BIMI and VMC: what it costs and what you actually get

BIMI displays your logo next to your messages in supporting inboxes. It is the last link in an authentication chain rather than a feature you switch on, and each preceding link has to be in place before it does anything.

The prerequisites, in order

1. SPF and DKIM published and aligned.
2. DMARC at enforcement — p=quarantine or p=reject. At p=none the BIMI record is read and ignored.
3. An SVG in the right profile, served over HTTPS.
4. A Verified Mark Certificate, for Gmail.

Most organisations stop at step two, which is fine — steps one and two are worth doing regardless of whether a logo ever appears.

The SVG is not any SVG

The requirement is SVG Tiny Portable/Secure, which is a restricted profile:

• No scripts, no external references, no embedded raster images
• A square aspect ratio
• A title element
• A solid background — transparency is not permitted

No mainstream design tool exports this by default. The file almost always needs editing by hand, and a file that renders correctly in a browser can still be rejected.

The certificate

A VMC is issued by a certificate authority after verifying that you hold a registered trademark on the logo. That is the binding constraint: no trademark, no certificate, and trademark registration is itself a process measured in months.

The certificate is an annual cost, in the high hundreds to low thousands of dollars depending on the issuer. Gmail requires one. Some other providers will display a logo from a valid BIMI record without it.

Is it worth it

It depends almost entirely on your recipients.

Consumer-facing brands with Gmail-heavy audiences get the most: a visible, recognisable mark in a crowded inbox, and a modest trust signal.

Transactional senders get less. A password reset is opened because the user just requested it, not because of a logo.

Business-to-business senders get the least. Corporate mail systems are the least likely to display it.

The honest summary

BIMI does not improve deliverability. It is not a ranking signal, and a message with a logo is not more likely to be delivered than the same message without one.

What improves deliverability is the DMARC enforcement that BIMI requires. If chasing a logo is what finally gets an organisation to p=reject, the project paid for itself before the certificate was issued — and the enforcement is the part you keep if you decide the certificate is not worth renewing.

Check where a domain currently stands with the BIMI checker.