BIMI and VMC: Secure Your Brand Logo in the Inbox 2026

What BIMI Achieves in the Inbox

BIMI is an open standard that tells email providers which logo they may display next to authenticated messages from a domain. Display only happens when the message passes email authentication - so the logo becomes visible proof that a message actually originates from the claimed domain. For recipients, this lowers the bar for spotting phishing: if a supposed brand email lacks the familiar logo, that is a warning sign perceptible without technical knowledge.

The need is real. According to the Verizon 2025 Data Breach Investigations Report, phishing was the initial access vector in 16% of all data breaches, and 60% of all security incidents involved a human element - usually a fraudulent email (Verizon 2025 DBIR). At the top of the damage scale sits Business Email Compromise (BEC): in 2024 alone this fraud caused 2.77 billion US dollars in reported losses, with a median loss of around 50,000 US dollars per incident (FBI IC3). BIMI does not eliminate this threat, but it moves detection to a place recipients perceive directly: the inbox itself.

The Four Building Blocks of the BIMI Chain

BIMI in the inbox is the result of four building blocks that all have to be correct at once. If one fails, no logo appears - regardless of how carefully the other three are implemented. This dependency is why BIMI is best viewed as a connected chain rather than a single measure.

The order of dependency matters: DMARC is the prerequisite without which nothing else counts. Only then follow the record, the logo, and the certificate. Once you understand this chain, it becomes clear why a seemingly harmless change in one place - such as briefly resetting the DMARC policy during troubleshooting - makes the logo disappear across the entire inbox.

VMC or CMC: Which Certificate Do You Need

The Verified Mark Certificate (VMC) is the original and most widely supported option. It is issued by authorized Mark Verifying Authorities and requires a registered trademark (BIMI Group) - in Germany, for example, with the German Patent and Trade Mark Office (DPMA) or as an EU trademark with the EUIPO (EUIPO). A VMC is a paid certificate that has to be renewed yearly and that verifies, alongside the trademark, both domain control and the organization.

The Common Mark Certificate (CMC) was introduced by Google in early 2025 as an alternative. It does not require a registered trademark but instead proof that the logo has already been used publicly under the domain over a longer period (Google). This opens BIMI to organizations without trademark protection - though with narrower provider support than the VMC for now. Of roughly 33,924 valid BIMI records in mid-2024, only about 3,450 included a link to a VMC (DMARC.org); the large majority therefore remained without a logo in Gmail and Apple Mail.

DMARC Enforcement: The Hard Prerequisite

BIMI is ineffective without enforced DMARC. The standard explicitly requires a policy at enforcement level - p=quarantine or p=reject on the organizational domain (BIMI Group). A domain that remains at p=none receives no logo, even if the record, logo, and certificate are flawlessly configured. This makes DMARC enforcement the bottleneck where most BIMI initiatives first get stuck.

The technical foundation is at least as widespread as ever. In the first quarter of 2026, the global DMARC pass rate stood at 88.99%, the DKIM pass rate at 90.90%, and the SPF pass rate at 80.24% (Cloudflare Radar). This was driven partly by the requirements of large providers: since 2024, Google and Yahoo have required bulk senders of more than 5,000 emails per day to have a DMARC record (Google/Yahoo). Germany's BSI recommends SPF, DKIM, and DMARC anyway as baseline measures against spoofing and phishing (BSI).

The path from p=none to at least p=quarantine succeeds only on the basis of a sound analysis of the feedback. How to read these aggregate reports and progress in controlled stages to full enforcement is described in the post on analyzing DMARC reports systematically. Only when the reports show all legitimate sending sources as authenticated is the enforcement stage stable - and BIMI can build on it.

The SVG Logo and the BIMI Record

Once DMARC and the certificate are in place, the last few meters decide the display: the DNS record and the logo itself. The BIMI record is a single TXT entry that points to both - the logo and the certificate. Both URLs must be permanently and reliably reachable over HTTPS (BIMI Group).

default._bimi.your-domain.com.  TXT  "v=BIMI1;
  l=https://your-domain.com/bimi/logo.svg;
  a=https://your-domain.com/bimi/vmc.pem"

# v = BIMI version
# l = HTTPS URL to the SVG Tiny P/S logo (square)
# a = HTTPS URL to the VMC or CMC certificate (PEM format)

The logo must be in the restrictive SVG Tiny Portable/Secure profile (BIMI Group): square aspect ratio, a title element with the brand name, no external references, no scripts. An SVG exported from a graphics program almost never meets this profile and has to be cleaned up deliberately. The most common errors that prevent display despite the right intent follow a clear pattern:

• Wrong SVG profile: script tags, embedded raster images, or a non-square viewBox turn a valid SVG into a logo that is invalid for BIMI.
• Unreachable URL: if the web server that delivers the logo or certificate goes down, the logo disappears - even though DMARC and the record are intact.
• Expired certificate: a VMC or CMC is time-limited; if it expires and is not renewed in time, the logo display ends.
• Record typo: a misconfigured l= or a= tag, or a missing entry under default._bimi, is enough for nothing to appear at all.

That these details often fail in practice is reflected in the low adoption. A Validity analysis of 13,000 domains found that 90.85% had published no BIMI record at all (Validity). Overall, the number of BIMI records grew from around 10,000 at the end of 2021 to almost 35,000 by mid-2024 (DMARC.org) - but measured against the total number of domains, adoption remains under one percent (DMARC.org). Between a published record and an actually displayed logo, then, there is still a noticeable implementation hurdle.

Provider Support: Gmail, Apple Mail, and Yahoo

How a logo is displayed and which certificate is required for it differs considerably by inbox. Anyone planning reach has to know each provider's requirements.

Apple Mail has displayed BIMI logos since iOS 16, iPadOS 16, and macOS Ventura 13 (Apple Developer). Display requires that the provider verifies a checked BIMI evidence document - in practice a VMC - and has set the corresponding headers (Apple Developer). For organizations this means concretely: anyone who wants the logo to appear on iPhones and Macs as well cannot, as of May 2026, avoid a VMC; a CMC alone is not sufficient for Apple Mail at present. Gmail, by contrast, has accepted both certificate types since 2025 (Google).

BIMI rewards senders who meet a high authentication requirement and demonstrate control over their brand logo.

— BIMI Group, specification summary

Why BIMI Is a Monitoring Topic

The decisive point for ongoing operation: a BIMI chain set up once does not stay intact on its own. Each of the four links can break unnoticed - and because the logo then simply no longer appears, there is no loud error signal, only a silent disappearance. It is precisely this inconspicuousness that makes BIMI a monitoring topic.

That is why the BIMI chain belongs under the same continuous observation as SSL certificates or DNS entries. XICTRAQ Brand Protection checks the BIMI record, the enforcement status of DMARC, and the validity of the stored certificate - and raises an alarm before the logo drops out of the inbox. Combined with DNS and domain monitoring and notifications across all relevant channels, this creates continuous monitoring of the sending channel that makes individual silent failures visible.

BIMI as Part of Brand and Domain Security

BIMI secures recognizability in the inbox - but brand abuse often begins earlier, elsewhere in the digital infrastructure. A resilient protection concept views the domain as a whole and interlocks email authentication with the monitoring of certificates, DNS, and domain ownership.

• Certificate Transparency: through monitoring CT logs you detect unauthorized certificates issued for your domain that are abused for deceptively real phishing pages.
• Look-alike domains: typo and homoglyph variants of your brand are registered deliberately; watching for lookalike domains makes such registrations visible early.
• DNS integrity: anyone who manipulates your DNS entries can also rewrite the BIMI and DMARC record - detecting DNS hijacking in time protects the basis of the chain.
• Domain ownership: a domain that expires by accident opens the door to spoofing; preventing domain expiration is part of basic hygiene.
• Deliverability: if a mail server IP lands on a blocklist, delivery suffers regardless of BIMI - blacklist monitoring of mail server IPs covers that side.

Email security is also not an isolated topic. Attackers who imitate a brand via phishing frequently target the website at the same time - for example through manipulated scripts or unpatched vulnerabilities. Anyone who considers the full attack surface includes client-side security under PCI DSS 4.0.1 and the current web risks of the OWASP Top 10 2025. Only the interplay of email authentication, domain monitoring, and application security produces a sound picture.

Keeping the Brand Logo in the Inbox for Good

BIMI turns clean email authentication into a visible trust signal - but only as long as the whole chain holds. A VMC or CMC certifies the logo, DMARC at enforcement level is the entry ticket, and the DNS record and SVG logo are the last few meters into the inbox. Because each of these building blocks can fail unnoticed and the logo then quietly disappears, BIMI is not a project with an end date but a steady state that needs observation.

Treat the BIMI record, the DMARC policy, and the certificate status like any other critical operational element - monitored, with clear alarms and a responsible owner. Then the brand logo stays where it belongs: as a reliable mark of authenticity in your recipients' inbox, and not as a display that quietly falls silent after the next server migration or certificate expiry.

Frequently Asked Questions About BIMI and VMC