What DMARC policy do I need for BIMI?

Enforcement, on both the organisational domain and the sending From domain: p=quarantine or p=reject, with the precise conditions the BIMI specification states — a quarantine policy must not carry pct below 100, the subdomain policy sp must not be none, and messages themselves must pass DMARC with alignment. The BIMI Group's own guide says the same in plainer words: 'None' policies or pct less than 100 percent are not accepted. A monitoring (p=none) domain — where most small businesses correctly spend their first months — does not qualify; the climb to enforcement is the real prerequisite project.

Do I need a trademark for BIMI?

For Gmail's verified display, you need a mark certificate: a VMC requires a registered trademark; the newer CMC covers marks without registration but requires a logo with at least 12 months of public use (per DigiCert, an issuing CA) — and Google accepts the CMC for logo display without the blue checkmark, which remains VMC-only. Combined with Google's stated 6–12-month trademark timeline, a business with a brand-new logo is structurally excluded from Gmail display for roughly its first year, whichever certificate path it takes. Requirements differ by receiver: Yahoo documents no certificate requirement but demands bulk volume with sufficient reputation and engagement; Fastmail displays self-asserted logos with no certificate; Microsoft does not display BIMI logos as a receiver at all.

How much does a VMC or CMC cost?

Buy only from the certificate authorities' own current pages — and read them carefully. DigiCert's pricing material is internally inconsistent: it lists a VMC at '$124/month' alongside a 'subscription $1,752.00' (124 times 12 is 1,488), and a CMC at '$125/month' alongside '$1,416.00' — the CMC shown as more per month yet less in total. This guide quotes both figures rather than cleaning them into a single price; confirm the actual total at checkout. Also note Entrust, recommended by older guides, sold its public certificate business including Verified Mark certificates to Sectigo — Entrust pointers are stale.

BIMI · Inbox logos

BIMI: the logo beside your email — after two gates, not one DNS record

First published 20 October 2026 · Gate conditions quoted from the BIMI specification draft and the BIMI Group; receiver rules from Google, Yahoo, Apple and Fastmail's own documentation; certificate facts from the issuing CAs. Where a source contradicts itself, this guide quotes it twice rather than once — see the pricing box.

Run the gate checker before buying anything.

Is your DMARC at p=quarantine (100%) or p=reject — organisational and sending domains? No → BIMI is later; the rollout is now.
Is sp anything but none, and does your mail pass DMARC with alignment? No → fix policy first.
For Gmail: do you hold a registered trademark (→ VMC) or a logo with 12+ months of public use (→ CMC)? Neither → Gmail display is ~a year away whatever you do; Yahoo/Fastmail may still be open (table below).

Most readers honestly stop at gate 1 or 3 today. That is a useful result, not a failed one — it tells you the order of your next projects.

The record and the logo file

TXT · Name: default._bimi · Value shape

v=BIMI1; l=https://yourdomain/logo.svg; a=https://…/certificate.pem

Selectors exist (<selector>._bimi) for different brands/streams; default is the standard one.
With a certificate, the certificate's PEM file itself embeds the logo; Google's certified route uses an empty l= with the cert at a= — Google states the standalone-SVG route is not supported in Gmail.
The SVG is a strict profile (SVG Tiny PS): square, a <title> naming your organisation, no scripts, no external references, no animation. Google adds: at least 96×96 px absolute dimensions; ≤32 KB is a recommendation. Fastmail's bar is tighter — under 16 KB — so build to 16 KB and satisfy everyone.
Display timing: Google says the logo may take up to ~48 hours to appear after everything validates.

Receiver reality — the table the hype skips

Receiver	What it takes (their documentation)
Gmail	Gate + certificate mandatory: VMC or CMC. Checkmark: VMC only. No cert, no display — the strictest house.
Yahoo	Four conditions in Yahoo's words: valid BIMI record/SVG, DMARC quarantine/reject, bulk mail, and “sufficient reputation and engagement.” No certificate mentioned — and no thresholds published, so a low-volume sender may qualify on paper and never display. Receiver discretion, honestly labelled.
Apple Mail	BIMI supported (iOS 16+/macOS Ventura 13+/iCloud.com); Apple's text requires evidence documents (“VMCs and other forms of BIMI Evidence Documents”) and — unusually — requires both sender and receiving provider to qualify. Whether Apple accepts the CMC is not stated by Apple; treat Apple+CMC as unconfirmed. (Apple's separate Branded Mail in Business Connect is NOT BIMI: a raster logo upload + a “Mail Verified” badge, iOS 18.2+ — a parallel program some businesses will prefer.)
Fastmail	Self-asserted works: publish record + compliant SVG (<16 KB); a VMC is an optional step in its own sender guide. The friendliest receiver — a good first proof.
Microsoft (Outlook.com)	No receiver-side BIMI display — Microsoft supports BIMI for senders only (per Microsoft's own Q&A). Your logo project buys nothing in Outlook inboxes; plan expectations accordingly.

The mark-evidence ladder (and the two clocks)

Evidence	Requirement	Unlocks
VMC	Registered trademark for the logo, verified by the CA	Gmail logo with checkmark; the broadest acceptance
CMC	Logo with ≥12 months of public use (DigiCert's stated requirement) — no registration needed	Gmail logo, no checkmark (Google's own announcement, Sept 2024)
Self-asserted	Just the record + SVG	Fastmail; partial elsewhere — never Gmail

The two clocks: trademark registration runs ~6–12 months (Google's stated range); the CMC's prior-use requirement is 12 months. Both clocks start from things you do outside this guide (file the mark; use the logo publicly and keep evidence). A business launching today should start one clock now and treat BIMI as next year's project — which is also exactly how long the DMARC climb in gate 1 deserves.

Costs — quoted, not cleaned. DigiCert's own pricing currently shows a VMC at “$124/month” and a “subscription $1,752.00” (which doesn't equal 124×12), and a CMC at “$125/month” and “$1,416.00” — the CMC printed costlier monthly and cheaper overall. We print both figures because both are DigiCert's; your checkout total is the only arbiter. And update your bookmarks: Entrust exited this business (its public-certificate arm, VMCs included, went to Sectigo) — every older guide pointing you to Entrust is stale.

The setup ladder (once the gates pass)

DMARC enforcement confirmed by lookup (gate checker above) — including sp.
Build the SVG to Tiny PS, ≤16 KB, square, titled; validate it (the BIMI Group publishes guidance/validators).
Obtain the certificate (VMC or CMC) from a current issuer; host the PEM over HTTPS.
Publish default._bimi with the certified shape (empty l=, cert at a=) — or self-asserted shape where you're targeting self-asserted receivers first.
Verify with lookups + a real send to Fastmail/Gmail test inboxes; allow Google's ~48 h.
Re-verify after any DMARC change — dropping back below enforcement quietly revokes the logo everywhere.

FAQ

My logo shows in Fastmail but not Gmail. Broken?

No — that's the receiver table working as documented. Fastmail accepts self-asserted; Gmail requires a certificate. The fix is evidence (VMC/CMC), not DNS.

We're at p=quarantine but pct=50 during rollout. Close enough?

The spec's exact asymmetry: quarantine with pct<100 is not accepted (reject tolerates partial percentages in the draft's text — don't build a plan on that wrinkle; go to 100%). Finish the climb, then BIMI.

Is the checkmark worth the trademark?

Only your brand strategy can price a blue check. What this guide can say: logo-without-check (CMC) covers the visual goal at Gmail for marks with a year of use; the checkmark is a trust garnish, not extra deliverability.

Sources

BIMI specification draft (gate conditions, record format, SVG profile) & BIMI Group guidance · Google — Set up BIMI + its Sept 2024 CMC announcement (certificate rules, checkmark, SVG sizing, 48 h) · Yahoo sender FAQ (four display conditions) · Apple — BIMI/evidence-document support pages · Fastmail sender guide (self-asserted, 16 KB) · DigiCert — VMC/CMC product & pricing pages (12-month prior use; pricing as printed) · Sectigo/Entrust transaction reporting.

Verification note: gate text and receiver conditions were confirmed from primary sources on 20 October 2026. Apple's CMC acceptance and Microsoft's position (Q&A-tier sourcing) are flagged as unconfirmed/lower-tier rather than stated flatly; CA pricing is quoted verbatim because the source contradicts itself.

Did this guide work for you?

Your reaction tells us whether this guide solved the problem it promised to solve.