BIMI with VMC and CMC: How Gmail’s Verified Logos Work in 2026

Email is one of the most exploited attack surfaces for brand impersonation. Brand Indicators for Message Identification (BIMI) is an email specification that displays a verified brand logo next to authenticated messages in supported inboxes, giving recipients a visual trust signal before they open the message.

Implementing BIMI in 2026 means choosing between two certificate types: the Verified Mark Certificate (VMC) and the Common Mark Certificate (CMC). The AuthIndicators Working Group introduced CMC support in late 2024, and Google supports CMC in Gmail, extending BIMI access to organizations without a registered trademark. This guide covers how BIMI works, how VMC and CMC differ, what Gmail specifically requires, and how enterprise teams can build a rollout that holds up operationally.

Quick Answer: What Is BIMI and How Does It Work in 2026?

BIMI (Brand Indicators for Message Identification) displays a verified brand logo next to authenticated emails in Gmail, Yahoo Mail, and Apple Mail. It requires DMARC enforced at p=quarantine or p=reject with pct=100, plus a valid VMC or CMC certificate. VMC requires a registered trademark and enables the Gmail blue checkmark. CMC requires 12 months of logo use. Both certificates have a 397-day validity cap.

Who Should Care About BIMI

BIMI sits at the intersection of email security, PKI, DNS, brand management, and cloud infrastructure. The consequences of a failure in any one component appear as a silent logo removal across all supported inboxes, with no error notification to the domain owner or any team member.

Scroll

Role	Why It Matters	Action Item
PKI and Certificate Teams	Own the VMC or CMC certificate: CA selection, trademark or logo use validation coordination, HTTPS hosting of the PEM file, and renewal tracking against the 397-day expiry; a certificate that expires removes the brand logo silently with no notification; BIMI certificates belong in the enterprise certificate inventory alongside TLS, code signing, and client authentication certificates	Add the VMC or CMC certificate to the CertSecure Manager inventory with renewal alerts at 90, 60, and 30 days before expiry; confirm the PEM file hosting URL is available over HTTPS from external networks; document the CA and trademark or logo use validation records for renewal evidence
Email Security Teams	Own DMARC policy enforcement, DKIM key rotation, and sender alignment monitoring; BIMI requires DMARC at p=quarantine or p=reject with pct=100 before it activates; a DKIM key rotation that breaks DMARC alignment, or a new third-party sender added without DKIM signing, disrupts BIMI display for that mail stream silently	Confirm DMARC enforcement is at pct=100 on all sending domains before adding BIMI DNS records; review DMARC aggregate reports weekly to identify new senders appearing in the outbound estate that are not DKIM-signed or aligned; document DKIM rotation procedures to require email security team notification before changes are applied
Brand and Marketing Teams	Own the SVG logo asset and format compliance with BIMI SVG Tiny PS requirements; updating the brand logo without resubmitting to the CA for revalidation causes the mailbox provider to reject the BIMI record outright because the certificate no longer matches the hosted logo; high-volume third-party marketing senders must be DKIM-signed and DMARC-aligned for the sending domain	Establish a change notification process requiring brand team to notify PKI and email security teams before any SVG logo update is deployed; confirm all marketing platform senders (email service providers, marketing automation tools) are listed in the sender inventory and are DKIM-signed and aligned; validate the SVG file against BIMI format requirements before submitting to the CA
Cloud and DevSecOps Teams	Own DNS automation, HTTPS infrastructure for logo and PEM certificate file hosting, and deployment pipelines; a DNS change that removes or alters the BIMI TXT record, or a hosting environment change that makes the SVG or PEM URL unreachable, breaks BIMI silently; subdomain coverage gaps appear when new subdomains are added as From addresses without a corresponding BIMI record	Add BIMI DNS TXT record validation and SVG/PEM URL availability checks to infrastructure-as-code validation and deployment pipelines; confirm BIMI record coverage for all subdomains used in From addresses; include BIMI stack validation in post-deployment smoke tests for any DNS or hosting environment change
CISOs	BIMI is both a brand trust mechanism and a security forcing function: full DMARC enforcement at pct=100 required for BIMI is the same enforcement posture that maximizes protection against domain spoofing; the certificate lifecycle discipline required for BIMI also reveals gaps in the broader certificate governance program; 53.6 percent of published BIMI records contain errors that prevent logo display (URIports, 2025), which means most BIMI implementations are not delivering the intended trust signal	Require BIMI implementation to be treated as a cross-functional program with named owners for each component (certificate, DNS, SVG, DMARC), not a one-time project; fund CLM tooling that covers BIMI certificates alongside the broader certificate estate; mandate quarterly BIMI stack validation as part of the email security review cadence

Expand table

BIMI Readiness Checklist: Issue, Business Impact, Recommended Action, and Owner

Use this checklist to identify which readiness issues apply to your environment and assign remediation ownership before a silent failure removes your brand logo from supported inboxes.

Scroll

Issue	Business Impact	Recommended Action	Owner
DMARC not enforced at pct=100	BIMI will not activate in Gmail or other providers requiring full enforcement; partial rollout (pct below 100) means BIMI logo displays inconsistently or not at all	Ramp DMARC enforcement incrementally using DMARC aggregate report data to identify misaligned senders before increasing pct; reach pct=100 before adding BIMI DNS records	Email Security Team
Third-party sender not DKIM-signed or DMARC-aligned	Mail from that sender stream fails DMARC alignment; BIMI logo absent for all mail from that source; deliverability impact possible if DMARC policy is p=reject	Audit all third-party senders in the outbound estate from DMARC aggregate reports; configure DKIM signing for each sender or move to a subdomain with its own DMARC and BIMI records	Email Security Team + Marketing Team
VMC or CMC certificate not tracked in CLM platform	Certificate expires with no renewal alert; brand logo removed silently from all supported inboxes at expiry; no notification sent to domain owner or any team	Add the VMC or CMC certificate to CertSecure Manager with renewal alerts at 90, 60, and 30 days before the 397-day expiry; confirm the PEM file URL is monitored for availability	PKI Team
SVG logo updated without CA revalidation	Certificate no longer matches the hosted logo; mailbox providers reject the BIMI record outright; brand logo removed silently from all supported inboxes	Establish a change control process requiring CA revalidation before any SVG logo update is published; document the revalidation timeline (one to four weeks) so brand updates are planned accordingly	Brand Team + PKI Team
BIMI record missing for a subdomain used in From header	BIMI records are not inherited by subdomains; mail sent from a subdomain with no BIMI record displays no logo in supported inboxes regardless of the parent domain’s BIMI configuration	Audit all subdomains used in From addresses; add BIMI DNS TXT records, VMC or CMC certificates, and DMARC enforcement for each qualifying subdomain	Cloud/DevSecOps Team + Email Security Team
SVG or PEM hosting URL not available over HTTPS	Mailbox providers cannot fetch the logo or certificate file; BIMI record is treated as invalid; logo display fails silently	Host the SVG and PEM files on HTTPS URLs accessible from external networks; add URL availability monitoring for both hosting endpoints; include availability checks in deployment pipelines	Cloud/DevSecOps Team
No quarterly BIMI stack validation process	DNS changes, logo updates, hosting migrations, and DMARC drift accumulate between reviews; failures are discovered only when someone notices the logo is missing	Schedule quarterly full BIMI stack validation using a BIMI validator covering the DNS record, SVG hosting, PEM hosting, and DMARC enforcement status; include validation in the quarterly email security review cadence	Email Security Team + PKI Team

Expand table

Why BIMI Matters for Enterprise Security Teams

BIMI interrupts phishing by backing the displayed brand logo with a verified certificate tied to the sending domain. For VMC-authenticated senders, Gmail also displays a blue verified checkmark, an additional visual verification signal in Gmail. That checkmark is exclusive to VMC; CMC-only implementations display a brand avatar without it.

A second benefit is operational. Implementing BIMI forces teams to resolve Domain-based Message Authentication, Reporting and Conformance (DMARC) alignment gaps across all outbound sending systems, including third-party platforms for marketing, support, and HR. That cleanup improves deliverability, reduces spoofing exposure, and gives security teams a complete picture of the sender inventory.

Note that Microsoft Outlook has not adopted BIMI as of mid-2026. BIMI currently operates across Gmail, Yahoo Mail, Apple Mail, and other major mailbox providers.

How BIMI Works

BIMI is a display layer, not an independent security system. It activates only when the underlying authentication stack passes all required checks. The architecture has three layers. Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) must pass; DMARC must be enforced at p=quarantine or p=reject with pct=100; and a BIMI DNS record must point to a hosted SVG logo and a valid certificate file. A policy at p=none or with pct below 100 does not qualify.

Those settings are DMARC record tags written as tag=value. The p tag sets the policy for mail that fails DMARC, where p=none only monitors, p=quarantine diverts failing mail to spam, and p=reject blocks it. The pct tag sets the share of failing mail the policy applies to, so pct=100 means all of it. The term pct is a single tag abbreviated from percent, not three separate letters.

Authentication Flow

1. The sender’s mail server signs the message with DKIM and passes SPF for the sending IP.
2. The mailbox provider checks DMARC alignment, which means the domain that passed SPF or DKIM must match the domain shown in the From address. At least one of SPF or DKIM must both pass and match; a message can pass one of them and still fail DMARC if the domains do not match. This binds authentication to the visible From domain.
3. The provider confirms DMARC is at p=quarantine or p=reject with pct=100.
4. The provider queries the BIMI DNS TXT record at default._bimi.[domain].
5. The provider fetches and validates the SVG logo and PEM certificate over HTTPS.
6. If all checks pass, the brand logo displays. In Gmail, messages authenticated with a VMC are also eligible to display the verified blue checkmark.

Every failure in this chain is silent. No error is sent to the domain owner. A 2025 URIports analysis found that 53.6 percent of published BIMI records contain at least one error that prevents logo display.

VMC vs CMC: Choosing the Right Certificate

Verified Mark Certificate (VMC)

A VMC requires a trademark registered with a recognized IP office. As of 2026, the BIMI Group’s VMC Requirements recognize trademark offices in more than a dozen jurisdictions, including the USPTO, EUIPO, UK IPO, and IP Australia. VMCs are issued by the Mark Verifying Authorities recognized by the BIMI Group. Entrust, an original issuer, exited the BIMI certificate business in 2025 after selling its public certificate operations.

Pricing varies by CA and reseller, running roughly USD 749 to USD 1,750 per year excluding trademark fees, with validation taking two to four weeks. A VMC enables the brand avatar and the Gmail blue checkmark on both web and mobile. Certificate validity is capped at 397 days.

Common Mark Certificate (CMC)

A CMC serves organizations without a registered trademark. To qualify, the logo must have been in continuous public use on the domain for at least 12 months, verified by the CA using evidence of prior use, which may include web archive records. The same authorities issue CMCs at approximately USD 650 to USD 1,100 annually, with issuance in one to three weeks. CMC enables Gmail brand avatar display but does not trigger the blue checkmark and is not supported by Apple Mail. The 397-day validity window and all operational requirements are identical to VMC.

Comparison Table

Scroll

Area	VMC	CMC
Trademark required	Yes, registered with recognized IP office	No trademark required
Proof of logo use	Trademark serves as proof	Logo in public use for 12+ months
Gmail blue checkmark	Yes	No, brand avatar only
Apple Mail support	Yes	No (VMC only as of 2026)
Yahoo Mail	Yes	Yes (no cert required by Yahoo)
Annual cost (approx., as of mid-2026)	USD 749-1,750 + trademark fees	USD 650-1,100
Issuance time	2-4 weeks	1-3 weeks

Expand table

Enterprise Architecture and Team Ownership

BIMI sits at the intersection of email security, Public Key Infrastructure (PKI), DNS, brand management, and cloud infrastructure. Clear ownership across four areas prevents the outages that follow certificate expiry or DNS changes:

• Email security teams own DMARC policy, DKIM key rotation, and sender alignment monitoring.
• PKI and certificate teams manage the VMC or CMC certificate, including trademark validation with the CA, HTTPS hosting, and renewal tracking.
• Brand and marketing teams own the SVG logo asset and format compliance.
• Cloud and DevSecOps teams own DNS automation, HTTPS infrastructure, and deployment pipelines.

When a team rotates a DKIM key without notifying the email team, DMARC alignment breaks and the logo disappears. When marketing updates the SVG without resubmitting to the CA, the certificate mismatch causes logo failure. Both scenarios are common in organizations that treat BIMI as a one-time project.

What Causes Silent BIMI Failures

• Incomplete DMARC enforcement: Setting p=quarantine without pct=100 means the policy applies to only a subset of outbound mail. Organizations ramping DMARC incrementally must reach pct=100 before BIMI activates in Gmail.
• Third-party sender misalignment: Marketing tools, support platforms, and HR systems must all be DKIM-signed and DMARC-aligned. A single high-volume misaligned sender disrupts BIMI display for that entire mail stream.
• Certificate and logo mismatch: The SVG and PEM must match the validated asset on record with the CA. Updating the logo without revalidating the certificate causes providers to reject the BIMI record outright.
• Subdomain coverage gaps: BIMI records are not inherited by subdomains. Senders using a subdomain in the From header need their own BIMI record or logo display will be absent for that mail stream.

Best Practices for a Durable BIMI Program

• Start with one domain. Confirm DMARC enforcement (p=quarantine or p=reject), ideally stable for around 30 days, before adding BIMI.
• Build a complete sender inventory first. Every system sending mail under the domain must be DKIM-signed and aligned before enforcement is enabled.
• Assign named owners for DNS records, certificate files, SVG assets, and DMARC reporting, and document handoff procedures for renewal and logo updates.
• Review DMARC aggregate reports weekly. They are the most reliable early-warning signal for BIMI disruptions.
• Set certificate renewal reminders at 90, 60, and 30 days before the 397-day expiry. Expiry causes immediate, graceless logo removal.
• Validate the full BIMI stack after any DNS change, logo update, or hosting migration using a BIMI validator.

How Encryption Consulting Can Help

Encryption Consulting provides the PKI expertise that a reliable BIMI program depends on. Our PKI Services cover assessment, design, and implementation of the certificate infrastructure behind DKIM signing and VMC or CMC deployment, including Hardware Security Module (HSM) integration for private key protection and certificate authority selection. Our PKI as a Service builds and manages the entire CA environment while ownership of the CA and keys stays with you, running on FIPS 140-3 Level 3 HSMs with crypto-agile, post-quantum-ready certificates.

CertSecure Manager, our certificate lifecycle management platform, gives you a single, automated view of every certificate across your environment, from TLS and code signing to client, device, and BIMI certificates. It is vendor-neutral, connects public and private certificate authorities in a single view, automates discovery, enrollment, and renewal, and generates audit and high-risk certificate reports that prevent the expiry-driven outages most organizations discover only after the fact. For organizations building a complete cryptographic inventory that includes BIMI certificate assets alongside their broader PKI estate, CBOM Secure provides the cross-environment discovery layer that confirms every certificate is tracked.

As post-quantum cryptography adoption advances following the publication of NIST FIPS 203, 204, and 205 (August 13, 2024), the certificate infrastructure supporting BIMI and the broader enterprise PKI estate will need to plan migration to post-quantum algorithms. PQC Readiness assessment services and the PQC Center of Excellence help organizations plan how algorithm transitions affect their certificate estate, including BIMI certificates issued by Mark Verifying Authorities.

Conclusion

BIMI rewards correct email authentication with a visible mark of trust in the inbox. VMC is the right choice for trademarked brands that want the Gmail blue checkmark and Apple Mail support. CMC opens the standard to organizations that can demonstrate 12 months of logo use, with identical operational requirements after issuance.

At its core, BIMI is one more place where disciplined authentication and certificate hygiene become something customers can actually see. Done correctly, the result is not just a logo in the inbox. It is a more controlled, visible, and defensible email identity program.

Frequently Asked Questions