The short answer is: yes, for all practical purposes, a Verified Mark Certificate (VMC) is required for BIMI to display your logo in most major email clients. While it's technically possible to set up a BIMI record without one, its effectiveness will be severely limited.
This is a common point of confusion. Brand Indicators for Message Identification (BIMI) is an open standard, and in its purest form, it doesn't strictly mandate a VMC. This is what's known as a "self-asserted" BIMI record. However, the reality is that the mailbox providers who support BIMI, like Google and Apple, have chosen to require a VMC to ensure the logo displayed is authentic and trustworthy.
So, while you can publish a BIMI record pointing to your logo without a VMC, it likely won't appear in the inboxes you're targeting.
What is a VMC and why is it required?
A Verified Mark Certificate, or VMC, is a digital certificate that proves your organization is the legal owner of a specific logo. Think of it like an SSL certificate for your website, but for your brand's logo instead. It's issued by a trusted Certificate Authority (CA) after a rigorous verification process.
The primary reason major mailbox providers like Gmail require a VMC is to prevent abuse. Without a verification step, bad actors could easily impersonate trusted brands by simply using their logos. The VMC acts as a security check, ensuring that only the legitimate owner of a trademarked logo can have it displayed in the inbox through BIMI.
The process and prerequisites for a VMC
Getting a VMC isn't as simple as just uploading a logo file. There are several key requirements you must meet first:
- DMARC enforcement: Your domain must have a DMARC policy of p=quarantine or p=reject. A policy of p=none is not sufficient.
- Trademarked logo: Your logo must be actively registered as a trademark with a recognized intellectual property office. This is a non-negotiable step in the verification process.
- Specific logo format: The logo file itself must be in a specific format, SVG Tiny 1.2, and meet other technical requirements set by the BIMI standard.
So, is a VMC worth it?
In my opinion, absolutely. While it's true you can have BIMI without a VMC, you won't get the primary benefit: displaying your logo in the world's most popular inboxes. If you're going through the effort of implementing DMARC at an enforcement policy, which is a prerequisite for BIMI anyway, taking the next step to secure a VMC is what makes the entire system work as intended.
To summarize, while BIMI can technically exist without a VMC, the support from major mailbox providers makes the VMC a mandatory component for any organization that wants to successfully display its logo and build brand trust directly in the email client.
