. The logo shows in Gmail, Yahoo, and Apple Mail — not in the Microsoft inbox.
Is it worth it?
Honestly: BIMI is the last mile, not the foundation. If your mail is landing in spam, a logo won't save it — you have an authentication or reputation problem, and BIMI can't even be configured until that's fixed. The value of BIMI to most senders isn't the logo. It's that pursuing it forces the domain to reach enforcement, which is where the real deliverability and anti-spoofing gains actually are.
So the honest order is: get to p=reject first, cleanly, with every legitimate sender aligned. That alone is most of the benefit. Then, if a verified logo and checkmark are worth a trademark and an annual certificate to your brand, BIMI is sitting there waiting — because you'll already have done everything it requires.
You can see whether you're anywhere near qualifying in a few seconds: check your domain. If DMARC comes back p=none, BIMI isn't a next step — enforcement is. The logo is on the other side of it.