What are the requirements and alternatives for implementing BIMI with VMC certificates, especially regarding trademark jurisdiction and costs?
Updated on 2 Aug 2026: We updated this guide for RFC 9989, current Mark Certificate Requirements, CMC evidence paths, and certificate costs.
The short answer: you need a VMC if you want the strongest BIMI outcome, especially a verified Gmail checkmark and broad certificate-backed logo display. You do not need a VMC to publish a BIMI record, and you do not always need one to get some logo display. A CMC is the main paid alternative for Gmail logo display when a registered logo trademark is unavailable, provided the mark qualifies through prior use or another permitted CMC evidence path. Self-asserted BIMI can still work with mailbox providers that do not require a certificate.
Do not start by buying the certificate. First prove the domain is ready. DMARC must be at enforcement, and the logo must use the required SVG format. Its trademark or common mark evidence must match the logo you want displayed. If DMARC monitoring shows failed authentication across real sending sources, BIMI will be blocked regardless of the certificate cost.
Trademark jurisdiction still matters, but the current rule is broader than the old fixed-country lists. The Mark Certificate Requirements now define a Trademark Office as an intellectual property office listed by WIPO. Argentina and Uruguay both have national industrial property offices in that directory, so their registrations should not be dismissed solely because of jurisdiction. The issuer must still validate the registration, good standing, ownership or license, and logo match. Each mailbox provider separately decides whether to accept that issuer's certificate.
The direct answer
For BIMI with a VMC, the requirements cover the technical setup and legal validation, plus ongoing operations. The organizational domain must use DMARC at p=quarantine or p=reject at full enforcement, without sp=none. RFC 9989 classifies pct as historic, so omit it from new records. Legally, the logo normally needs to be a registered trademark in good standing with a WIPO-listed office. Operationally, you need issuer validation, a compliant SVG Tiny PS logo, a hosted PEM certificate file, and a BIMI TXT record.
- VMC: Best for brands with an accepted registered logo trademark that want the Gmail verified checkmark.
- CMC: Best when Gmail logo display matters and the mark qualifies through a current CMC evidence path.
- Self-asserted BIMI: Best when the budget is zero and limited mailbox provider coverage is acceptable.
- No BIMI: Best when DMARC is not stable, because logo work should wait until authentication is clean.
Do not confuse certificate types
A standard TLS certificate, self-signed certificate chain, or ordinary domain validation certificate is not a VMC or CMC. A Mark Certificate binds the validated logo and domain to the applying organization under the current certificate requirements. Gmail will not treat an ordinary web certificate as BIMI evidence.
Google Workspace Admin BIMI setup requirements with VMC or CMC certificate fields.
Requirements before buying a VMC
The VMC purchase should be the last step in the sequence. Get the domain, DNS, logo file, and reporting pipeline ready first. The BIMI Group describes the core VMC requirements: a registered trademark, an SVG Tiny PS logo, DMARC enforcement, and a BIMI DNS record. The issuer then verifies the organization, logo rights, domain control, certificate request, and the designated applicant.
|
|
|
|---|---|---|
DMARC | Enforced | BIMI prerequisite |
Policy | Full enforcement | No partial rollout |
Logo | SVG Tiny PS | Required format |
Trademark | WIPO-listed office | VMC validation |
Hosting | Stable HTTPS | Fetchable evidence |
Core BIMI and VMC readiness checks
DMARC policy that can qualify for BIMIDNS
_dmarc.example.com. 3600 IN TXT ( "v=DMARC1; p=quarantine; " "rua=mailto:dmarc-reports@example.com" )
RFC 9989 made the old pct sampling tag historic. New DMARC records should omit it. For BIMI, keep the policy at p=quarantine or p=reject and do not rely on partial policy sampling.
The public web server should support HTTPS with TLS 1.2 or later. For a certificate-backed setup, host the entity certificate and the complete intermediate and root chain in the PEM file. Keep the URL stable and accessible without authentication. Gmail also expects an SVG at least 96 by 96 pixels with absolute dimensions. The file should contain no scripts or external resources, and the logo should use a square composition.
Before changing records, run the domain through Suped's domain health checker and confirm SPF, DKIM, and DMARC are passing for real mail streams. BIMI depends on the actual message path, not only the existence of DNS records.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Trademark jurisdiction and cost realities
Current Mark Certificate Requirements do not use the old short country list. They define a Trademark Office as an intellectual property office recognized in WIPO's directory, and the former appendix for a short authorized-office list is intentionally blank. A registered mark must still be in good standing and verifiable in the official office database or the global trademark database named in the requirements.
For a company with a registration in Argentina or Uruguay, do not file in another jurisdiction solely because an old VMC list omitted the local office. First ask the issuer to confirm that it can verify the registration number, ownership or license, mark status, colors, and the SVG match. For word-only marks, read the word mark requirements before assuming a brand name registration will qualify the proposed logo.
Cost decision bands
Use these rough annual certificate planning ranges before adding trademark filing, legal work, SVG preparation, and implementation time.
Self-asserted BIMI
$0
No certificate fee, limited provider reach.
CMC
$1,000-$1,300
Prior-use or other CMC evidence path.
VMC
$1,300-$1,700
Registered-mark path with Gmail checkmark.
A practical planning figure is about $1,150 per year for a CMC and $1,500 per year for a VMC before multi-year discounts, based on current public pricing. Quotes vary by term, reseller, domain count, and validation scope. A new trademark filing can add filing fees, legal review, translations, logo revisions, and months of waiting.
Compare the full quote
- Certificate scope: Confirm the number of covered domains and whether each added domain changes the price.
- Validation work: Ask what identity, trademark, archive, or licensing evidence is included in the quote.
- Renewal terms: Compare annual and multi-year rates, revalidation steps, and early renewal timing.
Ask this before paying
- Jurisdiction: Can you validate this exact trademark office under the current requirements?
- Logo match: Does the registered or evidenced mark match the SVG that will be embedded?
- Mailbox reach: Which mailbox providers currently accept certificates from this issuer?
- Renewal: What evidence is rechecked if the mark, domain, or applicant changes?
How CMC eligibility works
A CMC is not an automatic trademark-free certificate. The current Mark Certificate Requirements allow three validation paths, and the issuer must still verify the organization, domain control, logo rights, applicant authority, and the submitted SVG.
- Prior use mark: The same logo must appear now and at least 12 months earlier on a website under a domain the applicant controls. The issuer verifies the earlier display through an approved web archive.
- Modified registered mark: A registered mark can support a CMC when the proposed logo uses a permitted change, such as rearranged words or a limited removal from the design. The allowed changes are specific, so pre-clear the SVG.
- Provisional mark: A proposed logo can differ from the underlying registered mark when that registration is at least three years old and the issuer completes the required ownership and registration checks.
CMC does not provide the Gmail checkmark
A CMC can support BIMI logo display in Gmail, but the verified checkmark is tied to a VMC. Mailbox providers decide whether to display any BIMI logo, so valid DNS and a valid certificate do not guarantee rendering for every message.
VMC, CMC, and certificate-free BIMI compared
The main alternatives are concrete. Choose VMC when the registered mark and verified checkmark justify the cost. Choose CMC when Gmail logo display matters and the logo meets an accepted CMC evidence path. Choose self-asserted BIMI when certificate cost is unjustified and limited support is acceptable. A deeper CMC versus VMC comparison helps when procurement needs the validation differences spelled out.
|
|
|
|
|
|---|---|---|---|---|
VMC | Required | $1,300-$1,700 | Gmail checkmark | More validation |
CMC | Not always | $1,000-$1,300 | Gmail logo | No checkmark |
Self-asserted | Not required | $0 | Limited logo | Sparse support |
No BIMI | Not needed | $0 | No logo | No BIMI result |
BIMI implementation paths
VMC path
- Best fit: Brands with registered logo trademarks that pass current issuer checks.
- Benefit: Gmail verified checkmark and broader certificate-backed recognition.
- Risk: Registry data or ownership evidence can stall validation. A logo mismatch can do the same.
CMC or self-asserted path
- Best fit: Brands with qualifying CMC evidence or a limited certificate budget.
- Benefit: Lower certificate cost or no certificate purchase.
- Risk: No Gmail checkmark and less predictable provider support.
The certificate-free option is legitimate, but support remains limited. Yahoo, Fastmail, and some other BIMI-supporting providers can display self-asserted logos, while Gmail requires a VMC or CMC for BIMI logo display. Display is always the receiving provider's decision and can depend on reputation. For more on that narrow path, use BIMI without a VMC as a follow-up.
Implementation sequence
This order avoids paying for a certificate before the domain can use it. The work centers on DNS and evidence collection. The logo file and public hosting need careful handling before issuer validation begins.
- Inventory: List every sender using the domain and fix SPF or DKIM failures before enforcing DMARC.
- Enforce: Move the organizational domain to quarantine or reject, with no partial policy sampling.
- Prepare: Convert the logo to SVG Tiny PS and keep it visually matched to the mark evidence.
- Validate: Ask the issuer to confirm the trademark office, evidence path, mailbox acceptance, and final price.
- Publish: Host the SVG for self-asserted BIMI or the complete PEM for a certificate-backed setup, then publish the BIMI TXT record.
- Monitor: Track authentication failures, BIMI fetch errors, certificate expiry, and policy drift.
BIMI certificate decision path from DMARC enforcement to VMC, CMC, or self-asserted BIMI.
BIMI record without a certificateDNS
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; " "l=https://assets.example.com/bimi.svg; " "a=" )
BIMI record with a VMC or CMC PEMDNS
default._bimi.example.com. 3600 IN TXT ( "v=BIMI1; " "l=; " "a=https://assets.example.com/bimi.pem" )
If you need to create the first DMARC record before working toward BIMI, use the DMARC record generator and stage the policy carefully. For BIMI, skip p=none as the final state. It is useful for learning, but it does not qualify for logo display.
Where Suped fits
Suped is our DMARC reporting and email authentication platform. For BIMI preparation, it helps identify sending sources and authentication failures before a team pays for a Mark Certificate or moves DMARC to enforcement.
Hosted DMARC configuration dialog showing policy controls, CNAME setup, and expanded advanced options
The practical Suped workflow is to inventory legitimate sources, investigate SPF or DKIM alignment failures, stage the DMARC policy, and watch for drift after enforcement. Automated issue detection and real-time alerts help surface changes that can interrupt BIMI eligibility. Hosted DMARC can also reduce coordination delays when DNS access is split across teams.
For teams that need to manage DMARC changes through a central workflow, Suped's Hosted DMARC supports policy staging while reporting and alerts track the effect on legitimate senders.
Views from the trenches
Best practices
Confirm the issuer can verify your WIPO-listed trademark office before paying the fee.
Move DMARC to quarantine or reject without partial sampling before publishing BIMI.
Keep dated website evidence ready when a 12-month prior-use CMC is the likely route.
Common pitfalls
Relying on an old jurisdiction list can trigger an unnecessary foreign trademark filing.
Buying a certificate before fixing DMARC leaves the logo invisible in strict mailboxes.
Using an ordinary TLS certificate in the BIMI record does not satisfy evidence checks.
Expert tips
Ask for current mailbox acceptance details before choosing the lowest quoted price.
Match the submitted SVG's layout and colors to the evidence the issuer will review.
Keep the PEM URL stable and track expiration because an expired certificate stops display.
Marketer from Email Geeks says low sending volume can make a $1,000 annual certificate hard to justify compared with self-asserted BIMI.
2024-08-02 - Email Geeks
Expert from Email Geeks says mailbox providers decide which certificates count, so self-signed chains and ordinary TLS certificates do not replace VMC or CMC validation.
2024-09-05 - Email Geeks
Practical decision
If the brand has a registered logo trademark that the issuer can validate and sends enough mail for inbox branding to matter, buy a VMC after DMARC is enforced. If the trademark is missing or the displayed logo differs from it, check the current CMC evidence paths. If certificate spend is hard to justify, publish self-asserted BIMI and treat it as a limited branding improvement.
For Argentina or Uruguay, do not assume that the registration is unsupported. The current requirements recognize trademark offices listed by WIPO, and both countries have national industrial property offices in that directory. Ask the issuer for written confirmation that it can verify the specific registration and that the target mailbox providers accept its certificate. Refile elsewhere only if a concrete validation or business need justifies it.
The cost question is business math, not only email authentication. If annual certificate spend is around $1,000 to $1,500 and the audience is small, self-asserted BIMI can be the sensible stopping point. If the brand sends high-volume customer mail and the trademark path is clean, a VMC provides the Gmail checkmark. Complete the DMARC work first.
