Your verified logo in the inbox, set up to stay there.

The four prerequisites

Every BIMI implementation clears the same four gates, in roughly this order. Each missing one adds weeks, and the first accounts for the large majority of logos that never appear.

1. DMARC at enforcement. Your policy must be at p=quarantine or p=reject, covering all of your mail. A policy still at p=none is the reason a logo fails to show in roughly five cases out of six, by one checker’s data — and no amount of logo or certificate work substitutes for it.
2. A compliant logo. The artwork has to be SVG Tiny P/S, square, under 32 KB, served over HTTPS, with no scripts or external references. Providers validate it for safety and consistent rendering, and a near-miss simply does not display.
3. Proof of the mark. A registered trademark for a VMC, or about a year of documented prior use for a CMC. Trademark registration can run six to eighteen months, which is why it is usually the longest part of the whole project.
4. Control and hosting. You own the base domain and host both the PEM certificate and the SVG on stable public HTTPS. You need one certificate per unique logo and per base domain, and a mark certificate is valid for at most 397 days before renewal.

How does a mailbox provider evaluate BIMI?

It helps to see the check from the receiver’s side, because every prerequisite maps to a step the provider runs in order. When a message arrives, the provider first confirms DMARC passes at an enforcement policy; a failure here ends the process and no logo is considered. It then looks up your BIMI record — a TXT entry published at default._bimi.yourdomain.com — which carries two values: l=, the HTTPS URL of your SVG logo, and a=, the URL of your mark certificate. The provider fetches the SVG and validates it against the format rules, fetches the PEM and checks the certificate chain, and confirms the logo inside the certificate matches the one you published. Only when all of that lines up does the logo render, and in Gmail the checkmark appears for a VMC. Each link is a place the chain can break, which is why a single moved or missing file takes the whole logo down rather than degrading gracefully.

# Prerequisite: is DMARC actually at enforcement?
$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=none; rua=mailto:[email protected]"
# p=none — BIMI will not render: enforcement (quarantine/reject) is required first

# The BIMI record: does it point at a logo and a certificate?
$ dig +short TXT default._bimi.example.com
"v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"
# record is well-formed — but it stays invisible while DMARC sits at p=none

Which inboxes actually show the logo?

BIMI’s reach is real but uneven, and knowing the map before you buy keeps the spend honest. Receiver-side support is stable across the providers below, even though the specification itself is still an IETF Internet-Draft rather than a finished RFC.

Preparing the logo: where SVGs fail

The artwork requirement is stricter than most designers expect, and a logo that looks perfect in a browser routinely fails BIMI validation. The format is SVG Tiny P/S, a deliberately limited profile, and the file has to declare that profile, sit on a square canvas, stay under 32 KB, and carry no scripts, no external references, no raster images and no embedded fonts. A title element naming the mark is expected, and the artwork should be centred on a solid background rather than transparency, since some clients render a transparent logo onto a colour that ruins it. Most brand SVGs leave a design tool carrying exactly what the profile forbids, so the real work is converting and stripping the file down until it validates, then confirming it through the BIMI Group’s inspector before any certificate is ordered against it. Ordering the certificate first and discovering afterwards that the logo will not validate is a common and avoidable waste.

The part most senders underestimate: keeping it alive

Getting a logo to appear is a finite task. Keeping it appearing is the part that quietly defeats teams who treated BIMI as a one-time setup. Several things can switch the logo off without warning, and none of them announces itself.

The certificate expires every 397 days and has to be renewed and re-hosted. The PEM file and SVG live on hosting you control, and a moved URL or an hour of downtime breaks display immediately. The authorities themselves are not fixed points: when Apple stopped honouring Entrust certificates issued from 15 November 2024, every affected sender relying on Apple Mail had a problem that no change on their own side had caused. And because BIMI rests on DMARC alignment, any new sending tool or DNS edit that breaks alignment will take the logo down with it, often before anyone notices the underlying authentication slip. A logo that vanishes is worse than one that never appeared, because customers learned to expect it. Keeping it lit is an upkeep job, and we treat it as one.

What does BIMI cost, plainly?

The pricing is knowable, which is more than can be said for much of this market. A VMC runs from around 749 US dollars a year through the cheaper authorities to roughly 1,499 at the best-known ones, and a CMC sits lower, between about 650 and 1,100. If the trademark does not yet exist, add a few hundred dollars at the USPTO or in the region of 850 euros at the EUIPO, plus the months registration takes. Hosting the files need not cost anything. The detail worth holding onto is that the certificate is technically identical whichever authority issues it — same format, same validation, same provider compatibility — so paying the premium name buys guided service and reputation, and the cheaper authority your inboxes already honour does the same job for the logo.

The Gmail verified checkmark, specifically

Gmail draws a line the other inboxes do not, and it is worth understanding before you choose a certificate. A valid BIMI setup with either a VMC or a CMC places your logo beside your mail in Gmail. The verified checkmark next to the sender name, though, is reserved for a VMC — the certificate backed by a registered trademark. To a recipient the distinction reads as a small mark beside the name, but its meaning is precise: Gmail is vouching that the sender’s identity was checked against a trademark, a stronger statement than confirming a published logo alone. For a consumer brand fighting impersonation, that mark is often the real prize, and it is the reason a sender with the budget and the trademark takes the VMC path even though a CMC would show the same logo. For a brand without a registered mark, the logo on its own still earns recognition, and the checkmark simply waits until the trademark exists. We make that trade-off explicit when we scope the work, because it is the difference between a project measured in weeks and one measured in months.

Is BIMI worth the payoff?

Adoption tells its own story: a Validity survey in 2025 put BIMI at roughly 4.6% of the domains it looked at, a small share precisely because the DMARC-at-enforcement prerequisite is a real barrier rather than a checkbox. For the brands that clear it, the certificate-industry research reports meaningful lifts in open rates, brand recall and consumer trust, and those findings are consistent enough to take seriously even discounted for the source. The reasonable conclusion is narrow and useful: BIMI rewards brands whose name carries weight and whose audience sits on the supporting providers, and it does so as a trust and recognition signal layered on authentication — not as a fix for mail that is landing in spam. If your placement is the problem, BIMI is the wrong tool, and we will say so.

How long until the logo is visible?

The honest answer ranges from a few weeks to most of a year, and the variable is almost entirely the certificate path. If you already hold a registered trademark, a VMC can be validated and issued quickly once DMARC is at enforcement — an authority can often issue within a day of verifying the documents. If you do not, trademark registration is the long pole at six to eighteen months, during which a CMC offers a faster route: prior-use proof rather than a mark, issued in weeks, with a logo in Gmail, Yahoo and Fastmail while Apple and the checkmark wait. The work with no shortcut is reaching DMARC enforcement, which is why we start there in parallel with everything else. A sender already at enforcement with a clean trademark is weeks away; one starting from p=none with no mark should plan in months and use the CMC and Yahoo paths to show a logo in the meantime.

BIMI across a portfolio of brands

The cost and effort scale with the number of distinct logos and base domains, because the rule is one certificate per unique logo and per unique base domain. A business running several brands is therefore running several BIMI projects at once, each with its own DMARC enforcement, its own SVG, its own certificate and its own renewal clock. The trap is treating them as one: a single certificate cannot cover distinct marks, and a lapse on one brand’s hosting or alignment quietly drops that brand’s logo while the others stay lit, which is hard to spot without per-brand monitoring. We run portfolio BIMI as a set of parallel tracks on a shared renewal calendar, so no brand’s logo expires unnoticed and each brand’s authentication stays isolated from the rest.

BIMI as brand protection

The strongest case for BIMI is rarely the open-rate chart. It is impersonation. A brand whose name is worth forging — a bank, a retailer, a platform people trust with money — gains a visible, hard-to-fake signal that a message is the real thing, and over time trains its audience to treat mail without the logo as suspect. That works only because the logo cannot appear without DMARC enforcement, which is itself the control that stops most spoofing at the door. Seen this way, the certificate is the visible tip of an anti-impersonation programme rather than a marketing decoration, and the brands that gain most from it are exactly the ones criminals find most worth imitating.

Where we fit

Most of the difficulty in BIMI is the prerequisite, and the prerequisite is our core work. Bringing a domain to DMARC enforcement without bouncing legitimate mail is the same authentication discipline we run as a service in its own right, which means the hardest gate is one we are already built to clear. From there the BIMI-specific steps are ones we handle end to end: validating the SVG against the exact specification, advising VMC against CMC for your trademark reality and provider mix, choosing the cheapest authority your target inboxes will honour, coordinating the validation, and hosting the PEM and SVG on infrastructure that stays up.

We do all of it independently. We resell no certificates and hold no CA partnership, so the recommendation is shaped by your audience and budget rather than a margin we would earn. And because we work in Spanish and Portuguese as readily as in English, a brand protecting its mark across Latin American and Iberian markets is not left translating a certificate process designed for somewhere else.

How we run it

The sequence is fixed, because skipping a step is what wastes money on this particular project.

1. Confirm or reach enforcement. We verify DMARC is at p=quarantine or p=reject across all mail, and bring it there first if it is not.
2. Prepare the logo. The artwork is converted to compliant SVG Tiny P/S and validated before a certificate is ever ordered.
3. Choose the certificate path. VMC or CMC, and which authority, decided against your trademark position and the inboxes you care about.
4. Coordinate issuance and hosting. We run the validation with the CA and host the PEM and SVG on stable HTTPS.
5. Publish, test and watch. The BIMI record goes live, we confirm the logo renders in real sends, and the certificate and alignment go onto the same monitoring that keeps the rest of your authentication honest.

The free 25-point audit is the place to begin, because it shows whether you are anywhere near the enforcement BIMI demands. If you are far from it, that is the work to do first; if you are already there, a logo can be in supported inboxes within weeks on the CMC path, or once the trademark clears on the VMC one.