# BIMI VMC vs CMC: Requirements, DMARC and Which Inboxes Show Logos Source: https://srvscripts.com/guides/bimi-vmc-vs-cmc/ Updated: 2026-10-06 Publisher: srvScripts (https://srvscripts.com/) **Short answer:** A Verified Mark Certificate (VMC) needs a logo registered as a trademark; a Common Mark Certificate (CMC) needs no trademark, but the logo must have been shown on your website for at least 12 consecutive months. Gmail accepts both, but only a VMC gets the blue checkmark. Yahoo can show a logo without any certificate. Apple documents VMCs and does not name CMCs, so do not count on a CMC there. Every option needs DMARC at `p=quarantine` or `p=reject` and an SVG Tiny PS logo. Requirements were checked against Google Workspace Admin Help, Yahoo Sender Hub, Apple, the BIMI Group and Sectigo’s mark certificate documentation (linked below) on 6 October 2026. We checked the SVG MIME type mapping in Apache on our cPanel & WHM 11.138 and DirectAdmin 1.712 lab servers the same day; we have not bought a mark certificate for a lab domain. ## VMC and CMC compared | | VMC (Verified Mark Certificate) | CMC (Common Mark Certificate) | | --- | --- | --- | | Proof of right to the logo | Registered trademark with a recognised trademark office; the logo must match the registration and the trademark must not expire within 397 days of verification | No trademark. The logo must have been displayed on the website of the same domain for at least 12 consecutive months before you apply | | Identity checks | Organization identity validation, trademark verification, logo checks | Organization identity validation and logo checks | | Gmail | Logo shown, plus a blue checkmark next to the sender in Gmail | Logo shown, no checkmark | | Yahoo / AOL | Used as an input if present | Not required; Yahoo can show a logo without a certificate | | Apple Mail (iOS 16+, macOS 13+, iCloud.com) | Supported | Apple names VMCs and “other forms of BIMI Evidence Documents”, but does not list CMCs explicitly | | Validity | Maximum 398 days | Maximum 398 days | | Who issues it | Mark Verifying Authorities (MVAs) listed by the BIMI Group | Same MVAs | Both certificates are issued under a separate PKI from website TLS certificates. The BIMI Group notes that the CA/Browser Forum’s shrinking TLS lifetimes (200, 100 and later 47 days) do not apply to mark certificates. Which to choose: if your logo is already a registered trademark, buy a VMC; it works at the most providers and earns the Gmail checkmark. If registering a trademark is not realistic (Google notes it can take 6 to 12 months) and the logo has been on your site for over a year, a CMC gets you the logo in Gmail. If you mostly care about Yahoo and AOL, start with the free self-asserted route. ## The DMARC requirement BIMI only works for mail that passes DMARC under an enforcement policy: - `p=quarantine` or `p=reject` on the organizational domain. Google says `p=none` is not supported. - No partial rollout. Google says `pct` must be 100. Under the new DMARC standard (RFC 9989) `pct` is obsolete and leaving it out means the same thing, so a record without `pct` is fine. - The BIMI Group recommends enforcement on any subdomains you send from too. - SPF or, preferably, DKIM aligned with the visible From domain. ``` _dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" ``` Check your record with our [DMARC Checker](/tools/dmarc-checker/). Moving from `p=none` to `quarantine` before every legitimate sender is aligned will send real mail to spam, so read your aggregate reports first. ## Prepare the SVG Tiny PS logo BIMI logos must be in the SVG Tiny Portable/Secure profile. Google lists these rules: - Root element with `baseProfile="tiny-ps"` and `version="1.2"`, and a `` (use your organization’s name). - No scripts, animation, interactive elements or external references, and no `x=` or `y=` attributes on the root `<svg>`. - Gmail: at least 96 by 96 pixels, set in absolute pixels (not percentages). - Gmail recommends a square image centred on a solid background, 32 KB or smaller, with a `<desc>` element. You submit the SVG to the certificate authority when you apply, and the issued certificate embeds it. If you change the logo, you need a new certificate. ## Publish the files and the BIMI record - Upload the logo SVG and the PEM file (your certificate followed by the intermediate and root certificates, in that order, as Google describes) to an HTTPS URL on your domain, for example `https://example.com/bimi/logo.svg` and `https://example.com/bimi/vmc.pem`. On cPanel or DirectAdmin, any folder under the site’s document root works. - Publish a TXT record at `default._bimi.example.com`: ``` default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem" ``` `l=` is the logo and `a=` the certificate. Without a certificate (Yahoo-only, self-asserted), leave out `a=`. Google’s own example uses an empty `l=` with only `a=`, because the logo is inside the certificate. Our [BIMI Generator](/tools/bimi-generator/) builds the record. Serve the SVG with the `image/svg+xml` content type. Apache’s `mime.types` already maps `.svg` to `image/svg+xml` on both our cPanel and DirectAdmin labs. Check what your server really sends: ``` curl -sI https://example.com/bimi/logo.svg | grep -i -E "^HTTP|content-type|location" curl -sI https://example.com/bimi/vmc.pem | grep -i -E "^HTTP|location" ``` You want `200`, no redirect, and the right content type for the SVG. Use TLS 1.2 or later; Google requires HTTPS for BIMI files. ## Check that it worked - Run our [BIMI Checker](/tools/bimi-checker/) on the domain. It looks up `default._bimi` and the DMARC policy. - Confirm DMARC passes on real mail: in Gmail, **Show original** should show `DMARC: PASS`. - Wait. Google says it can take up to 48 hours after adding the record for the logo to appear. Yahoo also requires sufficient reputation and engagement for the sending address. - Check at each provider separately: Gmail web and app, Yahoo Mail, Apple Mail. ## Common problems - **Logo shows at Yahoo but not Gmail.** Gmail needs a VMC or CMC; Yahoo does not. - **Gmail shows the logo but no checkmark.** You have a CMC. The checkmark is for VMCs only. - **Nothing shows anywhere.** Usually DMARC: the policy is `none`, the From domain is a subdomain whose policy is `none`, or DMARC fails because the mail is signed by a provider’s domain. - **SVG rejected by the CA.** Exported from a design tool as full SVG 1.1. Convert to the Tiny PS profile and remove scripts, external fonts and image references. - **Fetch errors.** A redirect from `example.com` to `www.example.com`, a firewall challenge, or an expired TLS certificate on the host serving the files. - **Certificate expired.** Mark certificates last at most 398 days. Renew before expiry and replace the PEM file at the same URL. **Official documentation:** [Google Workspace: set up BIMI](https://support.google.com/a/answer/10911320) · [Yahoo Sender Hub: BIMI](https://senders.yahooinc.com/bimi/) · [Apple: BIMI support in Apple Mail](https://support.apple.com/en-us/108340) · [BIMI Group: Mark Certificate issuers](https://bimigroup.org/vmc/) **Related:** [BIMI Checker](/tools/bimi-checker/) · [BIMI Generator](/tools/bimi-generator/) · [DMARC Checker](/tools/dmarc-checker/) · [DMARC Record Generator](/tools/dmarc-record-generator/) · [SPF, DKIM and DMARC in cPanel DNS: Setup and Checks](/guides/spf-dkim-dmarc-cpanel-dns/) **See also:** [DMARCbis (RFC 9989): What Changed and Must You Edit Records?](/guides/dmarcbis-rfc-9989-changes/) · [Gmail and Yahoo Bulk Sender Requirements: 2026 Host Checklist](/guides/gmail-yahoo-bulk-sender-requirements/) ## Frequently asked questions ### What is the difference between a VMC and a CMC? A VMC proves you own a registered trademark for the logo. A CMC needs no trademark but requires the logo to have been on your domain’s website for at least 12 consecutive months. ### Does Gmail support CMC? Yes. Google accepts a VMC or a CMC for BIMI in Gmail, but only senders verified with a VMC get the checkmark. ### Do I need a VMC for Yahoo? No. Yahoo says it does not require a VMC; it shows a BIMI logo when the record and SVG are valid, DMARC is at quarantine or reject, and the sender has enough reputation. ### Does BIMI work with DMARC p=none? No. Google and the BIMI Group require an enforcement policy, p=quarantine or p=reject, applied to all mail. ### How long is a VMC or CMC valid? At most 398 days, under the AuthIndicators Working Group mark certificate requirements. Renew it every year. ### Do the 47-day TLS certificate rules apply to VMCs? No. Mark certificates are issued under a separate PKI and are not subject to the CA/Browser Forum TLS Baseline Requirements.