What are the requirements and alternatives for implementing BIMI with VMC certificates, especially regarding trademark jurisdiction and costs?
Updated on 8 Oct 2026: We refreshed BIMI certificate costs and clarified validation requirements and logo display checks.
A Verified Mark Certificate (VMC) supports BIMI (Brand Indicators for Message Identification) logo display and is required for Gmail's verified checkmark. You do not need a VMC to publish a BIMI record, and you do not always need one to get some logo display. A Common Mark Certificate (CMC) is the main paid alternative for Gmail logo display when a registered logo trademark is unavailable, provided the mark qualifies through prior use or another permitted CMC evidence path. Self-asserted BIMI can still work with mailbox providers that do not require a certificate.
Do not start by buying the certificate. First prove the domain is ready. DMARC must be at enforcement, and the logo must use the required SVG format. Its trademark or common mark evidence must match the logo you want displayed. If DMARC monitoring shows legitimate messages failing DMARC, fix those sending sources first. BIMI eligibility is evaluated for each message; failures on one source do not automatically block every authenticated message using the domain.
Trademark jurisdiction still matters, but the current rule is broader than the old fixed-country lists. The Mark Certificate Requirements now define a Trademark Office as an intellectual property office listed by WIPO. Argentina and Uruguay both have national industrial property offices in that directory, so their registrations should not be dismissed solely because of jurisdiction. The issuer must still validate the registration, good standing, ownership or license, and logo match. Each mailbox provider separately decides whether to accept that issuer's certificate.
BIMI and VMC requirements at a glance
For BIMI with a VMC, the requirements cover the technical setup and legal validation, plus ongoing operations. The organizational domain and the domain in the visible From address must use DMARC at p=quarantine or p=reject at full enforcement, without sp=none. RFC 9989 classifies pct as historic, so omit it from new records. Legally, the logo normally needs to be a registered trademark in good standing with a WIPO-listed office. A qualifying government mark is another VMC path. Operationally, you need issuer validation, a compliant SVG Tiny PS logo, a hosted PEM certificate file, and a BIMI TXT record.
- VMC: Best for brands with an accepted registered logo trademark that want the Gmail verified checkmark.
- CMC: Best when Gmail logo display matters and the mark qualifies through a current CMC evidence path.
- Self-asserted BIMI: Best when the budget is zero and limited mailbox provider coverage is acceptable.
- No BIMI: Best when DMARC is not stable, because logo work should wait until authentication is clean.
Do not confuse certificate types
A standard TLS certificate, self-signed certificate chain, or ordinary domain validation certificate is not a VMC or CMC. A Mark Certificate binds the validated logo and domain to the applying organization under the current certificate requirements. Gmail will not treat an ordinary web certificate as BIMI evidence.
Illustrated BIMI setup requirements for Google Workspace, including VMC or CMC certificates.
Requirements before buying a VMC
The VMC purchase should be the last step in the sequence. Get the domain, DNS, logo file, and reporting pipeline ready first. The BIMI Group describes the core VMC requirements: a registered trademark, an SVG Tiny PS logo, DMARC enforcement, and a BIMI DNS record. The issuer then verifies the organization, logo rights, domain control, certificate request, and the designated applicant.
|
|
|
|---|---|---|
DMARC | Messages pass DMARC | Authentication must match the visible From domain |
Policy | Quarantine or reject on organizational and sending domains | No partial rollout |
Logo | SVG Tiny PS | Required format |
Trademark | Eligible registered mark or qualifying government mark | Issuer verifies logo rights and evidence |
Hosting | Stable HTTPS | Fetchable evidence |
Core BIMI and VMC readiness checks
DMARC policy that can qualify for BIMIDNS
_dmarc.example.com. 3600 IN TXT ( "v=DMARC1; p=quarantine; " "rua=mailto:dmarc-reports@example.com" )
RFC 9989 made the old pct sampling tag historic. New DMARC records should omit it. For BIMI, keep the policy at p=quarantine or p=reject and do not rely on partial policy sampling. If a legacy record still includes pct, use pct=100; Google's BIMI documentation still describes that setting. Under RFC 9989, t=y requests reduced enforcement during testing, so disable that test mode before treating the domain as fully enforced.
The public web server should support HTTPS with TLS 1.2 or later. For a certificate-backed setup, host the entity certificate and the complete intermediate and root chain in the PEM file. Keep the URL stable and accessible without authentication. Gmail also expects an SVG at least 96 by 96 pixels with absolute dimensions. The file must use the restricted SVG Tiny PS profile and contain no scripts or external resources. Use a square composition. Gmail recommends a file of 32 KB or less, a solid background, and a <desc> element for accessibility.
Before changing records, run the domain through Suped's domain health checker to review DNS configuration, then use DMARC reports and test-message headers to confirm legitimate mail passes DMARC. SPF or DKIM must pass with an authenticated domain that matches the visible From domain under the configured DMARC rules. A DNS check alone does not verify every sending source.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Trademark jurisdiction and cost realities
Current Mark Certificate Requirements do not use the old short country list. They define a Trademark Office as an intellectual property office recognized in WIPO's directory for trademark registration. WIPO listing does not guarantee that a particular issuer will validate the registration, and it does not grant worldwide trademark protection. A registered mark must still be in good standing and verifiable in the official office database or the global trademark database named in the requirements. The current Mark Certificate Requirements are available through the BIMI Group.
For a company with a registration in Argentina or Uruguay, do not file in another jurisdiction solely because an old VMC list omitted the local office. First ask the issuer to confirm that it can verify the registration number, ownership or license, mark status, colors, and the SVG match. For word-only marks, read the word mark requirements before assuming a brand name registration will qualify the proposed logo.
Cost decision bands
Rough annual certificate budgets in USD, including advertised multi-year rates. Add trademark filing, legal work, SVG preparation, and implementation time separately.
Self-asserted BIMI
US$0 certificate fee
No certificate fee; setup and hosting still have costs.
CMC
US$990-$1,500/year
Prior-use or other CMC evidence path.
VMC
US$1,350-$1,800/year
Registered-mark path with Gmail checkmark.
Use roughly US$990-$1,500 per year for a CMC and US$1,350-$1,800 per year for a VMC as planning ranges. The lowest advertised rates include multi-year discounts, and one-year list prices reach US$1,416 for a CMC and US$1,752 for a VMC. Quotes vary by term, reseller, domain count, and validation scope; taxes and renewal pricing also affect the total. A new trademark filing can add filing fees, legal review, translations, logo revisions, and months of waiting.
Compare the full quote
- Certificate scope: Confirm the covered domains and logos, including whether extra domains or a different logo require another certificate or fee.
- Validation work: Ask what identity, trademark, archive, or licensing evidence is included in the quote.
- Renewal terms: Compare annual and multi-year rates, revalidation steps, and early renewal timing. A multi-year purchase still requires replacement certificates: the maximum validity is 398 days.
Ask this before paying
- Jurisdiction: Can you validate this exact trademark office under the current requirements?
- Logo match: Does the registered or evidenced mark match the SVG that will be embedded?
- Mailbox reach: Which mailbox providers currently accept certificates from this issuer?
- Renewal: What evidence is rechecked if the mark, domain, or applicant changes?
How CMC eligibility works
A CMC still requires evidence of logo rights even when no registered trademark is used. The current Mark Certificate Requirements allow three validation paths, and the issuer must still verify the organization, domain control, logo rights, applicant authority, and the submitted SVG. Confirm which of these paths the issuer offers before paying.
- Prior use mark: The same logo must appear now and at least 12 months earlier on a website under the same domain the applicant controls. The issuer verifies the earlier display through an approved web archive. A new logo without qualifying historical evidence does not qualify through prior use immediately.
- Modified registered mark: A registered mark can support a CMC when the proposed logo uses a permitted change, such as rearranged words or a limited removal from the design. The allowed changes are specific, so pre-clear the SVG.
- Provisional mark: A proposed logo can differ from the underlying registered mark when that registration is at least three years old and the issuer completes the required ownership and registration checks.
CMC does not provide the Gmail checkmark
A CMC can support BIMI logo display in Gmail, but the verified checkmark is tied to a VMC. Mailbox providers decide whether to display any BIMI logo, so valid DNS and a valid certificate do not guarantee rendering for every message.
VMC, CMC, and certificate-free BIMI compared
The main alternatives are concrete. Choose VMC when the registered mark and verified checkmark justify the cost. Choose CMC when Gmail logo display matters and the logo meets an accepted CMC evidence path. Choose self-asserted BIMI when certificate cost is unjustified and limited support is acceptable. A deeper CMC versus VMC comparison helps when procurement needs the validation differences spelled out.
|
|
|
|
|
|---|---|---|---|---|
VMC | Usually, or a qualifying government mark | US$1,350-$1,800 | Eligible Gmail logo and checkmark | More validation |
CMC | Not always | US$990-$1,500 | Eligible Gmail logo | No checkmark |
Self-asserted | Not required | $0 | Limited logo | Sparse support |
No BIMI | Not needed | $0 | No BIMI logo | No BIMI result |
BIMI implementation paths; certificate budgets exclude setup and trademark costs, and display remains subject to mailbox-provider checks.
VMC path
- Best fit: Brands with registered logo trademarks that pass current issuer checks.
- Benefit: Gmail verified checkmark and broader certificate-backed recognition.
- Risk: Registry data or ownership evidence can stall validation. A logo mismatch can do the same.
CMC or self-asserted path
- Best fit: Brands with qualifying CMC evidence or a limited certificate budget.
- Benefit: Lower certificate cost or no certificate purchase.
- Risk: No Gmail checkmark and less predictable provider support.
The certificate-free option is legitimate, but support remains limited. Yahoo, Fastmail, and some other BIMI-supporting providers can display self-asserted logos, while Gmail requires a VMC or CMC for BIMI logo display. Display is always the receiving provider's decision and can depend on reputation. Yahoo also requires bulk mail with sufficient sender reputation and engagement, so a low-volume sender should not assume a self-asserted logo will appear. Apple Mail display also depends on the receiving email provider meeting Apple's BIMI requirements. For more on that narrow path, use BIMI without a VMC as a follow-up.
Implementation sequence
This order avoids paying for a certificate before the domain can use it. The work centers on DNS and evidence collection. The logo file and public hosting need careful handling before issuer validation begins.
- Inventory: List every sender using the domain and verify that legitimate messages pass DMARC before enforcing the policy.
- Enforce: Move the organizational domain and visible From domain to quarantine or reject, with no partial policy sampling or DMARC test mode.
- Prepare: Convert the logo to SVG Tiny PS and keep it visually matched to the mark evidence.
- Validate: Ask the issuer to confirm the trademark office, evidence path, mailbox acceptance, and final price.
- Publish: Host the SVG for self-asserted BIMI or the complete PEM for a certificate-backed setup, then publish the BIMI TXT record.
- Monitor: Track authentication failures, BIMI fetch errors, certificate expiry, and policy drift.
BIMI implementation flowchart showing DMARC enforcement and VMC, CMC, or self-asserted options.
BIMI record without a certificateDNS
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; " "l=https://assets.example.com/bimi.svg; " "a=" )
BIMI record with a VMC or CMC PEMDNS
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; " "l=https://assets.example.com/bimi.svg; " "a=https://assets.example.com/bimi.pem" )
Use both the SVG and PEM URLs in a certificate-backed record to support providers that fetch the standalone logo. Gmail also accepts an empty l= when the PEM contains the logo, but that form does not supply a standalone SVG URL for other receivers.
If you need to create the first DMARC record before working toward BIMI, use the DMARC record generator and stage the policy carefully. For BIMI, skip p=none as the final state. It is useful for learning, but it does not qualify for logo display.
Why a BIMI logo does not appear after setup
A published record and paid certificate do not guarantee logo display. Check an actual message sent through each production sender.
- Inspect Authentication-Results in the received message for dmarc=pass. A passing SPF or DKIM result without the required From-domain match is insufficient.
- Check the sending domain and BIMI selector. Publish one applicable TXT record at default._bimi, or at the selector used by the message, and check any subdomain record that overrides the organizational record.
- Confirm that the PEM covers the sending domain, has not expired or been revoked, and includes the full certificate chain. Fetch the published HTTPS files without signing in.
- Test in a supporting mailbox and allow for provider caching. Google says a new BIMI record can take up to 48 hours to produce logo display in Gmail; this is not a display guarantee.
The BIMI specification explains DNS discovery and message evaluation. BIMI does not guarantee inbox placement or change how a receiver delivers the message.
Where Suped fits
Suped is our DMARC reporting and email authentication platform. For BIMI preparation, it helps identify sending sources and authentication failures before a team pays for a Mark Certificate or moves DMARC to enforcement.
Hosted DMARC configuration dialog showing policy controls, CNAME setup, and expanded advanced options
The practical Suped workflow is to inventory legitimate sources, investigate SPF or DKIM alignment failures, stage the DMARC policy, and watch for drift after enforcement. Automated issue detection and real-time alerts help surface changes that can interrupt BIMI eligibility. Hosted DMARC can also reduce coordination delays when DNS access is split across teams.
For teams that need to manage DMARC changes through a central workflow, Suped's Hosted DMARC supports policy staging while reporting and alerts track the effect on legitimate senders.
Views from the trenches
Best practices
Confirm the issuer can verify your WIPO-listed trademark office before paying the fee.
Move DMARC to quarantine or reject without partial sampling before publishing BIMI.
Keep dated website evidence ready when a 12-month prior-use CMC is the likely route.
Common pitfalls
Relying on an old jurisdiction list can trigger an unnecessary foreign trademark filing.
Buying a certificate before fixing DMARC leaves the logo invisible in strict mailboxes.
Using an ordinary TLS certificate in the BIMI record does not satisfy evidence checks.
Expert tips
Ask for current mailbox acceptance details before choosing the lowest quoted price.
Match the submitted SVG's layout and colors to the evidence the issuer will review.
Keep the PEM URL stable and track expiration because an expired certificate stops display.
Marketer view
Marketer from Email Geeks says low sending volume can make a $1,000 annual certificate hard to justify compared with self-asserted BIMI.
2024-08-02 - Email Geeks
Expert view
Expert from Email Geeks says mailbox providers decide which certificates count, so self-signed chains and ordinary TLS certificates do not replace VMC or CMC validation.
2024-09-05 - Email Geeks
Choose a BIMI certificate path
If the brand has a registered logo trademark that the issuer can validate and sends enough mail for inbox branding to matter, buy a VMC after DMARC is enforced. If the trademark is missing or the displayed logo differs from it, check the current CMC evidence paths. If certificate spend is hard to justify, publish self-asserted BIMI and treat it as a limited branding improvement.
For an Argentina or Uruguay registration, obtain written confirmation of issuer validation and target mailbox acceptance before deciding whether another trademark filing is needed.
The cost question is business math, not only email authentication. If annual certificate spend is around US$1,000 to US$1,800 and the audience is small, self-asserted BIMI is worth considering where the target providers support it; it does not provide Gmail BIMI display. If the brand sends high-volume customer mail and the trademark path is clean, a VMC enables Gmail's verified checkmark on eligible messages. Complete the DMARC work first.
Frequently asked questions
No. You can publish a BIMI record without a VMC, but Gmail requires a VMC or CMC for BIMI logo display. A VMC is needed for the Gmail verified checkmark.
The current Mark Certificate Requirements recognize trademark offices listed by WIPO, and both countries have offices in that directory. Ask the issuer to verify the exact registration, ownership or license, good standing, and logo match before paying.
Usually, yes. Rough annual budgets are US$990-$1,500 for a CMC and US$1,350-$1,800 for a VMC, including advertised multi-year rates. Compare the actual quote and renewal terms. A CMC supports eligible Gmail logo display but does not provide the verified checkmark.
No. A self-signed certificate is not VMC or CMC evidence. It will not satisfy Gmail's certificate requirement for BIMI logo display.
BIMI requires full DMARC enforcement with p=quarantine or p=reject. RFC 9989 classifies pct as historic, so omit it from new records. If a legacy record retains pct, set it to 100; Google's BIMI documentation still uses pct=100. Do not use partial sampling or t=y test mode as the final enforcement state.
No. Enforce DMARC first, verify real sending sources, and confirm the logo and trademark qualify. Buying the certificate first creates avoidable renewal pressure.
