Implementing BIMI with VMC and CMC

You have probably noticed a brand logo sitting next to an email in Gmail before you even open it. That is BIMI in action. Brand Indicators for Message Identification (BIMI) is an email standard that lets organizations display a verified logo next to their authenticated emails in supported inboxes. Recipients get a visual signal that the message is genuinely from that brand, before they open it.

For security teams, this matters beyond branding. Phishing attacks succeed partly because spoofed sender names look identical to legitimate ones. BIMI ties a verified logo to the sending domain, and for organizations using a Verified Mark Certificate, Gmail adds a blue checkmark that recipients can recognize as a third-party trust signal. This guide walks through the complete implementation process, from understanding your certificate options to publishing your DNS record and testing the result.

Quick Answer: How Do You Implement BIMI with VMC or CMC?

BIMI implementation follows five sequential steps: enforce DMARC at p=reject with pct=100; prepare an SVG Tiny PS logo hosted at a stable HTTPS URL; apply for a VMC (registered trademark required) or CMC (12 months continuous logo use required); assemble the PEM file in chain order and host it at HTTPS; publish the BIMI DNS TXT record at default._bimi.[domain]. Every failure is silent.

Key Takeaways

• BIMI is a sequential five-step process where every step depends on the one before it and every failure is silent. No error is sent to the domain owner when the logo fails to display. The only way to detect failures is proactive validation using a BIMI validator, network traffic monitoring, and DMARC aggregate report analysis.
• DMARC must be enforced at p=quarantine or p=reject with pct=100 before BIMI activates in Gmail. A DMARC policy at p=none, or with pct below 100, does not qualify. Third-party senders (marketing platforms, support tools, HR systems) must all be DKIM-signed and DMARC-aligned before enforcement is raised to pct=100.
• VMC requires a registered trademark with a recognized IP office (USPTO, EUIPO, UK IPO) and enables the Gmail brand avatar and blue verified checkmark plus Apple Mail support. CMC requires 12 months of continuous public logo use verified via web archive records and enables Gmail brand avatar display only. Both certificates have a 397-day validity cap and the same hosting and DNS requirements.
• A 2025 URIports analysis found that 53.6 percent of published BIMI records contain at least one error that prevents logo display. The most common sources of failure are incorrect SVG format (not SVG Tiny PS), incomplete or misordered PEM chains, DMARC not at pct=100, and DNS propagation timing.
• The DigiCert Trust Pulse Survey (July 2025) found that 45 percent of enterprises experienced certificate-related downtime in the prior year. A BIMI certificate expiry at 397 days produces an immediate, silent logo removal from all supported inboxes with no notification sent to the domain owner or any team member.

Who Should Care About BIMI Implementation

BIMI implementation touches every team responsible for email security, certificate governance, brand assets, and DNS infrastructure. A change by any one team without notifying the others can break BIMI silently, and the failure is invisible until someone manually checks whether the logo is still appearing.

Role	Why It Matters	Action Item
PKI and Certificate Teams	Own the VMC or CMC certificate lifecycle: CA selection, trademark or logo use validation coordination, HTTPS hosting of the PEM file, PEM chain assembly in the correct order (entity, intermediates, root), and renewal tracking against the 397-day expiry; a certificate expiry removes the brand logo immediately and silently; the BIMI certificate belongs in the enterprise certificate inventory alongside TLS, code signing, and client authentication certificates	Add the VMC or CMC certificate to the CertSecure Manager inventory with renewal alerts at 90, 60, and 30 days before expiry; confirm the PEM file hosting URL is available over HTTPS from external networks; verify the chain order (entity first, intermediates next, root last) before publishing the BIMI DNS record
Email Security Teams	Own DMARC policy enforcement, DKIM key rotation, and sender alignment monitoring; BIMI requires DMARC at p=quarantine or p=reject with pct=100 before it activates; a DKIM key rotation that breaks DMARC alignment, or a new third-party sender added without DKIM signing, disrupts BIMI display for that mail stream silently; NIST SP 800-177 Rev. 1 (Trustworthy Email) is the federal reference for SPF, DKIM, and DMARC as email authentication foundations	Confirm DMARC enforcement is at pct=100 before publishing the BIMI DNS record; review DMARC aggregate reports weekly to identify new senders appearing in the outbound estate that are not DKIM-signed or aligned; document DKIM rotation procedures requiring email security team notification before changes are applied
Brand and Marketing Teams	Own the SVG logo asset and format compliance with BIMI SVG Tiny PS requirements; updating the brand logo without resubmitting to the CA for revalidation causes the mailbox provider to reject the BIMI record outright because the certificate no longer matches the hosted logo; high-volume third-party marketing senders must be DKIM-signed and DMARC-aligned	Establish a change notification process requiring brand team to notify PKI and email security teams before any SVG logo update is deployed; confirm all marketing platform senders are listed in the sender inventory and are DKIM-signed and aligned; validate the SVG file against SVG Tiny PS requirements before submitting to the CA
Cloud and DevSecOps Teams	Own DNS record management, HTTPS infrastructure for SVG and PEM hosting, and deployment pipelines; a DNS change that removes or alters the BIMI TXT record, or a hosting environment change that makes the SVG or PEM URL unreachable, breaks BIMI silently; subdomains used as From addresses require their own BIMI DNS TXT records	Add BIMI DNS TXT record validation and SVG/PEM URL availability checks to infrastructure-as-code validation and deployment pipelines; confirm BIMI record coverage for all subdomains used in From addresses; include BIMI stack validation in post-deployment smoke tests for any DNS or hosting environment change
CISOs	BIMI is both a brand trust mechanism and a security forcing function: full DMARC enforcement at pct=100 required for BIMI is the same enforcement posture that maximizes protection against domain spoofing; 53.6 percent of published BIMI records contain errors preventing logo display (URIports, 2025), meaning most BIMI implementations are not delivering the intended trust signal; the certificate lifecycle discipline required for BIMI also reveals gaps in the broader certificate governance program	Require BIMI implementation to be treated as a cross-functional program with named owners for each component (certificate, DNS, SVG, DMARC), not a one-time project; fund CLM tooling that covers BIMI certificates alongside the broader certificate estate; mandate quarterly BIMI stack validation as part of the email security review cadence

BIMI Implementation Checklist: Issue, Business Impact, Recommended Action, and Owner

Use this checklist to identify which implementation gaps apply to your environment and assign remediation ownership before a silent failure removes the brand logo from supported inboxes.

Issue	Business Impact	Recommended Action	Owner
DMARC not at pct=100	BIMI will not activate in Gmail or other providers requiring full enforcement; logo absent or inconsistent for all mail from the domain; partial enforcement (pct below 100) does not qualify even if p=reject is set	Complete the DMARC ramp to pct=100 using DMARC aggregate report data to identify and align all misaligned senders before increasing pct; publish the BIMI DNS record only after pct=100 is stable for at least 30 days	Email Security Team
Third-party sender not DKIM-signed or DMARC-aligned	Mail from that sender stream fails DMARC alignment; BIMI logo absent for all mail from that source; deliverability impact possible if DMARC policy is p=reject	Audit all third-party senders from DMARC aggregate reports; configure DKIM signing for each sender or move to a subdomain with its own DMARC and BIMI records; do not raise pct to 100 until all high-volume senders are aligned	Email Security Team + Marketing Team
SVG file not conforming to SVG Tiny PS profile	CA rejects the certificate application with no detailed explanation; BIMI record cannot be published until a compliant SVG is submitted; rework delay of one to four weeks depending on CA processing time	Convert the SVG to the SVG Tiny PS profile before beginning the certificate application; validate the converted file using the BIMI Group’s SVG validator before submission; confirm pixel dimensions are absolute values with a minimum of 96×96 pixels	Brand Team + PKI Team
PEM chain assembled in wrong order	Mailbox providers silently reject the BIMI record because certificate chain validation fails; logo does not display; no error is sent to the domain owner	Assemble the PEM file in the correct order: entity certificate first, then intermediate CA certificates in order, then root CA certificate last; verify the chain using an SSL/TLS chain verification tool before hosting; re-host and re-test after any certificate renewal	PKI Team
VMC or CMC certificate not tracked in CLM platform	Certificate expires at 397 days with no renewal alert; brand logo removed immediately and silently from all supported inboxes; no notification sent to domain owner or any team	Add the VMC or CMC certificate to CertSecure Manager with renewal alerts at 90, 60, and 30 days before the 397-day expiry; confirm the PEM file URL and SVG file URL are monitored for HTTPS availability alongside the certificate expiry date	PKI Team
SVG logo updated without CA revalidation	Certificate no longer matches the hosted logo; mailbox providers reject the BIMI record outright; logo removed silently from all supported inboxes	Establish a change control process requiring CA revalidation before any SVG logo update is published; document the revalidation timeline (one to four weeks) so brand updates are planned with sufficient lead time	Brand Team + PKI Team
BIMI record missing for a subdomain used in From header	BIMI records are not inherited by subdomains; mail sent from a subdomain with no BIMI record displays no logo in supported inboxes regardless of the parent domain BIMI configuration	Audit all subdomains used in From addresses; publish separate BIMI DNS TXT records, VMC or CMC certificates, and DMARC enforcement for each qualifying subdomain	Cloud/DevSecOps Team + Email Security Team
No quarterly BIMI stack validation process	DNS changes, logo updates, hosting migrations, certificate renewals, and DMARC drift accumulate between reviews; failures are discovered only when someone notices the logo is missing	Schedule quarterly full BIMI stack validation using a BIMI validator covering DNS record, SVG hosting URL, PEM hosting URL, and DMARC enforcement status; include in the quarterly email security review cadence	Email Security Team + PKI Team

What Are VMC and CMC?

To display a verified logo in Gmail, you need one of two types of mark certificates. Both act as digital proof that your organization owns the logo and is authorized to display it next to emails sent from your domain.

A Verified Mark Certificate (VMC) is the original certificate type. It requires a trademark registered with a recognized intellectual property office, such as the USPTO in the United States or the EUIPO in the European Union. In Gmail, a VMC enables both the brand logo and the blue verified checkmark. Apple Mail also requires a VMC for logo display.

A Common Mark Certificate (CMC) is the newer option, announced by the AuthIndicators Working Group in September 2024. It removes the trademark requirement but replaces it with proof that your logo has been in continuous public use on your domain for at least 12 months. Certificate authorities verify this using web archive records. In Gmail, a CMC gives you the brand logo without the blue checkmark. Apple Mail does not currently accept CMCs.

Quick Comparison

Feature	VMC	CMC
Trademark required	Yes	No
Logo eligibility proof	Trademark registration with IPO	12 months continuous public use
Gmail blue checkmark	Yes	No, logo avatar only
Apple Mail support	Yes	No (as of 2026)
Yahoo Mail	Yes	Yes
Annual cost (approx., as of mid-2026)	USD 749 to 1,688 + trademark fee	USD 650 to 1,100
Validation time	2 to 4 weeks	1 to 3 weeks
Certificate validity	397 days max	397 days max

One practical note: if your trademark registration is still in progress, you can start with a CMC and upgrade to a VMC once the trademark is confirmed. Both use the same DNS record format, the same hosting requirements, and the same PEM file structure, so the transition is mostly a certificate swap rather than a full rebuild.

How to Implement BIMI

Every step in this process depends on the one before it. A gap at any stage causes a silent failure where the logo simply does not appear and no error is sent to the domain owner. The only reliable approach is to complete each step fully before moving to the next.

Step 1: Set Up and Enforce DMARC

DMARC is the foundation that BIMI sits on. Without it at full enforcement, BIMI will not activate in Gmail or any other major provider. Begin by confirming that SPF and DKIM are configured and passing for every system that sends email from your domain. SPF authorizes the IP addresses permitted to send on behalf of your domain. DKIM adds a cryptographic signature to each outbound message so receiving servers can verify it has not been altered. Both must be aligned with the domain shown in the email From header.

Once SPF and DKIM are in place, publish a DMARC TXT record starting in monitoring mode (p=none). In a DMARC record, the p tag is the policy: it tells receiving servers what to do with mail that fails authentication. It has three values: p=none only monitors and takes no action, p=quarantine sends failing mail to the spam or junk folder, and p=reject blocks failing mail outright. The pct tag is the percentage of failing mail the policy is enforced on, where pct=100 covers every message. This lets you collect aggregate reports showing which senders are passing or failing alignment, without affecting mail delivery.

A gradual rollout matters because it shows you exactly who sends mail for your domain before you start blocking anything. Jumping directly to p=reject is risky. Any legitimate sender that is not yet aligned, such as a marketing tool or an internal app, will have its mail silently rejected, and you may not notice until customers do.

Reviewing the aggregate reports at each stage is what prevents this, because the reports reveal every sending source and whether it passes SPF and DKIM alignment. Only after every legitimate sender is passing, you should move the policy from p=none to p=quarantine, and then to p=reject. Crucially, you must also set pct=100, which applies the policy to all outbound mail, not just a percentage. Gmail requires pct=100 before it will process BIMI. A policy at p=quarantine with pct=25 will not qualify, even though it is technically an enforcement policy.

v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]

NIST Special Publication 800-177 Rev. 1, Trustworthy Email, is the federal reference for SPF, DKIM, and DMARC as the foundational mechanisms for trustworthy email infrastructure.

Step 2: Prepare a BIMI-Compliant SVG Logo

The logo file must conform to the SVG Tiny Portable and Secure profile, commonly called SVG Tiny PS. This is a restricted version of the SVG standard that prohibits JavaScript, external file references, and certain rendering features that mailbox providers cannot safely process. A standard SVG exported from a design tool will almost always need to be converted to this profile before it will pass BIMI validation.

Gmail requires the image dimensions to be specified as absolute pixel values with a minimum size of 96 by 96 pixels. Relative values like width=”100%” will cause rejection even if everything else is correctly configured. The logo should be square and centered within the image frame. Once the file meets the specification, host it at a stable HTTPS URL. Mailbox providers fetch this file every time they validate a BIMI record, so the hosting location should be treated as production infrastructure with consistent uptime.

Step 3: Apply for Your Certificate

With DMARC enforced and your logo hosted, you are ready to apply for a VMC or CMC from a BIMI-recognized certificate authority (CA). If you are applying for a VMC, you will need to submit your SVG logo file and proof of trademark registration from the relevant intellectual property office. The certificate authority will verify your organization identity, confirm domain control, and validate the trademark against the official registry. Expect the process to take two to four weeks, with trademark verification typically being the longest step.

For a CMC, you will submit your SVG logo and evidence that it has been continuously displayed on your domain for at least 12 months. Certificate authorities use web archive records to verify this, so the logo must be findable in publicly accessible archive snapshots going back at least 12 months from the date of application. CMC issuance typically takes one to three weeks.

When the certificate is issued, you receive a PEM file containing your entity certificate. You then need to append the intermediate CA certificates and the root CA certificate to this file, in that exact order: entity certificate first, intermediates next, root last. An incomplete or misordered chain is one of the most common causes of silent BIMI failure at the certificate validation stage.

Step 4: Host the PEM File and Publish the BIMI DNS Record

Upload the complete PEM file to a public HTTPS endpoint. The URL must be stable and reliably reachable by external servers, since mailbox providers will fetch it as part of every BIMI verification. Treat this URL the same way you would treat a production TLS certificate endpoint. Once the file is hosted, publish your BIMI TXT record in DNS:

Host: default._bimi.yourdomain.com  Record type: TXT
v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/certificate.pem

The l= field is the URL of your hosted SVG logo. The a= field is the URL of your hosted PEM certificate file. Both must use HTTPS. According to Google’s official BIMI documentation, DNS changes can take up to 48 hours to propagate fully.

Step 5: Validate and Test

After DNS propagation, use a BIMI validator to confirm that the TXT record resolves correctly, the SVG meets the Tiny PS specification, the PEM chain is in the correct order, and DMARC is properly enforced. A few free tools cover different parts of this check. The BIMI Inspector from the BIMI Group checks that your BIMI record is well formed and that DMARC is at enforcement. The URIports BIMI validator inspects the DNS record, the SVG logo, and the certificate together. The Google Admin Toolbox lets you open a real message header and see the SPF, DKIM, and DMARC results Gmail actually applied. A DMARC analyzer helps you read your aggregate reports and confirm every sender is aligned.

Then send a test email from your domain to a Gmail account and check whether the logo appears. If the logo is not showing, start by reviewing DMARC aggregate reports for alignment failures, verifying the PEM chain order, and confirming both hosted file URLs are publicly reachable over HTTPS. Give the setup up to 48 hours after DNS propagation before treating a missing logo as a confirmed failure.

Completing all five steps gets the logo live, but a working setup is not a permanent one. The same chain of dependencies that makes BIMI succeed also makes it fragile, and most failures are silent. The logo simply can stop appearing with no error sent to you. The mistakes below are the ones that most often break an otherwise correct configuration, both during initial rollout and months later.

Common Mistakes to Avoid

• Setting pct below 100 in DMARC prevents BIMI from activating in Gmail, even if p=reject is set. Organizations ramping DMARC enforcement gradually must complete the full ramp to pct=100 before enabling BIMI.
• Third-party sending platforms such as marketing automation tools, HR systems, and customer support software each need to be DKIM-signed and DMARC-aligned. A single high-volume misaligned sender disrupts BIMI display for that entire mail stream.
• Submitting a standard SVG file instead of one conforming to the SVG Tiny PS profile will result in CA rejection. Verify the logo profile before beginning the certificate application.
• An incomplete or misordered PEM chain causes silent certificate validation failure. Always verify the assembly order after building the file: entity certificate, then intermediates, then root.
• Certificate expiry removes logo display immediately with no grace period. Set renewal reminders at 90, 60, and 30 days before the expiry date and treat this like any production certificate renewal.
• Subdomains do not inherit the parent domain BIMI record. If your organization sends email from a subdomain, publish a separate BIMI TXT record for that subdomain.
• Not all certificate authorities are accepted by all mailbox providers. Confirm that your chosen CA is on the accepted list for your most important target providers before purchasing.

What these pitfalls have in common is that they treat BIMI as a one-time DNS change rather than ongoing certificate and PKI infrastructure. Avoiding them reliably takes the same discipline you apply to any production cryptographic asset which is exactly where dedicated PKI support makes the difference. For complete visibility over the BIMI certificate alongside your broader certificate estate, CBOM Secure provides the cryptographic inventory that confirms all certificate assets across sending domains are tracked and monitored.

How Encryption Consulting Can Help

Encryption Consulting provides the PKI expertise that a reliable BIMI program depends on. Our PKI Services cover assessment, design, and implementation of the certificate infrastructure behind DKIM signing and VMC or CMC deployment, including HSM integration for private key protection and certificate authority selection. If you would rather not run this infrastructure in-house, our PKI as a Service can host and manage the CA and HSMs that protect your DKIM and mark-certificate keys, while ownership of the CA and keys stays with you.

CertSecure Manager, our certificate lifecycle management platform, gives you a single, automated view of every certificate across your environment, from TLS and code signing to client, device, and BIMI certificates. It is vendor-neutral, connects public and private certificate authorities in a single view, automates discovery, enrollment, and renewal, and generates audit and high-risk certificate reports that prevent the expiry-driven outages most organizations discover only after the fact. As post-quantum cryptography adoption advances following the publication of NIST FIPS 203, 204, and 205 (August 13, 2024), the certificate infrastructure supporting BIMI and the broader enterprise PKI estate will need to plan migration to post-quantum algorithms. PQC Readiness assessment services and the PQC Center of Excellence help organizations plan how algorithm transitions affect their certificate estate, including BIMI certificates issued by Mark Verifying Authorities.

Watch our video on Understanding Digital Certificates to learn more about the certificate infrastructure that powers BIMI, PKI, and enterprise email security.

Conclusion

BIMI is one of the more practical wins available in enterprise email security right now. A verified logo in the inbox, and a blue checkmark for VMC senders in Gmail, gives recipients a clear and immediate trust signal before they open the message. The implementation process is methodical: enforce DMARC fully at p=reject with pct=100, prepare your logo in SVG Tiny PS format, apply for the right certificate type from an authorized CA, assemble the PEM in the correct chain order, host both files over HTTPS, and publish the BIMI DNS record.

Every step depends on the one before it, and every failure is silent. The organizations that maintain BIMI reliably are the ones that treat the certificate and the hosting infrastructure with the same discipline they apply to any other production cryptographic asset. If your team needs support with any part of the certificate management, PKI design, or DMARC enforcement process, Encryption Consulting is a best place to start.

Frequently Asked Questions

What is the main takeaway from Implementing BIMI with VMC and CMC?

BIMI implementation is a five-step sequential process where every step depends on the one before it and every failure is silent. The steps are: enforce DMARC at p=reject with pct=100; prepare an SVG logo conforming to SVG Tiny PS hosted at a stable HTTPS URL; apply for a VMC (registered trademark required) or CMC (12 months continuous logo use required); assemble the PEM file in chain order (entity first, then intermediates, then root) and host it at HTTPS; and publish the BIMI DNS TXT record. A 2025 URIports analysis found that 53.6 percent of published BIMI records contain at least one error that prevents logo display.

Why does BIMI implementation matter for enterprise PKI teams?

BIMI adds a VMC or CMC certificate to the enterprise certificate estate that expires silently at 397 days with no notification. When the certificate expires, the brand logo is removed immediately from all supported inboxes with no grace period. The DigiCert Trust Pulse Survey (July 2025) found that 45 percent of enterprises experienced certificate-related downtime in the prior year; a BIMI certificate expiry produces the same silent failure pattern. BIMI implementation also forces PKI teams to validate DKIM key management and DMARC alignment across the full outbound mail estate, often revealing third-party senders operating outside the managed email infrastructure.

What risks increase if BIMI implementation is handled manually?

Manual BIMI management introduces four specific risks: certificate expiry without renewal (the 397-day validity window requires proactive renewal tracking); PEM chain assembly errors (a misordered PEM causes silent certificate validation failure); third-party sender drift (new senders added without DKIM signing break DMARC alignment and BIMI display silently); and subdomain coverage gaps (subdomains used as From addresses require their own BIMI records, which manual inventories regularly miss).

Which teams should own BIMI implementation and ongoing governance?

BIMI governance must be distributed across four teams: PKI and certificate teams own the VMC or CMC certificate lifecycle including CA selection, PEM chain assembly, HTTPS hosting, and renewal tracking; email security teams own DMARC policy enforcement, DKIM key rotation, and sender alignment monitoring; brand and marketing teams own the SVG logo asset and SVG Tiny PS format compliance; and cloud or DevSecOps teams own DNS record management and HTTPS infrastructure for logo and PEM hosting. Any change by one team without notifying the others can break BIMI silently.

How does BIMI connect to certificate lifecycle management?

The VMC or CMC certificate is a certificate that expires, must be renewed, and must be tracked in the enterprise certificate inventory alongside TLS, code signing, and client authentication certificates. CertSecure Manager discovers and tracks BIMI certificates alongside all other certificates in the estate, sets renewal alerts at configurable thresholds before the 397-day expiry, and flags SVG or PEM hosting endpoint availability issues. Without CLM coverage, BIMI certificates become an unmonitored asset that removes brand trust signals on expiry with no warning.

How should organizations measure success in their BIMI implementation?

Key metrics: BIMI display rate (percentage of outbound mail volume that successfully displays the brand logo in supported providers, measurable via DMARC aggregate report analysis); DMARC enforcement coverage (100 percent of sending domains at p=quarantine or p=reject with pct=100); sender alignment completeness (all third-party senders DKIM-signed and aligned, verified quarterly); certificate renewal lead time (VMC or CMC renewal initiated at least 30 days before the 397-day expiry, with renewal alerts set at 90, 60, and 30 days); and zero unplanned logo removals from certificate expiry.

What should be audited or monitored regularly for a BIMI implementation?

Monitor continuously: VMC or CMC certificate expiry with renewal alerts at 90, 60, and 30 days; BIMI DNS TXT record validity and HTTPS availability of hosted SVG and PEM files; and DMARC aggregate reports for new senders not DKIM-signed or aligned. Audit quarterly: validate the full BIMI stack using a BIMI validator after any DNS change, logo update, or hosting migration; review the sender inventory against DMARC aggregate reports; and confirm subdomain coverage for all subdomains used in From addresses.

How does BIMI implementation affect cloud, hybrid, or multi-domain email environments?

In cloud and hybrid environments, outbound mail originates from multiple sources including the primary mail platform, third-party marketing platforms, support ticketing systems, HR tools, and transactional mail providers. Each must be DKIM-signed and DMARC-aligned. In multi-domain environments, each domain requires its own BIMI DNS TXT record, its own VMC or CMC certificate, and its own DMARC enforcement at pct=100. BIMI records are not inherited by subdomains. CBOM Secure provides the cryptographic inventory confirming all BIMI certificate assets across sending domains are tracked.

What common mistakes should teams avoid when implementing BIMI?

The most frequent mistakes: setting pct below 100 in DMARC (BIMI will not activate even if p=reject is set); submitting a standard SVG instead of SVG Tiny PS (CA rejection); assembling the PEM chain in the wrong order (entity must come first, then intermediates, then root; reversal causes silent failure); treating BIMI as a one-time project without assigning ongoing owners for certificate renewal, DNS records, SVG assets, and DMARC reporting; and not publishing separate BIMI records for subdomains used as From addresses.

What should be refreshed quarterly for BIMI governance?

Quarterly: review DMARC aggregate reports for new third-party senders not DKIM-signed or aligned; confirm the VMC or CMC certificate expiry date and verify renewal is initiated if within 90 days; validate the full BIMI stack using a BIMI validator; review subdomain coverage for any new subdomains used as From addresses; and check the BIMI Group website and mailbox provider announcements for policy changes. For post-quantum migration planning for BIMI certificate algorithms, check whether Mark Verifying Authorities have published timelines for post-quantum algorithm support through the PQC Center of Excellence.