BIMI setup: requirements, VMC/CMC costs, and whether it's worth it

BIMI shows your logo next to authenticated email — but only with DMARC at enforcement, and at the major inboxes only with a paid certificate. Requirements, costs, and setup.

Last updated: July 2026

In short: BIMI (Brand Indicators for Message Identification) shows your company logo next to authenticated email in the inbox. The catch: at the inboxes that matter (Gmail, Apple Mail, Yahoo) the logo appears only with a paid certificate (VMC or CMC), and BIMI strictly requires DMARC at enforcement. This page explains the requirements, the costs, and the setup — and who it's actually worth it for.

Unlike SPF, DKIM, or DMARC, BIMI setup is not provider-specific: you publish a single DNS TXT record regardless of whether your DNS is hosted at IONOS, Cloudflare, GoDaddy, or anywhere else. That's why this is one shared guide instead of twenty near-identical provider pages. Where exactly you add a TXT record is covered by your provider's SPF and DKIM guides.

What BIMI is — and isn't

BIMI is a display signal on top of strong authentication, not a delivery mechanism. It doesn't improve your inbox placement and doesn't filter spam — it can only show your logo when a message provably comes from you. And even then, each provider decides for itself:

Provider-specific policies determine if and when the logo shows.

Requirement 1: DMARC at enforcement

Nothing happens without an enforced DMARC policy. The BIMI Group is explicit:

DMARC policy MUST be at enforcement on the organizational domain and subdomains:

That means p=quarantine or p=reject — a monitoring-only policy (p=none) or a percentage less than 100 percent are not accepted. If your domain is still on p=none, that's the first (and biggest) step: work your way up to p=reject using your DMARC reports before you even consider BIMI.

Requirement 2: the certificate (the real catch)

This is where most people stop. The BIMI Group puts it this way:

At a minimum, BIMI requires DMARC alignment, and many providers also require a valid Certificate (VMC or CMC) proving rights to the logo.

Without a certificate you have a "self-asserted" BIMI record — and its reach is small:

Self-Asserted BIMI records have limited support across the various Mailbox Providers

In practice, Gmail and Apple Mail show your logo essentially only with a valid certificate. A certificate cryptographically proves your rights to the logo:

they cryptographically assert you have rights to the logo referenced by your record. Providers decide whether a Certificate is needed for display.

There are two types, both paid and issued by Mark Verifying Authorities:

VMC (Verified Mark Certificate): the certificates are based on registered trademarks of the logo/image — so you need a registered trademark. This is the most expensive and involved path (trademark registration plus an annual certificate fee).
CMC (Common Mark Certificate): CMCs are used in place of trademarked logos — no registered trademark required, but with narrower display support. Still a paid certificate.

VMCs and CMCs are being issued by the Mark Verifying Authorities (e.g. DigiCert, Entrust). They quote the exact prices directly; budget for an annual fee — plus, for a VMC, the cost and time of registering a trademark.

The logo: SVG Tiny PS

Produce an SVG Tiny PS version of your official logo — a normal SVG won't do; it must conform to the SVG Tiny PS profile and be reachable at a stable HTTPS URL.

Setup in four steps

Get DMARC to p=quarantine or p=reject (organizational domain and subdomains).
Create an SVG Tiny PS logo and host it at an HTTPS URL.
Optional, but effectively required for display at Gmail/Apple: obtain a VMC or CMC — the BIMI Group marks this step "highly recommended, but Optional": Acquire a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC) for Your Logo.
Publish the BIMI record — a TXT record at default._bimi.your-domain.com:

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem

The l= tag points to your logo, the a= tag to your certificate. Without a certificate you drop a= — a= tag is currently optional, but without it the major providers won't display the logo.

Is BIMI worth it for you?

An honest assessment:

Yes, if you already run DMARC at p=reject, have a registered trademark (or budget for a CMC), and value visible branding in the inbox — typically larger brands and newsletter senders.
Probably not, if you're not yet at DMARC enforcement or have no budget for an annual certificate. A self-asserted record with no certificate simply won't show at Gmail, Apple, or Yahoo — the effort is wasted.

By far the most valuable step for your deliverability isn't BIMI, it's clean SPF/DKIM/DMARC. BIMI is the cosmetic finishing touch on top — worth it only once the fundamentals are in place.

Verifying your setup

Whether your BIMI record is syntactically valid and whether DMARC meets the prerequisite takes seconds to check with the free Kuveris scanner.