BIMI CMC Certificate in 2026: Cost, Rules and Setup

BIMI lets your brand logo appear next to your emails in Gmail, Yahoo, and Apple Mail, before the recipient even opens the message. The standard has existed since 2021, but a significant cost barrier limited adoption: displaying a logo in Gmail required a Verified Mark Certificate (VMC) that costs $1,000-$1,500 per year and requires active trademark registration.

In 2025, Google changed this. The launch of the Common Mark Certificate (CMC) removes the trademark requirement. Any brand that has used a logo for at least one year can now get a CMC and display their logo in Gmail, at a fraction of the cost and complexity.

How BIMI Works

BIMI is a DNS-based standard. When your email arrives in a supporting inbox, the receiving server checks your DNS for a BIMI record, retrieves your logo file from the specified URL, verifies the certificate, and displays your logo in the inbox view.

The result: recipients see your brand logo next to your sender name and subject line before opening. For brand-recognized senders (retail, media, SaaS products with visual identity), this is a meaningful visibility advantage at the moment of inbox scanning.

The Three Components You Need

1. DMARC at Enforcement

BIMI requires DMARC at p=quarantine or p=reject. Monitoring mode (p=none) is not sufficient.

This is the hardest requirement for many senders because moving to DMARC enforcement means messages that fail DMARC authentication may be quarantined or rejected by receivers. You must verify that all legitimate email streams pass DMARC alignment before enforcing:

• Your primary ESP (Klaviyo, Mailchimp, etc.)
• Transactional email providers (SendGrid, Postmark, etc.)
• Marketing automation platforms
• CRM tools that send email on your behalf
• Any third party that uses your domain in the From address

DMARC Monitoring from InboxEagle checks your DMARC policy record every 24 hours and alerts you when it changes, so a policy change never goes unnoticed. To see which sending sources pass or fail, you need DMARC aggregate reports, which InboxEagle’s separate DMARC Processing product handles.

2. An SVG Logo File

BIMI requires your logo in SVG Tiny PS format, a specific SVG profile with restrictions on fonts, gradients, and effects. Standard SVGs from design tools don’t automatically comply. A few technical notes:

• Your logo must be square (1:1 aspect ratio)
• The SVG must use the correct SVG Tiny PS profile
• The file must be hosted at a publicly accessible HTTPS URL
• Complex effects (drop shadows, gradients on gradients) may not render correctly in all clients

Most graphic designers familiar with email standards can produce a compliant BIMI SVG. You can validate your SVG file using BIMI Group tools to ensure compliance before you publish the DNS record.

3. A Certificate (VMC or CMC)

This is where 2025’s change matters. A BIMI CMC certificate is the type Google accepts without a trademark, and a BIMI certificate cost comparison starts with that difference. VMC is sometimes searched as visual mark certificate, but the correct name is Verified Mark Certificate.

BIMI certificate cost: VMC vs CMC

Common Mark Certificate cost is not fixed, so check DigiCert and Entrust for current rates. If you are looking for a cheap BIMI certificate, the CMC is the lower-cost option for Gmail, and Yahoo needs no certificate at all.

Verified Mark Certificate (VMC): Traditional Option

• Requires active trademark registration in the country of use
• Costs $1,000–$1,500/year from DigiCert or Entrust
• Provides the highest level of verification (trademark ownership confirmed)
• Required for BIMI display in Gmail (before CMC was available)
• Still accepted by all providers

Common Mark Certificate (CMC): Google’s 2025 Option

• Requires one year of documented logo use, no trademark registration needed
• Lower cost than VMC (pricing varies by provider, check DigiCert and Entrust for current rates)
• Accepted by Gmail for BIMI logo display
• Broader accessibility for smaller brands and startups
• Not yet universally accepted: Yahoo currently recommends but doesn’t require any certificate

Yahoo’s Approach Yahoo displays BIMI logos without requiring a certificate at all. The DMARC enforcement and valid logo file are sufficient. A VMC enhances the display but isn’t mandatory for Yahoo BIMI.

Who Supports BIMI

Outlook does not currently support BIMI. Given that Microsoft processes hundreds of millions of mailboxes, this limits BIMI’s overall reach, but Gmail + Yahoo already covers a majority of consumer inboxes for most B2C senders.

The Business Case for Implementing BIMI

Open Rate Lift

A 2021 consumer study by Red Sift and Entrust found open rates up to 39% higher when a brand logo was displayed with the message. Treat that as directional, not a current industry average: it’s one study, from the early days of BIMI, and more recent third-party data at that precision is hard to find. The mechanism is straightforward regardless: a recognizable logo in the inbox view increases the chance a subscriber identifies and opens your email. For brands with strong visual recognition (retail, consumer apps, media brands), this is a meaningful performance gain per campaign.

First-Mover Advantage

BIMI adoption remains low. A scan of 5.5 million domains in February 2026 found just 0.4% (20,518 domains) had published a BIMI record, and even among that small group, over a quarter had a broken or invalid logo file. Most of your competitors’ emails show a generic initial avatar next to their sender name in Gmail, no logo. The ecosystem is growing quickly though: BIMI certificate issuance was on pace for roughly 9,079 new certificates in 2026, up about 24% from 2025. Low current adoption plus fast growth means implementing BIMI now still gives you a differentiated inbox presence, with a shrinking window before it becomes table stakes.

Trust Signal

The certificate (VMC or CMC) confirms to Gmail that your logo is verified. This provides an additional trust signal to recipients, particularly for brands in financial services, healthcare, or other sectors where impersonation is a concern.

What the Implementation Process Looks Like

Here’s the typical sequence for implementing BIMI with a CMC:

1. Confirm DMARC enforcement: Get to p=quarantine or p=reject with zero legitimate mail failing. A DMARC checker confirms your policy level and flags any legitimate source still failing before you move to enforcement
2. Create a compliant SVG logo: Convert your logo to SVG Tiny PS format and validate it
3. Host the SVG at a public HTTPS URL: Your web server, CDN, or your ESP’s asset hosting
4. Obtain a CMC (or VMC if you have trademark registration): Work with a BIMI certificate provider
5. Publish the BIMI DNS record:

   default._bimi.yourdomain.com TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://your-certificate-url"

6. Verify using a BIMI lookup tool: Confirm the record resolves correctly and the certificate validates
7. Test in Gmail: Send to a Gmail address and verify the logo appears in the inbox

The process takes 1–4 weeks depending on how quickly you can get the SVG compliance handled and the certificate issued.

Is BIMI Worth It?

Yes, if:

• Your brand has strong visual recognition that benefits from logo visibility
• You send to a list with significant Gmail and Yahoo penetration
• You already have DMARC at enforcement (or are close)
• You have the design resources to create a compliant SVG logo

Wait, if:

• You’re still at DMARC p=none: implement enforcement first; BIMI requires it
• Your brand logo isn’t distinctive enough to meaningfully drive opens
• Your list is primarily B2B with heavy Outlook penetration (Outlook doesn’t support BIMI)

Start with the foundation first. BIMI is a visible signal, but it doesn’t affect spam filtering or inbox placement. If you have deliverability problems, fix authentication, complaint rate, and list hygiene before pursuing BIMI. A logo in the inbox doesn’t help if the email is in spam.

The Bottom Line

BIMI is a visibility feature, not a deliverability fix. It gives subscribers a reason to trust the logo they see in their inbox, but only if your email is already reaching that inbox.

• DMARC enforcement (p=quarantine or p=reject) is required. BIMI cannot be implemented at p=none; fix authentication first
• CMC made BIMI accessible without trademark. Google’s 2025 Common Mark Certificate requires only one year of logo use; no IP registration needed
• Gmail and Yahoo cover most B2C consumer inboxes. Outlook’s lack of BIMI support matters more for B2B lists
• 0.4% domain adoption means first-mover advantage still exists. Your competitors likely show a generic initial avatar where you’d show a verified logo, though certificate issuance is growing about 24% year over year
• The up-to-39% open rate lift is directional, not a guarantee. It comes from one 2021 study, and results vary by brand recognition and list ISP distribution

Next Steps

To get started with BIMI after reading this:

1. Check your DMARC status at DMARC Record Generator. If you’re at p=none, make a plan to move to enforcement
2. Review your DMARC aggregate reports to see which of your sending sources are passing DMARC alignment before you enforce, and use DMARC Monitoring to get alerted when your policy record changes
3. Research CMC providers if you don’t have trademark registration. The 2025 launch makes this significantly more accessible
4. Once you’re at enforcement, implement BIMI as a competitive advantage in Gmail and Yahoo inboxes

Related reading:

• SPF, DKIM, and DMARC Explained: The Authentication Trinity
• The Complete Email Deliverability Guide for 2026
• Google Postmaster Tools v2: The Complete Setup and Interpretation Guide