BIMI in 2026: Verified Logos, Common Mark Certificates and Brand Trust in the Inbox

BIMI in 2026 is the clearest example of a security feature that doubles as a branding feature. Brand Indicators for Message Identification lets a sender display a verified logo beside authenticated email in supporting inboxes. In Gmail, a sender with a Verified Mark Certificate also gets a checkmark. The mechanism sounds like marketing, but its entry ticket is security: you cannot use it without enforced DMARC. That makes BIMI a useful lens on the state of email authentication, on who is investing in it, and on how mailbox providers are using visual trust signals. This analysis separates what the standards and Google's documentation say from what vendors claim about the results.

How BIMI works

BIMI rests on three layers. The first is authentication: the message must pass SPF or DKIM and DMARC. The second is a published logo, a specific kind of SVG file, referenced from a DNS TXT record. The third, where the provider requires it, is a certificate proving that the logo belongs to the sender. When a receiving provider that supports BIMI sees an authenticated message from a domain with a valid record, it can display the logo in place of a generic avatar.

The certificate layer comes in two types:

The CMC matters because trademark registration is slow and costly, and many small and mid-sized senders are unlikely to hold the right registration. A CMC broadens who can take part, though the evidence on how much value it brings compared with a VMC is thin.

What Gmail requires

Google's setup documentation lists the following requirements, and they are more demanding than the idea of "adding a logo" suggests:

• DMARC at enforcement. The policy must be quarantine or reject, and pct must be 100. Google states that BIMI does not support a DMARC policy of none.
• SPF or DKIM set up first, with DMARC authenticating messages.
• A particular SVG profile. The logo must be SVG Tiny PS, with baseProfile="tiny-ps" and version 1.2, at least 96 by 96 pixels in absolute units, with no scripts, animations or external references. Google recommends a square, a solid background and a file of 32 KB or less.
• A certificate from a third-party certificate authority: a VMC (recommended) or a CMC.
• A PEM file that bundles the logo and the certificate chain, hosted over HTTPS, and referenced in the BIMI TXT record.
• Patience. Logos can take up to 48 hours to appear after the record is added.

Our own BIMI setup guide walks through the records step by step. The point for this analysis is the first item: the gate is enforced DMARC.

The gate is the story: BIMI and the enforcement gap

In our analysis of DMARC adoption in 2026, EasyDMARC's data showed 52.1% of the top 1.8 million domains with a valid record but only 22.9% at quarantine or reject. Palisade's separate scan found enforcement at 64.0% among publishers in its smaller, more popular sample. Both studies agree on the shape: most domains with DMARC do not enforce it.

BIMI is therefore addressable to only a minority of domains today. A marketing team that wants the logo has a clear reason to ask the security team to finish the move to enforcement. That is an unusual alignment of incentives. DMARC projects often stall because the benefit is invisible: spoofed mail that never arrives. A logo in a customer's inbox is visible, and that visibility can unlock budget and attention for the unglamorous work of inventorying senders and fixing alignment.

What is claimed, and what is evidenced

Vendors report impressive effects. A Red Sift guide published in December 2025 and updated in September 2026 states that BIMI delivers a 90% increase in consumer confidence and that customers report 4 to 6% higher open rates, an 80% increase in click-through rates and a 44% boost in brand recall. It also cites a telecoms customer reporting 4 to 6% better engagement. The page gives no underlying studies, and Red Sift sells DMARC and BIMI services. These figures may be right, but they are unverified, and open rate is itself an unreliable metric after Apple's privacy changes, as we explain in our post on the end of the open rate.

The honest position is that a verified logo and checkmark are a plausible trust signal, that independent, controlled measurements of their effect are scarce, and that any business case should rest on a test of your own: compare a BIMI-enabled stream with a matched one and measure replies, conversions and complaints, not opens.

Where support stands

Gmail, Yahoo and Apple Mail are named as supporting BIMI in vendor and provider documentation, with Gmail showing the checkmark for VMC senders. Support differs by provider and by certificate type, and it changes. For example, the Google documentation notes that non-Gmail web apps do not support the checkmark feature. Before investing, check the current behaviour of the providers that matter for your audience, and test with real accounts.

Why mailbox providers like visual signals

Providers face a design problem. They run on authentication data that ordinary users cannot see, such as headers and alignment results. A logo and a checkmark translate machine-checked facts into something a person can read at a glance. That suits a world in which AI-written phishing is cheap and polished. Industry summaries report that a large majority of phishing messages now use AI in some form (we examine those figures in our post on AI phishing and authentication), which erodes the old cue of clumsy writing. A cryptographically backed logo is a harder cue to fake.

There is a limit. A checkmark can only show that a domain owner has proven a link between a logo and a domain. It does not show that the message content is honest. Lookalike domains remain a problem, and a fraudster can authenticate their own domain with a plausible name. Visual signals reduce some risks; they do not replace user caution.

Costs and trade-offs

We do not quote prices because certificate authority pricing varies and we have not verified current rates. The categories of cost are:

1. The certificate itself, renewed periodically.
2. Trademark work for a VMC, which can dominate the cost and timeline.
3. Design work to produce an SVG Tiny PS logo that renders well at small sizes.
4. Engineering time to finish DMARC enforcement, which is the largest hidden item and the one with the most security value.
5. Ongoing maintenance: renewing certificates, updating the logo when branding changes and keeping DNS records correct.

Three scenarios to 2028

1. Niche status symbol. BIMI stays mostly with large consumer brands that can afford a VMC. Mid-market senders skip it. The logo helps those brands and little changes for the rest of the market.

2. CMC-driven broadening. Cheaper certificates and easier tooling bring in mid-sized senders, and mailbox providers show logos more widely. DMARC enforcement rises as a by-product. This is the best outcome for the ecosystem and depends on providers extending support for CMC-verified marks.

3. Superseded by something else. Providers could develop their own verification and display schemes. This is speculation, and we have seen no announcement of one. BIMI would remain an input but not the visible product. Enforced DMARC would still be the lasting value.

In all three, the work that pays off regardless is the same: authenticate every legitimate sender and enforce DMARC.

A practical checklist

1. Confirm DMARC at quarantine or reject with pct=100 on the sending domain, and verify that all legitimate sources align.
2. Decide whether you hold a registered mark (VMC) or need a CMC.
3. Have the logo converted to SVG Tiny PS and validated.
4. Obtain the certificate, build the PEM file and host it over HTTPS.
5. Publish the BIMI record and wait up to 48 hours.
6. Test with real Gmail, Yahoo and Apple Mail accounts, and measure outcomes beyond opens.

Bottom line

BIMI is worth considering for the reason it is hard to get: it requires enforced DMARC. Even if the logo does little for engagement, the work it prompts protects your domain from spoofing and your recipients from fraud. If the logo does help, as vendors claim, that is a bonus that you should confirm with your own test.

Sources

• Google Workspace Admin Help: Set up BIMI
• BIMI Group: Announcing Common Mark Certificates (26 September 2024)
• Red Sift: BIMI in 2026, verified logos, CMCs and the fastest path to inbox display (vendor; performance figures are unverified claims)
• EasyDMARC: 2026 DMARC Adoption and Enforcement Report
• Palisade: The State of DMARC 2026