VMC and CMC: what Gmail costs
Point a= at a valid CMC or VMC, the only thing Gmail accepts
The threat
Your logo is already rendering in Yahoo, AOL, and Apple Mail. In Gmail your recipients still see a flat circle with your first initial in it. Nothing bounces, nothing errors, no dashboard flags it. Gmail reads your default._bimidefault._bimiEmail authThe exact DNS name a BIMI record has to live at, written as default._bimi.yourdomain.com. Publish the same text anywhere else and email apps will never find it. record, finds no a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag or finds one it cannot fetch, and quietly declines. You will never be told.
That gap is the whole distance from BIMIBIMIEmail authBrand Indicators for Message Identification: a DNS record that tells email apps to show your logo beside your messages in the inbox. It only takes effect once DMARC is set to quarantine or reject, so the logo doubles as visible proof your email security is switched on. T3 to BIMI T4. Gmail is the only major receiver that refuses a self-asserted logo, and the mechanism is a certificate authority attesting that the mark is yours. An expired certificate or a dead PEM URL does the same thing in reverse: you drop back to the initial, usually for months before anyone notices.
The exact fix
Choose the certificate first, because this one costs real money.
CMCCMCTLS / PKICommon Mark Certificate: the cheaper certificate for businesses with no registered trademark, granted once the issuer confirms you have used the same logo publicly for at least twelve months. Apple Mail accepts it, Gmail still asks for the full trademark version. (Common Mark Certificate), roughly $650 to $1,150 a year. No trademark required. Your exact logo must have been in continuous public use for 12 months, and the issuing CA verifies that against a public web archive. Gmail renders your logo.
VMCVMCTLS / PKIVerified Mark Certificate: a paid certificate confirming that the logo in your BIMI record is your registered trademark. Gmail requires one before it will show your logo, and it is the only route to the verified badge. (Verified Mark Certificate), more expensive and slower, because it requires a registered trademark. Gmail renders your logo and adds the blue checkmark next to your sender name.
Buy from a BIMI issuing CA, host the returned PEM on your own site, then add the a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag alongside your existing l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo.:
| Field | Value |
|---|---|
| Type | TXT |
| Name | default._bimidefault._bimiEmail authThe exact DNS name a BIMI record has to live at, written as default._bimi.yourdomain.com. Publish the same text anywhere else and email apps will never find it. |
| Value | v=BIMI1; l=https://yourdomain.com/bimi/mark.svg; a=https://yourdomain.com/bimi/vmc.pem |
| TTL | 3600 |
Serve the PEM over HTTPS at that exact URL, returning 200 with no redirect hop and no authentication. The logo embedded in the certificate must match the SVG at l=l= tagBIMI tagThe part of a BIMI record holding the web address of your logo file. It must load over HTTPS straight from that address, because a redirect on the way there is enough to stop some email apps showing the logo. exactly, so re-issue the certificate any time the mark changes.
Now the honest part: most domains should stop at BIMI T3. Yahoo, AOL, and Apple Mail render a self-asserted logo for the price of a DNSDNSInfrastructureThe Domain Name System, the internet's address book. It's also where you publish the SPF, DKIM, DMARC and CAA records that secure your domain. record. If Gmail is not where your audience reads mail, a certificate buys you nothing you can measure. Spend the money on DMARC enforcement and DKIM coverage first, they are free and they are the actual gate.
Renewal is not automatic. These certificates run 12 months. On expiry Gmail drops you back to the initial with no notice to you at all, so put the expiry date in a calendar the day you buy it.
Verify it
dig +short TXT default._bimi.yourdomain.com | grep -o 'a=[^;]*'Expect exactly one line, a=https://yourdomain.com/bimi/vmc.pem. Empty output means there is no certificate in the record and Gmail is still showing the initial.
Proof
dev3lop.com sits at BIMI T3 today. default._bimidefault._bimiEmail authThe exact DNS name a BIMI record has to live at, written as default._bimi.yourdomain.com. Publish the same text anywhere else and email apps will never find it. publishes v=BIMI1;l=https://dev3lop.com/bimi/dev3lop-mark.svg, DMARCDMARCEmail authDomain-based Message Authentication: a DNS policy telling receivers what to do with mail that fails SPF or DKIM, and which emails you a report of everyone spoofing you. is p=quarantinep=quarantineDMARC policyDMARC policy that sends failing (likely spoofed) mail to the spam folder instead of the inbox. at pct=100pct=DMARC policyA DMARC setting that applies your policy to only a share of your mail while you test, for example nine messages in ten. Anything below 100 quietly disqualifies you from BIMI even though every DMARC checker still calls the record valid., and the mark returns 200 as image/svg+xml, 15,472 bytes, tiny-ps, 400 by 400, zero redirect hops. Posture is grade A at 100. There is no a=a= tagBIMI tagThe part of a BIMI record holding the web address of your certificate file. Leave it out and Gmail will not display your logo, because nothing proves the logo belongs to you. tag, so the logo is self-asserted: Yahoo, AOL and Apple Mail render it, Gmail withholds it. We dated our own mark’s first public archive appearance to 2026-05-04, which puts CMC eligibility in May 2027, so we cannot buy a certificate before then. apecyber.com is unrated, no MX, v=spf1 -all, p=rejectp=rejectDMARC policyThe strictest DMARC policy, mail that fails authentication is refused outright. The gold standard, once you have confirmed legitimate mail passes., a domain that sends nothing, so BIMI does not apply to it at all.