What are the requirements and alternatives for implementing BIMI with VMC certificates, especially regarding trademark jurisdiction and costs?

Key findings

• VMC necessity: A Verified Mark Certificate is required for your BIMI logo to appear in major email clients such as Gmail and Apple Mail (iCloud).
• Trademark jurisdiction: Your logo must be a registered trademark in one of the approved jurisdictions. Most Latin American countries are not accepted, with Brazil being a notable exception. This can create a barrier for companies in these regions.
• BIMI without VMC: It is possible to deploy BIMI without a VMC, but your logo will only display in a limited number of email clients, notably Yahoo Mail, Fastmail, and LaPoste.
• High cost: The annual cost for a VMC is substantial, typically around $1,000 USD, which can be prohibitive for smaller senders or those with limited email volume.
• DMARC enforcement: A strong DMARC policy (at p=quarantine or p=reject) is a foundational requirement for any BIMI implementation, whether with or without a VMC. You can learn more about DMARC setup for BIMI.

Key considerations

• Strategic trademark registration: Organizations with trademarks in unsupported regions might consider registering their logo in an accepted jurisdiction, especially those offering faster processing, to meet VMC requirements. For a comprehensive list, refer to accepted trademark jurisdictions for BIMI.
• Cost-benefit analysis: Weigh the marketing and branding benefits of displaying your logo in major inboxes against the significant annual VMC cost. For some, the expense may not justify the limited visibility gain, particularly if email volume is low. Consider BIMI pricing and approach.
• BIMI without VMC implementation: For organizations not ready to invest in a VMC, deploying BIMI without one can still offer brand recognition in supported clients, allowing for a phased implementation strategy.
• Provider choice: Currently, only a few Certificate Authorities (CAs) are authorized to issue VMCs, primarily DigiCert and Entrust. These are the main points of contact for questions about specific requirements or edge cases.
• Technical compliance: Beyond the VMC, ensure proper SPF and DKIM configuration and a compliant SVG logo file. These are prerequisites for any BIMI deployment, with or without a VMC.

Key opinions

• VMC cost vs. value: The high annual cost of a VMC ($1,000 USD) is a significant deterrent for marketers, especially those sending low volumes of email, as the cost per message can become disproportionately high.
• Partial BIMI deployment: Some marketers opt to deploy BIMI without a VMC, understanding that it will still function in certain email environments like Yahoo Mail, Fastmail, and LaPoste, even if not with Google or Apple Mail. You can find out more about setting up BIMI and VMC requirements.
• Trademark limitations: Marketers are often frustrated by the strict trademark jurisdiction requirements, which can exclude companies with established trademarks in regions not recognized by VMC issuers.
• ROI considerations: The perceived return on investment for VMC can be low for many, especially if their primary audience is not heavily concentrated on VMC-supporting platforms, or if the branding impact is deemed minimal given the cost. Consider the business value of implementing BIMI.

Key considerations

• Audience segmentation: Assess your target audience's email client usage. If a significant portion uses Google or Apple Mail, the VMC might be a worthwhile investment despite the cost. If not, a non-VMC BIMI implementation may suffice.
• Brand impact: Evaluate the importance of logo display in the inbox for your brand's recognition and trust. For highly visible brands, this might be a higher priority.
• Alternative brand visibility: Consider other methods to build brand trust and recognition if VMC is not feasible, such as strong sender reputation and consistent branding within email content. For more information, refer to BIMI without a Verified Mark Certificate.
• Budget allocation: Allocate budget for both the VMC and potential trademark registration in a supported jurisdiction if full BIMI implementation is desired.

Key opinions

• Conditional VMC requirement: While BIMI can technically be deployed without a VMC, experts confirm that a VMC is a hard requirement for logo display in key mail environments like Google and iCloud.
• Strict trademark adherence: Accepted trademark jurisdictions are very limited, and most Latin American countries (excluding Brazil) are not included, presenting a significant hurdle for companies in those regions. This is a core part of BIMI requirements and implementation steps.
• Limited VMC issuers: Currently, only a couple of CAs (DigiCert and Entrust) are authorized to issue VMCs, consolidating expertise and control over the process.
• BIMI without VMC functionality: Deploying BIMI without a VMC still enables logo display in providers like Yahoo, Fastmail, and LaPoste, highlighting a segmented approach to BIMI adoption.
• Cost is a barrier: The high cost of VMCs is universally acknowledged as a barrier to wider adoption, suggesting that BIMI with VMC remains a premium feature.

Key considerations

• Trademark strategy: If a company's primary trademark is in an unsupported jurisdiction, experts advise exploring if the logo is also trademarked in an accepted country, or consider registering it there. Germany is cited as an example for faster trademark registration options. This is a critical factor for BIMI implementation requirements and provider support.
• Consult VMC issuers: For complex or edge cases regarding VMC requirements, direct consultation with DigiCert or Entrust is recommended, as they are the authorities in certificate issuance. Further details on VMC technical setup are available from SSL2BUY's VMC technical guide.
• Self-signed certificate experiments: While not officially supported for VMC, some experts are curious about testing self-signed or non-approved certificates to observe how rigorously Mailbox Providers validate them, though this is not a recommended production strategy.
• Mailbox provider discretion: Ultimately, Mailbox Providers decide which certificates and BIMI implementations they will accept and display, meaning their policies dictate the effectiveness of any BIMI setup.

Key findings

• Mandatory DMARC enforcement: BIMI requires a DMARC policy set to 'quarantine' or 'reject' for the sending domain. This is a non-negotiable prerequisite for VMC issuance and effective BIMI. See our guide on DMARC record and policy examples.
• Trademarked logo: The logo intended for BIMI display must be a registered trademark with an intellectual property office recognized by the VMC Certificate Authorities.
• SVG file format: Logos must be in a specific Scalable Vector Graphics (SVG) Tiny Portable/Secure (SVG-PS) format, hosted at a secure (HTTPS) URL. Our article on BIMI requirements for SVG files provides more detail.
• Approved CAs: VMCs can only be issued by a limited number of Certificate Authorities, such as DigiCert and Entrust, which undergo a rigorous accreditation process.
• DNS publication: Once obtained, the BIMI record, including the VMC URL, must be published as a TXT record in the domain's DNS. You can use our BIMI Record Checker to validate your record.

Key considerations

• Validation process: The VMC application process involves extensive validation of the organization's identity, ownership of the domain, and the trademark itself, which can be time-consuming.
• Geographical limitations: Documentation explicitly lists accepted trademark offices. If a company's trademark is registered elsewhere, it will not qualify for a VMC, regardless of the trademark's validity in its own jurisdiction.
• DMARC policy alignment: Maintaining a strong DMARC policy is not just an initial setup requirement but an ongoing operational necessity for BIMI to function correctly. This impacts DMARC requirements for BIMI.
• Certificate renewal: VMCs are typically issued for one-year terms, requiring annual renewal and associated costs and re-validation.