We checked BIMI across 100 top domains: 38 have a VMC certificate, 10 host an SVG Gmail ignores

Every business wants its logo to show up next to its messages in the inbox. BIMI promises to do that, but what many guides skip is that Google and Apple will not show your logo unless you pay roughly $1,500 a year for a Verified Mark Certificate (VMC). We checked 100 top domains from live DNS: 38 have a VMC, 10 publish a self-asserted SVG that Gmail completely ignores, and 49 have no BIMI record at all.

When you set up transactional email, you configure SPF, DKIM, and DMARC so messages land in the primary inbox instead of spam. Once those pass, the next shiny feature people spot is BIMI (Brand Indicators for Message Identification). It promises an official avatar and, on Gmail, a verified blue checkmark. But setting up the DNS TXT record is only half the battle.

How we counted

• The domains: 100 popular domains across consumer tech, SaaS platforms, retailers, banks, and email providers (including Apple, Amazon, Cloudflare, Salesforce, Spotify, Reddit, Airbnb, Chase, and PayPal).
• The BIMI query: A DNS TXT lookup for default._bimi.<domain>, checking for the v=BIMI1 header, the logo location tag (l=), and the certificate authority tag (a=).
• The DMARC query: A DNS TXT lookup for _dmarc.<domain> to verify whether the domain meets BIMI's mandatory policy rule: p=quarantine with pct=100, or p=reject.
• When: 11 November 2026, querying authoritative resolvers from live DNS. No email was sent.

The four BIMI categories across 100 domains

Why 10 major brands host an SVG that Gmail ignores

A common misconception among developers is that publishing an SVG logo in a BIMI record will show that logo across all email clients for free. It does not. The mailbox providers are fundamentally split into two camps:

• Yahoo Mail and Fastmail: Support self-asserted BIMI. If you publish a clean SVG Tiny P/S logo and have a strict DMARC policy with high sender reputation, Yahoo Mail will render your logo without asking for a certificate.
• Gmail and Apple Mail: Strictly require a cryptographic Verified Mark Certificate (VMC) or Common Mark Certificate (CMC). If the a= tag is missing, blank, or points to an invalid certificate chain, Gmail and Apple Mail discard the record immediately. No logo is shown.

Look at who publishes a self-asserted SVG with no certificate: Salesforce, Spotify, Reddit, Airbnb, Uber, Mailchimp, Figma, Zapier, Forbes, and TripAdvisor. These companies know the difference. They host an SVG so Yahoo users see their icon, while choosing not to purchase a VMC certificate for those specific sending domains.

What a Verified Mark Certificate actually costs and requires

If you want your logo to appear in Gmail and Apple Mail, here is what the certificate authority actually checks before handing you the .pem file:

• A registered trademark: Your logo must be an active, officially registered word or design mark issued by a recognized government intellectual property office (such as the USPTO in the US, EUIPO in Europe, UKIPO in the UK, or similar national offices). Common-law trademarks or pending applications are not accepted for a VMC.
• Identity verification: The certificate authority (for example DigiCert or GlobalSign) conducts background checks, notary calls, and corporate verification to prove that the company requesting the certificate owns the trademark.
• Annual price: A single VMC costs approximately $1,299 to $1,500 per year per logo. In late 2024, a cheaper tier called Common Mark Certificates (CMC) was introduced for logos without a registered trademark, but those still cost around $990 per year.
• Strict SVG Tiny P/S formatting: Your logo cannot be a regular SVG exported from Figma or Illustrator. It must follow the SVG Tiny Portable/Secure specification: square 1:1 aspect ratio, no scripts, no external font references, no raster bitmaps embedded inside, and under 32 KB.

Of the 38 domains in our audit that declared a certificate, DigiCert hosted 19, Valimail Amplify hosted 6, GlobalSign hosted 1, Sectigo hosted 1, and 11 hosted the PEM file directly on their own CDN.

The mandatory DMARC hurdle

You cannot use BIMI with a relaxed DMARC policy. The BIMI specification explicitly rejects any domain whose DMARC record is set to monitoring mode (p=none) or whose percentage tag is less than 100%.

To qualify for BIMI, your domain must publish either:

v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-reports@yourdomain.com

or:

v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-reports@yourdomain.com

All 51 domains that published a BIMI record in our test had their DMARC policy set to either reject or quarantine at 100%. If you try to publish a BIMI record while DMARC is at p=none, every receiving mail server will ignore your logo entirely.

Should a small business or new SaaS set up BIMI?

Unless you already hold a registered trademark and have a budget to spend $1,500 every year on an email avatar, a VMC is almost certainly the wrong priority for an early-stage app or small business. Here is the sensible path:

• 1. Fix SPF, DKIM, and DMARC first: Making sure 100% of your transactional emails pass authentication and arrive in the inbox matters vastly more than an icon.
• 2. Monitor DMARC aggregate reports: Move your domain from p=none to p=quarantine and eventually p=reject. This protects your brand from phishing without costing a penny.
• 3. Publish a self-asserted SVG if you want Yahoo coverage: If you send newsletters or customer notifications and have clean delivery, hosting a clean SVG Tiny P/S file and pointing default._bimi to it costs nothing and will display in Yahoo Mail.
• 4. Don't wonder why Gmail ignores it: If you don't have the a= certificate URL in DNS, understand that Google and Apple are behaving exactly as designed.

Check your domain's BIMI and DMARC status

Want to see what receiving servers see when you send an email? Use our free deep email check to inspect your domain's SPF lookups, DKIM selectors, DMARC enforcement, MTA-STS, and BIMI records in seconds. If you need an automated way to collect and read DMARC aggregate reports, take a look at our DMARC digest tool.

Sources and technical specifications

• IETF Draft: Brand Indicators for Message Identification (BIMI)
• Authing Group: Verified Mark Certificate (VMC) Requirements and Guidelines
• Google Workspace Admin Help: Set up BIMI (VMC and CMC requirements)
• Apple Support: Authenticate email with BIMI in Apple Mail
• Yahoo Mail Sender Best Practices: BIMI and self-asserted logo requirements
• RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC)