BIMI with VMC and CMC: How Gmail’s Verified Logos Work in 2026

Email is one of the most exploited attack surfaces for brand impersonation. Brand Indicators for Message Identification (BIMI) is an email specification that displays a verified brand logo next to authenticated messages in supported inboxes, giving recipients a visual trust signal before they open the message.

Implementing BIMI in 2026 means choosing between two certificate types: the Verified Mark Certificate (VMC) and the Common Mark Certificate (CMC). The AuthIndicators Working Group introduced CMC support in late 2024, and Google supports CMC in Gmail, extending BIMI access to organizations without a registered trademark. This guide covers how BIMI works, how VMC and CMC differ, what Gmail specifically requires, and how enterprise teams can build a rollout that holds up operationally.

Quick Answer: What Is BIMI and How Does It Work in 2026?

BIMI (Brand Indicators for Message Identification) displays a verified brand logo next to authenticated emails in Gmail, Yahoo Mail, and Apple Mail. It requires DMARC enforced at p=quarantine or p=reject with pct=100, plus a valid VMC or CMC certificate. VMC requires a registered trademark and enables the Gmail blue checkmark. CMC requires 12 months of logo use. Both certificates have a 397-day validity cap.

Key Takeaways

• BIMI is a display layer, not an independent security system. It activates only when the full authentication stack passes: SPF and DKIM must pass, DMARC must be enforced at p=quarantine or p=reject with pct=100, and a valid VMC or CMC certificate must be referenced in the BIMI DNS TXT record at default._bimi.[domain]. A DMARC policy at p=none or with pct below 100 does not qualify.
• VMC requires a registered trademark with a recognized IP office (USPTO, EUIPO, UK IPO, IP Australia). It enables the Gmail brand avatar and the blue verified checkmark, and is supported by Apple Mail. CMC requires 12 months of continuous public logo use on the sending domain. It enables Gmail brand avatar display only and is not supported by Apple Mail as of 2026.
• A 2025 URIports analysis found that 53.6 percent of published BIMI records contain at least one error that prevents logo display. Every failure in the authentication and certificate chain is silent: no error notification is sent to the domain owner.
• Both VMC and CMC certificates carry a 397-day validity cap. A certificate that expires removes the brand logo immediately and silently from all supported inboxes. The DigiCert Trust Pulse Survey (July 2025) found that 45 percent of enterprises experienced certificate-related downtime in the prior year; a BIMI certificate expiry produces the same silent failure pattern.
• Microsoft Outlook has not adopted BIMI as of mid-2026. BIMI operates across Gmail, Yahoo Mail, Apple Mail (VMC only for Apple Mail), and other major mailbox providers. BIMI is a living specification: mailbox provider support and certificate requirements change, and implementations require quarterly review against current provider policies.

Who Should Care About BIMI

BIMI sits at the intersection of email security, PKI, DNS, brand management, and cloud infrastructure. The consequences of a failure in any one component appear as a silent logo removal across all supported inboxes, with no error notification to the domain owner or any team member.

Role	Why It Matters	Action Item
PKI and Certificate Teams	Own the VMC or CMC certificate: CA selection, trademark or logo use validation coordination, HTTPS hosting of the PEM file, and renewal tracking against the 397-day expiry; a certificate that expires removes the brand logo silently with no notification; BIMI certificates belong in the enterprise certificate inventory alongside TLS, code signing, and client authentication certificates	Add the VMC or CMC certificate to the CertSecure Manager inventory with renewal alerts at 90, 60, and 30 days before expiry; confirm the PEM file hosting URL is available over HTTPS from external networks; document the CA and trademark or logo use validation records for renewal evidence
Email Security Teams	Own DMARC policy enforcement, DKIM key rotation, and sender alignment monitoring; BIMI requires DMARC at p=quarantine or p=reject with pct=100 before it activates; a DKIM key rotation that breaks DMARC alignment, or a new third-party sender added without DKIM signing, disrupts BIMI display for that mail stream silently	Confirm DMARC enforcement is at pct=100 on all sending domains before adding BIMI DNS records; review DMARC aggregate reports weekly to identify new senders appearing in the outbound estate that are not DKIM-signed or aligned; document DKIM rotation procedures to require email security team notification before changes are applied
Brand and Marketing Teams	Own the SVG logo asset and format compliance with BIMI SVG Tiny PS requirements; updating the brand logo without resubmitting to the CA for revalidation causes the mailbox provider to reject the BIMI record outright because the certificate no longer matches the hosted logo; high-volume third-party marketing senders must be DKIM-signed and DMARC-aligned for the sending domain	Establish a change notification process requiring brand team to notify PKI and email security teams before any SVG logo update is deployed; confirm all marketing platform senders (email service providers, marketing automation tools) are listed in the sender inventory and are DKIM-signed and aligned; validate the SVG file against BIMI format requirements before submitting to the CA
Cloud and DevSecOps Teams	Own DNS automation, HTTPS infrastructure for logo and PEM certificate file hosting, and deployment pipelines; a DNS change that removes or alters the BIMI TXT record, or a hosting environment change that makes the SVG or PEM URL unreachable, breaks BIMI silently; subdomain coverage gaps appear when new subdomains are added as From addresses without a corresponding BIMI record	Add BIMI DNS TXT record validation and SVG/PEM URL availability checks to infrastructure-as-code validation and deployment pipelines; confirm BIMI record coverage for all subdomains used in From addresses; include BIMI stack validation in post-deployment smoke tests for any DNS or hosting environment change
CISOs	BIMI is both a brand trust mechanism and a security forcing function: full DMARC enforcement at pct=100 required for BIMI is the same enforcement posture that maximizes protection against domain spoofing; the certificate lifecycle discipline required for BIMI also reveals gaps in the broader certificate governance program; 53.6 percent of published BIMI records contain errors that prevent logo display (URIports, 2025), which means most BIMI implementations are not delivering the intended trust signal	Require BIMI implementation to be treated as a cross-functional program with named owners for each component (certificate, DNS, SVG, DMARC), not a one-time project; fund CLM tooling that covers BIMI certificates alongside the broader certificate estate; mandate quarterly BIMI stack validation as part of the email security review cadence

BIMI Readiness Checklist: Issue, Business Impact, Recommended Action, and Owner

Use this checklist to identify which readiness issues apply to your environment and assign remediation ownership before a silent failure removes your brand logo from supported inboxes.

Issue	Business Impact	Recommended Action	Owner
DMARC not enforced at pct=100	BIMI will not activate in Gmail or other providers requiring full enforcement; partial rollout (pct below 100) means BIMI logo displays inconsistently or not at all	Ramp DMARC enforcement incrementally using DMARC aggregate report data to identify misaligned senders before increasing pct; reach pct=100 before adding BIMI DNS records	Email Security Team
Third-party sender not DKIM-signed or DMARC-aligned	Mail from that sender stream fails DMARC alignment; BIMI logo absent for all mail from that source; deliverability impact possible if DMARC policy is p=reject	Audit all third-party senders in the outbound estate from DMARC aggregate reports; configure DKIM signing for each sender or move to a subdomain with its own DMARC and BIMI records	Email Security Team + Marketing Team
VMC or CMC certificate not tracked in CLM platform	Certificate expires with no renewal alert; brand logo removed silently from all supported inboxes at expiry; no notification sent to domain owner or any team	Add the VMC or CMC certificate to CertSecure Manager with renewal alerts at 90, 60, and 30 days before the 397-day expiry; confirm the PEM file URL is monitored for availability	PKI Team
SVG logo updated without CA revalidation	Certificate no longer matches the hosted logo; mailbox providers reject the BIMI record outright; brand logo removed silently from all supported inboxes	Establish a change control process requiring CA revalidation before any SVG logo update is published; document the revalidation timeline (one to four weeks) so brand updates are planned accordingly	Brand Team + PKI Team
BIMI record missing for a subdomain used in From header	BIMI records are not inherited by subdomains; mail sent from a subdomain with no BIMI record displays no logo in supported inboxes regardless of the parent domain’s BIMI configuration	Audit all subdomains used in From addresses; add BIMI DNS TXT records, VMC or CMC certificates, and DMARC enforcement for each qualifying subdomain	Cloud/DevSecOps Team + Email Security Team
SVG or PEM hosting URL not available over HTTPS	Mailbox providers cannot fetch the logo or certificate file; BIMI record is treated as invalid; logo display fails silently	Host the SVG and PEM files on HTTPS URLs accessible from external networks; add URL availability monitoring for both hosting endpoints; include availability checks in deployment pipelines	Cloud/DevSecOps Team
No quarterly BIMI stack validation process	DNS changes, logo updates, hosting migrations, and DMARC drift accumulate between reviews; failures are discovered only when someone notices the logo is missing	Schedule quarterly full BIMI stack validation using a BIMI validator covering the DNS record, SVG hosting, PEM hosting, and DMARC enforcement status; include validation in the quarterly email security review cadence	Email Security Team + PKI Team

Why BIMI Matters for Enterprise Security Teams

BIMI interrupts phishing by backing the displayed brand logo with a verified certificate tied to the sending domain. For VMC-authenticated senders, Gmail also displays a blue verified checkmark, an additional visual verification signal in Gmail. That checkmark is exclusive to VMC; CMC-only implementations display a brand avatar without it.

A second benefit is operational. Implementing BIMI forces teams to resolve Domain-based Message Authentication, Reporting and Conformance (DMARC) alignment gaps across all outbound sending systems, including third-party platforms for marketing, support, and HR. That cleanup improves deliverability, reduces spoofing exposure, and gives security teams a complete picture of the sender inventory.

Note that Microsoft Outlook has not adopted BIMI as of mid-2026. BIMI currently operates across Gmail, Yahoo Mail, Apple Mail, and other major mailbox providers.

How BIMI Works

BIMI is a display layer, not an independent security system. It activates only when the underlying authentication stack passes all required checks. The architecture has three layers. Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM) must pass; DMARC must be enforced at p=quarantine or p=reject with pct=100; and a BIMI DNS record must point to a hosted SVG logo and a valid certificate file. A policy at p=none or with pct below 100 does not qualify.

Those settings are DMARC record tags written as tag=value. The p tag sets the policy for mail that fails DMARC, where p=none only monitors, p=quarantine diverts failing mail to spam, and p=reject blocks it. The pct tag sets the share of failing mail the policy applies to, so pct=100 means all of it. The term pct is a single tag abbreviated from percent, not three separate letters.

Authentication Flow

1. The sender’s mail server signs the message with DKIM and passes SPF for the sending IP.
2. The mailbox provider checks DMARC alignment, which means the domain that passed SPF or DKIM must match the domain shown in the From address. At least one of SPF or DKIM must both pass and match; a message can pass one of them and still fail DMARC if the domains do not match. This binds authentication to the visible From domain.
3. The provider confirms DMARC is at p=quarantine or p=reject with pct=100.
4. The provider queries the BIMI DNS TXT record at default._bimi.[domain].
5. The provider fetches and validates the SVG logo and PEM certificate over HTTPS.
6. If all checks pass, the brand logo displays. In Gmail, messages authenticated with a VMC are also eligible to display the verified blue checkmark.

Every failure in this chain is silent. No error is sent to the domain owner. A 2025 URIports analysis found that 53.6 percent of published BIMI records contain at least one error that prevents logo display.

VMC vs CMC: Choosing the Right Certificate

Verified Mark Certificate (VMC)

A VMC requires a trademark registered with a recognized IP office. As of 2026, the BIMI Group’s VMC Requirements recognize trademark offices in more than a dozen jurisdictions, including the USPTO, EUIPO, UK IPO, and IP Australia. VMCs are issued by the Mark Verifying Authorities recognized by the BIMI Group. Entrust, an original issuer, exited the BIMI certificate business in 2025 after selling its public certificate operations.

Pricing varies by CA and reseller, running roughly USD 749 to USD 1,750 per year excluding trademark fees, with validation taking two to four weeks. A VMC enables the brand avatar and the Gmail blue checkmark on both web and mobile. Certificate validity is capped at 397 days.

Common Mark Certificate (CMC)

A CMC serves organizations without a registered trademark. To qualify, the logo must have been in continuous public use on the domain for at least 12 months, verified by the CA using evidence of prior use, which may include web archive records. The same authorities issue CMCs at approximately USD 650 to USD 1,100 annually, with issuance in one to three weeks. CMC enables Gmail brand avatar display but does not trigger the blue checkmark and is not supported by Apple Mail. The 397-day validity window and all operational requirements are identical to VMC.

Comparison Table

Area	VMC	CMC
Trademark required	Yes, registered with recognized IP office	No trademark required
Proof of logo use	Trademark serves as proof	Logo in public use for 12+ months
Gmail blue checkmark	Yes	No, brand avatar only
Apple Mail support	Yes	No (VMC only as of 2026)
Yahoo Mail	Yes	Yes (no cert required by Yahoo)
Annual cost (approx., as of mid-2026)	USD 749-1,750 + trademark fees	USD 650-1,100
Issuance time	2-4 weeks	1-3 weeks

Enterprise Architecture and Team Ownership

BIMI sits at the intersection of email security, Public Key Infrastructure (PKI), DNS, brand management, and cloud infrastructure. Clear ownership across four areas prevents the outages that follow certificate expiry or DNS changes:

• Email security teams own DMARC policy, DKIM key rotation, and sender alignment monitoring.
• PKI and certificate teams manage the VMC or CMC certificate, including trademark validation with the CA, HTTPS hosting, and renewal tracking.
• Brand and marketing teams own the SVG logo asset and format compliance.
• Cloud and DevSecOps teams own DNS automation, HTTPS infrastructure, and deployment pipelines.

When a team rotates a DKIM key without notifying the email team, DMARC alignment breaks and the logo disappears. When marketing updates the SVG without resubmitting to the CA, the certificate mismatch causes logo failure. Both scenarios are common in organizations that treat BIMI as a one-time project.

What Causes Silent BIMI Failures

• Incomplete DMARC enforcement: Setting p=quarantine without pct=100 means the policy applies to only a subset of outbound mail. Organizations ramping DMARC incrementally must reach pct=100 before BIMI activates in Gmail.
• Third-party sender misalignment: Marketing tools, support platforms, and HR systems must all be DKIM-signed and DMARC-aligned. A single high-volume misaligned sender disrupts BIMI display for that entire mail stream.
• Certificate and logo mismatch: The SVG and PEM must match the validated asset on record with the CA. Updating the logo without revalidating the certificate causes providers to reject the BIMI record outright.
• Subdomain coverage gaps: BIMI records are not inherited by subdomains. Senders using a subdomain in the From header need their own BIMI record or logo display will be absent for that mail stream.

Best Practices for a Durable BIMI Program

• Start with one domain. Confirm DMARC enforcement (p=quarantine or p=reject), ideally stable for around 30 days, before adding BIMI.
• Build a complete sender inventory first. Every system sending mail under the domain must be DKIM-signed and aligned before enforcement is enabled.
• Assign named owners for DNS records, certificate files, SVG assets, and DMARC reporting, and document handoff procedures for renewal and logo updates.
• Review DMARC aggregate reports weekly. They are the most reliable early-warning signal for BIMI disruptions.
• Set certificate renewal reminders at 90, 60, and 30 days before the 397-day expiry. Expiry causes immediate, graceless logo removal.
• Validate the full BIMI stack after any DNS change, logo update, or hosting migration using a BIMI validator.

How Encryption Consulting Can Help

Encryption Consulting provides the PKI expertise that a reliable BIMI program depends on. Our PKI Services cover assessment, design, and implementation of the certificate infrastructure behind DKIM signing and VMC or CMC deployment, including Hardware Security Module (HSM) integration for private key protection and certificate authority selection. Our PKI as a Service builds and manages the entire CA environment while ownership of the CA and keys stays with you, running on FIPS 140-3 Level 3 HSMs with crypto-agile, post-quantum-ready certificates.

CertSecure Manager, our certificate lifecycle management platform, gives you a single, automated view of every certificate across your environment, from TLS and code signing to client, device, and BIMI certificates. It is vendor-neutral, connects public and private certificate authorities in a single view, automates discovery, enrollment, and renewal, and generates audit and high-risk certificate reports that prevent the expiry-driven outages most organizations discover only after the fact. For organizations building a complete cryptographic inventory that includes BIMI certificate assets alongside their broader PKI estate, CBOM Secure provides the cross-environment discovery layer that confirms every certificate is tracked.

As post-quantum cryptography adoption advances following the publication of NIST FIPS 203, 204, and 205 (August 13, 2024), the certificate infrastructure supporting BIMI and the broader enterprise PKI estate will need to plan migration to post-quantum algorithms. PQC Readiness assessment services and the PQC Center of Excellence help organizations plan how algorithm transitions affect their certificate estate, including BIMI certificates issued by Mark Verifying Authorities.

Conclusion

BIMI rewards correct email authentication with a visible mark of trust in the inbox. VMC is the right choice for trademarked brands that want the Gmail blue checkmark and Apple Mail support. CMC opens the standard to organizations that can demonstrate 12 months of logo use, with identical operational requirements after issuance.

At its core, BIMI is one more place where disciplined authentication and certificate hygiene become something customers can actually see. Done correctly, the result is not just a logo in the inbox. It is a more controlled, visible, and defensible email identity program.

Frequently Asked Questions

What is the main takeaway from BIMI with VMC and CMC: How Gmail’s Verified Logos Work in 2026?

BIMI activates only when SPF and DKIM pass, DMARC is enforced at p=quarantine or p=reject with pct=100, and a valid VMC or CMC certificate is referenced in the BIMI DNS TXT record. VMC requires a registered trademark and enables the Gmail blue verified checkmark and Apple Mail support. CMC requires 12 months of continuous logo use and enables Gmail brand avatar display only. Both certificates have a 397-day validity cap. A 2025 URIports analysis found that 53.6 percent of published BIMI records contain at least one error that prevents logo display.

Why does BIMI matter for enterprise PKI and security teams?

BIMI forces DMARC enforcement at pct=100, which also maximizes protection against domain spoofing. The VMC or CMC certificate is a certificate that expires silently if not tracked: the DigiCert Trust Pulse Survey (July 2025) found that 45 percent of enterprises experienced certificate-related downtime in the prior year, and a BIMI certificate expiry produces the same silent removal pattern with no notification sent to the domain owner or any team. Implementing BIMI also forces a complete audit of all third-party senders in the outbound estate, giving security teams visibility they often did not have before.

What risks increase if BIMI is implemented and managed manually?

Manual BIMI management introduces four specific risks: certificate expiry without renewal (logo removed silently at 397-day expiry with no notification); SVG and certificate mismatch (updating the brand logo without CA revalidation causes providers to reject the BIMI record outright); DMARC alignment drift (a new third-party sender without DKIM signing disrupts BIMI display for that mail stream silently); and subdomain coverage gaps (BIMI records not inherited by subdomains are regularly missed in manual inventories).

Which teams should own BIMI implementation and ongoing governance?

BIMI ownership must be distributed across four teams: email security teams own DMARC policy, DKIM rotation, and sender alignment monitoring; PKI and certificate teams manage the VMC or CMC certificate including CA selection, HTTPS hosting, and renewal tracking; brand and marketing teams own the SVG logo asset and format compliance; and cloud or DevSecOps teams own DNS automation, HTTPS infrastructure, and deployment pipelines. When any team makes a change without notifying the others, BIMI fails silently.

How does BIMI connect to certificate lifecycle management?

The VMC or CMC certificate is a certificate in the enterprise estate that expires, must be renewed, and must be tracked in a CLM platform alongside TLS, code signing, and client authentication certificates. CertSecure Manager discovers and tracks BIMI certificates alongside all other certificates, sets renewal alerts at configurable thresholds before the 397-day expiry, and flags SVG or PEM hosting endpoint availability issues. Without CLM coverage, BIMI certificates become an unmonitored asset that removes brand trust signals from the inbox on expiry with no warning.

How should organizations measure success in their BIMI program?

Key metrics: BIMI display rate (percentage of outbound mail volume in Gmail and other supported providers that successfully displays the brand logo, measurable via DMARC aggregate report analysis); DMARC enforcement coverage (100 percent of sending domains at p=quarantine or p=reject with pct=100); sender alignment completeness (all third-party senders DKIM-signed and DMARC-aligned, verified quarterly); certificate renewal lead time (VMC or CMC renewal initiated at least 30 days before the 397-day expiry); and zero unplanned logo removals from certificate expiry.

What should be audited or monitored regularly for a BIMI program?

Monitor continuously: VMC or CMC certificate expiry with renewal alerts at 90, 60, and 30 days before expiry; BIMI DNS TXT record validity and HTTPS availability of the hosted SVG and PEM files; and DMARC aggregate reports for new senders not DKIM-signed or aligned. Audit quarterly: validate the full BIMI stack using a BIMI validator after any DNS change, logo update, or hosting migration; review the sender inventory against DMARC aggregate reports; and confirm subdomain coverage for all subdomains used in From addresses.

How does BIMI affect cloud, hybrid, or multi-domain email environments?

In cloud and hybrid environments, outbound mail originates from multiple sources including the primary mail platform, third-party marketing platforms, support ticketing systems, HR tools, and transactional mail providers. Each must be DKIM-signed and DMARC-aligned for the sending domain. In multi-domain environments, each domain requires its own BIMI DNS TXT record, its own VMC or CMC certificate, and its own DMARC enforcement at pct=100. BIMI records are not inherited by subdomains; each subdomain used as a From address requires its own record. CBOM Secure provides the cryptographic inventory that confirms all certificate assets across sending domains are tracked.

What common mistakes should teams avoid when implementing BIMI?

The most frequent mistakes: enabling BIMI before DMARC enforcement reaches pct=100 (logo display will be inconsistent or absent); updating the brand SVG logo without resubmitting to the CA for revalidation (certificate no longer matches the hosted logo, BIMI record rejected); treating BIMI as a one-time project without assigning ongoing owners for certificate renewal, DNS records, SVG assets, and DMARC reporting; and assuming BIMI is universal (Microsoft Outlook has not adopted BIMI as of mid-2026; CMC is not supported by Apple Mail; Yahoo Mail supports BIMI without a certificate requirement).

What should be refreshed quarterly for BIMI governance?

Quarterly: review DMARC aggregate reports for new third-party senders not DKIM-signed or aligned; confirm the VMC or CMC certificate expiry date and verify renewal is initiated if within 90 days; validate the full BIMI stack using a BIMI validator; review subdomain coverage for any new subdomains used as From addresses; and check the BIMI Group website and supported mailbox provider announcements for policy changes. For post-quantum planning, check whether Mark Verifying Authorities have published timelines for post-quantum algorithm support through the PQC Center of Excellence.