BIMI for Ecommerce: VMC vs CMC and Is It Worth It?

BIMI is the one piece of email authentication marketers actually want, because you can see it. It puts your logo in the circle next to your sender name, where most brands currently show a grey initial. It’s also the most over-sold. It won’t fix a spam folder problem, and most of the work isn’t the logo. It’s getting your DMARC policy to enforcement first.

Here’s what BIMI requires, the real difference between VMC and CMC certificates, where your logo will and won’t show up, and our honest view on whether a DTC brand should bother.

---

What is BIMI?

BIMI (Brand Indicators for Message Identification) is an email standard that displays your brand’s logo next to your emails in supporting inboxes such as Gmail, Apple Mail and Yahoo. It only works when your domain passes SPF and DKIM with DMARC enforced at quarantine or reject, and most major providers also require a mark certificate proving you own the logo.

It’s a reward for good authentication, not a replacement for it. Inbox providers show the logo because they can be confident the email really came from you.

---

BIMI requirements

These are drawn from the BIMI Group sender FAQ and Google’s own BIMI setup documentation, checked September 2026.

1. SPF and DKIM passing and aligned with your From domain. With Klaviyo, that means a branded sending domain. See our DMARC, SPF and DKIM guide.
2. DMARC at enforcement. The BIMI Group defines this as p=quarantine or p=reject, and explicitly not p=none or pct below 100. Google’s documentation says the same: policy must be quarantine or reject, and pct must be 100.
3. A logo in SVG Tiny PS format. A square SVG with no scripts, external resources or embedded raster images. Google specifies baseProfile="tiny-ps" and version="1.2". Your designer’s normal SVG export won’t be compliant; it needs converting.
4. A mark certificate (VMC or CMC) for Gmail and Apple Mail. More on these below.
5. A BIMI DNS record at default._bimi.yourdomain.com:

v=BIMI1; l=https://yourbrand.com/bimi/logo.svg; a=https://yourbrand.com/bimi/cert.pem

l= points to your SVG logo and a= to your certificate file. Both must be served over HTTPS.

6. Reputation. Even with everything in place, providers can decline to show your logo if your sending reputation is weak. The BIMI Group says so plainly.

---

VMC vs CMC: which certificate do you need?

A mark certificate is how an inbox provider knows the logo is yours and not a lookalike. There are two types.

	Verified Mark Certificate (VMC)	Common Mark Certificate (CMC)
Logo requirement	Registered trademark (or government mark)	No registration needed; proof of prior public use
Prior use evidence	Not the basis for validation	Sectigo specifies at least 12 months of public use on your domain
Gmail	Logo plus blue verified checkmark	Logo, no checkmark
Apple Mail	Supported	Apple’s documentation refers to VMCs; don’t count on CMC display
Yahoo	Supported	Supported
Speed and cost	Slower (trademark verification)	Usually faster and cheaper
Issuers	DigiCert, GlobalSign, SSL.com (BIMI Group list), Sectigo	Same issuers

Sources: Google Workspace BIMI setup guide, Apple Support “About BIMI support in Apple Mail”, Sectigo “CMC vs VMC certificates” (August 2025), BIMI Group mark certificate issuer list. Checked September 2026.

The practical rule: if your logo is a registered trademark in a jurisdiction your certificate authority accepts, get a VMC. It’s the only route to Gmail’s checkmark and dependable Apple Mail display. If it isn’t registered yet, a CMC gets your logo showing in Gmail in the meantime. Start the trademark application in parallel.

A note for Australian brands: check with your certificate authority which trademark offices it accepts before you pay. An IP Australia registration is a common question, and the answer depends on the CA’s current policy.

What does a BIMI certificate cost?

Each certificate authority sets its own pricing, sold as annual subscriptions per domain. As of September 2026, DigiCert’s mark certificate page showed a 12-month auto-renewing subscription at US$1,416 (prices subject to change). Compare quotes from the BIMI Group’s listed issuers and from Sectigo before you commit, and remember the certificate is usually the smallest cost. The DMARC work and logo conversion take more time.

---

Which inboxes show BIMI logos?

The BIMI Group lists Apple, AU (KDDI), Fastmail, Gmail, La Poste, Yahoo and Zone as supporting providers. Two notable points:

• Yahoo can display a self-asserted logo (no certificate) if you have enforced DMARC, a valid SVG, bulk volume and a good reputation.
• Outlook.com doesn’t appear on the BIMI Group’s list of supporting providers, so a large Microsoft audience won’t see your logo.

For most DTC brands, Gmail and Apple Mail are the audiences that matter, and both reward a VMC. Check your own mix before you buy: a quick segment by email domain in Klaviyo shows how much of your list is on Gmail.

---

Does BIMI improve deliverability?

Not directly. No provider says BIMI is a ranking signal for inbox placement, and a logo won’t rescue an email that’s going to spam for engagement reasons. (For that, see how to avoid the spam folder in Klaviyo.)

What BIMI does do:

• Makes you recognisable in the inbox list and the Promotions tab, where every other sender is fighting for the same glance.
• Signals legitimacy. A checkmark next to your name is a visible anti-phishing cue for customers.
• Forces DMARC enforcement. This is the underrated part. Getting to p=reject means nobody else can send “your order is delayed, click here” emails as your domain. That protection is worth having with or without the logo.

Treat any claimed open-rate lift from BIMI with caution. The published figures mostly come from vendors that sell BIMI services, and Apple Mail Privacy Protection has made open rates a weak measure anyway.

---

Should a DTC brand bother?

Our honest view:

Do it if:

• Your logo is a registered trademark (or you’re happy with a CMC for Gmail while registration completes).
• Your DMARC is already at, or close to, p=reject.
• You send weekly or more to a list that’s heavy on Gmail and Apple Mail.
• You’re in a category that gets spoofed or impersonated: supplements, beauty, anything with a subscription or a cult following.

Wait if:

• You’re still on Klaviyo’s shared sending domain. Fix that first.
• Your DMARC is at p=none and nobody has looked at the reports. Enforcing blind can block your own order confirmations.
• Your spam rate or engagement is weak. The logo won’t show reliably anyway, and the money is better spent on list hygiene.

---

How to set up BIMI, step by step

1. Get authentication right. Branded sending domain in Klaviyo, SPF and DKIM aligned, DMARC reports reviewed.
2. Move DMARC to enforcement. p=quarantine then p=reject, with pct=100 when you’re done phasing.
3. Convert your logo to SVG Tiny PS. Square, centred, and legible at small sizes. The BIMI Group suggests checking it at 20 to 40 pixels.
4. Buy a VMC or CMC from an approved issuer and complete validation.
5. Host the SVG and certificate on HTTPS URLs on your domain.
6. Publish the BIMI record at default._bimi.yourdomain.com.
7. Check it. Our deliverability checker looks up your BIMI record alongside SPF, DKIM and DMARC. Then send to a Gmail address and look for the logo. It can take a little while to appear.

---

The short version

BIMI is a nice-to-have that sits on top of must-haves. If your authentication is solid and your logo is trademarked, an annual certificate fee is a reasonable price for a visible trust signal in the inbox. If your authentication isn’t solid, the work BIMI forces you to do is worth more than the logo itself.

If you’d like help getting to DMARC enforcement and BIMI without breaking anything that sends as your brand, that’s part of our email deliverability service. Or start with a free Klaviyo audit.