Inbox Theory
BlogKnowledge Base

© 2026 Inbox Theory

Made with ❤️ in Aachen

Blog›Protocols›BIMI Explained: Is the VMC Investment Worth It for B2B Senders?
ProtocolsAuthentication

BIMI Explained: Is the VMC Investment Worth It for B2B Senders?

David·August 22, 2023·8 min read
Hero Image
Hero Image

BIMI displays your logo in supporting inboxes. The VMC certificate costs $1,500/year. Whether the brand recognition lift justifies the spend honestly assessed.

TL;DR

BIMI (Brand Indicators for Message Identification) displays your brand logo next to messages in supporting inboxes primarily Gmail, Yahoo, Apple Mail, and Fastmail. To use it, you need DMARC at p=quarantine or p=reject, an SVG logo formatted to BIMI's spec, and (for Gmail and Apple Mail) a Verified Mark Certificate (VMC) costing roughly $1,500 per year. For B2C brands at scale, the brand recognition and trust signals justify the cost. For B2B senders, the math is more complicated: most B2B mail goes to Microsoft 365 environments where BIMI is not displayed, the volume per recipient is lower, and the brand-recognition value is harder to measure. The honest answer for B2B: BIMI is not a deliverability lever, it is a brand presentation choice, and most B2B senders are spending the money on something better. Common Mark Certificates (CMCs) introduced in 2023 lower the entry cost but do not change the underlying calculus.

What BIMI Actually Does

BIMI is a standard for displaying brand logos alongside email messages in compatible inboxes. When a recipient opens their inbox, supported clients show your brand's logo where the default sender avatar would otherwise appear a small visual cue that the message is from a verified sender.

The mechanism: you publish a TXT record at default._bimi.yourbrand.com pointing to two things:

  1. An SVG logo file hosted on your domain
  2. A Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) that cryptographically proves the logo belongs to your brand

Receiving inboxes that support BIMI fetch both, validate the certificate against the published trust chain, and display the logo if everything checks out.

The end result is visible only in the inbox UI. There is no deliverability impact in the technical sense mail does not deliver better because BIMI is configured. The benefit is recognition: recipients see your logo, associate it with verified sender identity, and (in theory) trust the message more.

That trust effect is what BIMI is selling. Whether it is worth the cost depends on whether trust effects translate to engagement and revenue for your specific sender profile.

What You Need to Implement BIMI

Three prerequisites, in order of difficulty:

1. DMARC at Enforcement

BIMI is built on DMARC. The receiver only displays your logo if your DMARC policy is at p=quarantine or p=reject. p=none does not qualify the receiver interprets p=none as "this domain is not protecting itself against spoofing" and refuses to display the logo.

For senders who have not yet completed the DMARC rollout, this is the gating prerequisite. There is no path to BIMI that skips DMARC enforcement.

For senders already at p=quarantine or p=reject, this requirement is satisfied. Move to step 2.

2. A Properly Formatted SVG Logo

BIMI requires SVG Tiny PS (Portrait/Square), a profile of SVG with restrictions designed to prevent abuse and ensure consistent rendering. The constraints:

  • Square aspect ratio (1:1)
  • No external references (no fonts, scripts, or linked images)
  • Limited element types
  • File size under 32KB
  • Background color either transparent or specified explicitly

Most logo files do not meet these requirements out of the box. Existing brand SVGs typically use rectangular aspect ratios, embedded fonts, or linked elements. The conversion to BIMI-compliant SVG is usually a small project—a designer or an automated tool can produce the BIMI version in an hour or two.

Hosting requirement: the SVG must be served from your domain over HTTPS, with proper MIME type (image/svg+xml). Most CDN setups handle this trivially.

3. A Verified Mark Certificate (VMC) or Common Mark Certificate (CMC)

This is where the cost lives. The certificate cryptographically proves to receiving inboxes that the logo belongs to your brand.

VMC (Verified Mark Certificate):

  • Requires the logo to be a registered trademark
  • Issued by a small set of certificate authorities (Entrust, DigiCert)
  • Costs approximately $1,300-1,800 per year
  • Required for Gmail and Apple Mail BIMI display

CMC (Common Mark Certificate):

  • Introduced in 2023 to lower the entry barrier
  • Does not require a registered trademark accepts brand-style marks like logos used commercially
  • Lower cost, around $300-500 per year
  • Supported initially by some receivers; broader adoption growing
  • As of late 2023, Gmail does not display CMC-backed BIMI; Yahoo and others have begun to

The VMC is the established path. The CMC is the cost-effective path for brands without registered trademarks, but adoption-side coverage is incomplete.

Where BIMI Displays

The list of inbox clients that show BIMI logos has grown but remains limited. As of October 2023:

Confirmed display:

  • Gmail (web, mobile apps; requires VMC)
  • Yahoo Mail (VMC or CMC)
  • Apple Mail (iOS 16+, macOS Ventura+; requires VMC)
  • Fastmail
  • Some smaller providers (La Poste, Onet)

No display:

  • Microsoft Outlook (Outlook.com, Microsoft 365)
  • Most corporate gateways
  • Older mobile clients
  • Anyone running their own mail client that has not implemented BIMI

The single most important absence on this list: Microsoft. Outlook.com, Office 365, and most Microsoft mail clients do not display BIMI logos. For B2B senders whose audience skews toward Microsoft 365, BIMI investment produces no visible result for the majority of recipients.

This matters because the case for BIMI is mostly visual. If your audience does not see the logo, you are paying for a feature they do not experience.

The B2C Case for BIMI

For consumer brands sending high-volume marketing to a Gmail-Apple-Yahoo-heavy audience, the BIMI case is straightforward:

1. Brand recognition. Inbox lists are visually noisy. A recognizable logo next to your messages makes them stand out especially in mobile inboxes where attention spans are short and visual cues drive open decisions.

2. Implicit trust signal. A displayed logo, validated against a VMC, communicates "this sender has gone through the process to verify their identity." For consumers who have learned to be suspicious of email, this is a meaningful credibility marker.

3. Engagement lift studies. Various BIMI-promoting case studies report open-rate lifts of 5-30% from BIMI implementation. The methodology varies, the controls are usually weak, and the effect sizes should be discounted but a real positive effect is plausible even if smaller than reported.

4. Cost is small relative to brand spend. $1,500/year is rounding error for any brand spending meaningfully on email marketing. The decision is whether the engagement uplift justifies the time to implement, not whether the certificate fee is affordable.

For consumer brands at scale, BIMI is usually a yes. The audience is in the right inboxes, the brand spend justifies the certificate, and the visual presence in mobile inboxes is genuinely valuable.

The B2B Case Is Weaker

For B2B senders, the calculation looks different:

1. Audience inbox distribution. B2B mail typically goes to Microsoft 365 mailboxes (60-80% in many B2B segments). Gmail share is smaller, and Apple Mail share is negligible. BIMI does not display in the inboxes where most B2B mail lands.

2. Lower per-recipient volume. A B2B sender might send 5-10 messages per recipient per year. The recognition compounding that benefits B2C senders (consumers seeing the logo across multiple campaigns weekly) does not apply when contact frequency is low.

3. Engagement drivers differ. B2B opens are driven primarily by sender name (a recognized vendor or contact) and subject line. The visual logo is competing with established cues name and subject that already drive most decisions.

4. Trust signals matter less in expected mail. A B2B recipient receiving a follow-up from a sales rep they met at a conference is not making a trust decision based on the logo display. They know the sender; the message was expected.

5. Implementation cost is the same regardless of audience size. A small B2B sender pays the same $1,500/year as a global consumer brand, with proportionally smaller audience exposure.

The case is not zero for B2B some categories (B2B SaaS marketing, partner enablement, channel marketing) have engagement profiles closer to B2C and benefit accordingly. But the default answer for typical B2B senders is "the money is better spent elsewhere."

What "Better Spent Elsewhere" Looks Like for B2B

Common alternative investments that produce more measurable B2B deliverability or engagement returns:

1. List hygiene infrastructure. Engagement-based suppression, validation tooling, automated re-engagement workflows.

2. DMARC monitoring tooling. A subscription to Dmarcian, OnDMARC, or EasyDMARC for ongoing aggregate report parsing produces more deliverability value per dollar than BIMI for senders who have not yet automated DMARC review.

3. Subdomain architecture. Subdomain separation is operational discipline, not a recurring fee, but the implementation effort produces protection that BIMI cannot.

4. Microsoft 365-specific testing. Inbox placement testing tools that include Microsoft 365 corporate environments cost $200-500/month and surface deliverability issues in the inbox where most B2B mail lands.

5. Send infrastructure improvements. Dedicated IPs, custom Return-Path on subdomains, proper DKIM signing these establish the authentication foundation that BIMI requires anyway, and they improve deliverability whether or not BIMI is ever implemented.

For B2B senders not yet running these basics, BIMI is premature. For B2B senders who already have all of this in place and are looking for the next investment, BIMI is plausible but the ROI is harder to demonstrate than the alternatives.

Implementation, If You Are Going to Do It

For senders who decide BIMI is worth pursuing, the implementation sequence:

Week 1-2: Confirm prerequisites

  • Verify DMARC is at p=quarantine or p=reject for the sending domain
  • Verify alignment is correct
  • Verify SPF, DKIM, and DMARC pass rates in Postmaster Tools are clean

Week 3-4: Prepare the logo

  • Create or commission a BIMI-compliant SVG (square aspect ratio, no external references, under 32KB)
  • Host the SVG on your domain over HTTPS
  • Verify the SVG renders correctly when fetched directly

Week 5-8: Acquire the certificate

  • Engage with a VMC or CMC issuing CA (Entrust, DigiCert)
  • Provide trademark documentation (VMC) or brand-use evidence (CMC)
  • Receive the certificate after verification (typically 2-4 weeks)
  • Host the PEM-format certificate on your domain

Week 9: Publish the BIMI record

  • Add a TXT record at default._bimi.yourbrand.com:
text
v=BIMI1; l=https://yourbrand.com/bimi-logo.svg; a=https://yourbrand.com/bimi-cert.pem
  • Verify with a BIMI checker (Mark That Mark, BIMIRadar)
  • Send a test message to a Gmail or Yahoo address; confirm logo display

The mechanical steps are straightforward. The certificate acquisition is the longest pole in the timeline plan for 4-8 weeks from start to first logo display.

Frequently Asked Questions

Does BIMI improve deliverability?
No, not directly. BIMI does not affect inbox placement decisions. It affects what the recipient sees once the message is in the inbox. The deliverability benefits are downstream—if logo display drives engagement, engagement signals improve reputation, reputation improves placement.
Can I publish BIMI without a VMC?
You can publish the DNS record without a VMC, but Gmail and Apple Mail will not display your logo. Yahoo and some others may accept the BIMI record without the VMC, but the support is uneven. As of 2023, the VMC (or CMC where supported) is effectively required for meaningful BIMI display.
What about CMCs should I use one instead of a VMC?
CMCs are cheaper and accept brand marks without trademark registration. The tradeoff is reduced inbox-side support. As of late 2023, Gmail still requires VMCs for display; Yahoo and others increasingly accept CMCs. If your priority audience is Gmail, the VMC is necessary.
Can I use BIMI with a subdomain?
Yes. The BIMI record goes at default._bimi.subdomain.yourbrand.com, and the DMARC enforcement requirement applies to that subdomain. The certificate must be valid for that subdomain (or wildcard).
What if my logo changes?
Update the SVG, update the certificate (new logo means new certificate signing process), update the BIMI record. The total effort is similar to the original implementation. Logos do not change frequently for most brands; for those that rebrand, the BIMI re-issuance is part of the rebrand cost.
Does BIMI work if recipients have logo display disabled?
Some clients let users disable sender avatars. In those cases, BIMI logos do not display. The BIMI record is still published; it just is not surfaced to that user. This is rare in default configurations.
Are there security implications to publishing a BIMI record?
Minimal. The certificate cryptographically binds the logo to your domain; spoofers cannot use your logo without a valid certificate. The BIMI infrastructure was designed with abuse resistance in mind.

Key Takeaways

  • BIMI displays your brand logo next to messages in supporting inboxes (Gmail, Yahoo, Apple Mail, Fastmail). Microsoft does not display BIMI as of late 2023.
  • Three prerequisites: DMARC at enforcement, BIMI-compliant SVG logo, and a VMC ($1,500/year) or CMC ($300-500/year, more limited support).
  • For B2C brands at scale, BIMI is usually worth the investment. The visual recognition in mobile inboxes is genuinely valuable.
  • For B2B senders, the math is weaker. Most B2B mail goes to Microsoft 365 where BIMI does not display, and per-recipient volume is too low to compound visual recognition effects.
  • BIMI is not a deliverability lever. It does not affect inbox placement. The benefits are presentation-layer, not infrastructure.
  • B2B senders evaluating BIMI should first confirm they have list hygiene, subdomain architecture, DMARC monitoring, and Microsoft 365 inbox testing in place. BIMI is the last investment in the deliverability stack, not the first.
  • Implementation timeline is 6-9 weeks, dominated by certificate acquisition.

BIMI is the most-marketed feature in deliverability for the past three years. The marketing emphasis exceeds the technical impact. Implement it if you are a consumer brand at scale and have everything else dialed in. Skip it otherwise. The certificate fee is small, but the opportunity cost of implementing BIMI before the foundation is in place is real.

Reactions
ShareLinkedIn
← Previous articleWhy Your Transactional Emails Are Landing in Spam (And Mixing Them with Marketing Is the Reason)
Next article →The ARC Header: How Forwarding Breaks DMARC and What You Can Do

Related articles

Hero Image
ProtocolsProtocolsInfrastructure

Why DMARC Alignment Matters More Than DMARC Itself

DMARC fails when SPF or DKIM pass for the wrong domain. The alignment rules, relaxed vs strict modes, and the ESP configuration that fixes it.

Apr 23, 2024
Hero Image
ProtocolsStrategySecurity

DKIM Key Rotation: A Practical Guide for Production Environments

How to rotate DKIM keys in production without breaking signatures. Dual-selector strategy, 2048-bit key sizes, and the rotation cadence that actually works.

Mar 21, 2024
Yahoo and Gmail's February 2024 Bulk Sender Requirements: A Compliance Checklist
AuthenticationDeliverability

Yahoo and Gmail's February 2024 Bulk Sender Requirements: A Compliance Checklist

The complete compliance checklist for Yahoo and Gmail's February 2024 bulk sender requirements. Authentication, unsubscribe, complaint rates—what you actually need.

Jan 19, 2024

Contents

  1. What BIMI Actually Does
  2. What You Need to Implement BIMI
  3. 1. DMARC at Enforcement
  4. 2. A Properly Formatted SVG Logo
  5. 3. A Verified Mark Certificate (VMC) or Common Mark Certificate (CMC)
  6. Where BIMI Displays
  7. The B2C Case for BIMI
  8. The B2B Case Is Weaker
  9. What "Better Spent Elsewhere" Looks Like for B2B
  10. Implementation, If You Are Going to Do It
  11. Frequently Asked Questions
  12. Key Takeaways