> BIMI email authentication puts your logo in the inbox, but only after DMARC enforcement and a certificate. See who actually needs it, and how to set it up right. *Source : https://10centmail.com/bimi-email-authentication/* --- Land in the inbox — not the spam folder. [EN](https://10centmail.com/bimi-email-authentication/)[FR](https://10centmail.com/fr/bimi-email-authentication/) [Home](https://10centmail.com/)/Deliverability/BIMI Email Authentication: Is It Worth the VMC? Deliverability # BIMI Email Authentication: Is It Worth the VMC? August 21, 2026 · 10centmail editorial ![A brand logo displayed next to the sender name in an inbox, illustrating BIMI email authentication](https://images.unsplash.com/photo-1596526131083-e8c633c948d2?w=1200) A mid-market SaaS team spent three months chasing a blue logo in the inbox. They commissioned a vector redesign, bought a certificate, and published the DNS record, expecting a jump in open rates. Nothing moved. The logo appeared, opens stayed flat, and support tickets asking "is this email real?" kept arriving. Their mistake was treating BIMI email authentication as a growth lever instead of what it is: a trust badge you earn only after the authentication work is already done. ## BIMI at a glance: three paths, one shared gate Before any setup steps, it helps to see the whole landscape on one screen. BIMI (Brand Indicators for Message Identification) lets a supporting inbox show your logo next to your name. There are three ways to get there, and they differ mostly in whether a certificate is involved and whether a registered trademark is required. Path Certificate Trademark needed Shows in Gmail / Apple Mail Typical fit Self-asserted None No No (only a few smaller providers) Testing, non-major inboxes Common Mark Certificate (CMC) CMC No (uses prior-use or public marks) Yes Brands without a registered trademark Verified Mark Certificate (VMC) VMC Yes (registered) Yes Established brands with a filed trademark The table hides one thing every path shares: the DMARC gate. No certificate, no matter how expensive, will display your logo in a major inbox while your domain still authenticates weakly. That is the single most common reason BIMI projects stall, and it is worth understanding before you spend a cent on a certificate or a designer. ## The prerequisite nobody can skip: DMARC at enforcement DMARC enforcement gates BIMI: no inbox displays your logo while your policy sits at `p=none`. That policy tells receivers to monitor but take no action on messages that fail alignment, which is exactly the posture BIMI is designed to reward against. To qualify, your published DMARC record needs a policy of `p=quarantine` or `p=reject`, backed by SPF and DKIM that align with the visible From domain. That requirement is a feature, not an obstacle. It means BIMI can only appear for domains that have already closed the door on casual spoofing. If you are still mapping your legitimate senders and reading aggregate reports, that groundwork is the real project, and our walkthrough on [configuring SPF, DKIM and DMARC together](https://10centmail.com/email-authentication-spf-dkim-dmarc/) covers the sequence in order. Rushing to enforcement without that inventory risks silently dropping your own transactional mail, which does far more damage than a missing logo. The safe path to enforcement runs through the DMARC aggregate reports (the XML files receivers send back when you set a `rua` address). Read a few weeks of them before you tighten the policy: they list every source sending under your domain, which lets you spot the forgotten CRM, the invoicing tool, or the legacy server that would otherwise fail alignment the moment you move off `p=none`. Only once that list is clean and every legitimate stream aligns should you step the policy up, first to `quarantine`, then to `reject` if the failure rate stays near zero. There is a second, quieter prerequisite: reputation. A logo next to a domain that lands in spam simply advertises the problem to more people. If your placement is shaky, fix the fundamentals first, because inbox providers weigh [the sending reputation attached to your domain](https://10centmail.com/sender-reputation/) long before they decide whether to render a brand indicator. BIMI rewards senders who are already trusted; it does not create trust from nothing. ## The logo and the certificate: what setup actually involves Once enforcement is stable, the mechanical part is short but unforgiving about format. The steps below are the ones that trip teams up most often. 1. **Prepare the logo.** BIMI requires the SVG Tiny Portable/Secure (SVG Tiny PS) profile, not a generic SVG export. The artwork must be square, centered, and use a solid background rather than transparency. 2. **Host it over HTTPS.** The file has to sit on a URL your DNS record can point to, served with a valid certificate and no redirects that break the fetch. 3. **Obtain a certificate (if you want major inboxes).** A Verified Mark Certificate requires a registered trademark, verified by an authorized certificate authority before issuance. A Common Mark Certificate is the newer route for brands whose mark is not registered but has documented prior use. 4. **Publish the BIMI DNS record.** Add a TXT record at `default._bimi.yourdomain.com` referencing the logo URL and, where used, the certificate URL. 5. **Validate and wait.** Confirm the record parses, then allow inboxes time to fetch and cache the assets on their own schedule. Budget for the ongoing side, not just the launch. A VMC is a paid, renewable certificate tied to a live trademark, so the cost recurs and lapses if the mark or the certificate expires. For the authoritative field-by-field spec, the [official BIMI Group documentation](https://bimigroup.org/) is the neutral reference maintained by the standard's working group, and it stays current as inbox support shifts. Keep the logo asset itself under version control too, because a broken or moved SVG will quietly remove your indicator without any error surfaced to you. If you are still choosing tooling, some [email platforms that streamline authentication setup](https://10centmail.com/best-email-marketing-software/) will host the record and validate the chain for you, which removes a class of manual DNS mistakes. ## Who should invest, and who should wait BIMI displays your logo; it does not raise inbox placement or open rates on its own. That reframing decides the whole business case. Treat it as a brand-trust and anti-impersonation layer, not a deliverability tactic, and the right choice usually becomes obvious. - **Invest in a VMC now** if you are a high-volume, recognizable consumer or B2B brand, you already sit at `p=quarantine` or `p=reject`, and you hold a registered trademark. The impersonation risk is real and the logo reinforces recognition at scale. - **Consider a CMC** if your placement and DMARC are solid but you have no registered trademark. It gets you into major inboxes without the trademark hurdle, at a lower barrier than a VMC. - **Start self-asserted or wait** if you send low volume, serve a niche audience, or cannot yet justify a recurring certificate. You lose the major inboxes but keep the option open for later. - **Fix authentication first** if you are still at `p=none`, unsure which systems send on your behalf, or fighting spam-folder placement. BIMI is the wrong line item until that is resolved. One caveat for smaller senders: a certificate does nothing for messages that never reach the inbox. If your recent campaigns are being filtered, the money is far better spent diagnosing [why legitimate emails land in spam](https://10centmail.com/why-emails-go-to-spam/) and repairing the underlying signals. The logo is a reward for solving that problem, never a substitute for solving it. ## Where BIMI fits in your authentication roadmap BIMI is the last mile of email authentication, not the first. Sequenced correctly, it sits after SPF and DKIM alignment, after DMARC has moved to enforcement, and after your reputation is stable enough that the logo confirms trust rather than exposing its absence. Teams that respect that order get a clean visual payoff; teams that jump the queue get a certificate invoice and no visible change. The calculus is also shifting. The Common Mark Certificate has lowered the barrier for brands without a registered trademark, and inbox support for brand indicators has widened rather than narrowed. That makes BIMI worth revisiting on a schedule: run the enforcement work now because it protects your mail regardless, then reassess the certificate decision once your DMARC policy has held steady for a quarter. When the foundation is solid, adding your logo is a small, deliberate final step, and it finally does the one job it was built for. ## Get the inbox playbook. Join our newsletter for practical email marketing & deliverability tips. No spam — we'd be embarrassed.