When Marketing and PKI Collided
For most of PKI's history, marketing teams and PKI teams operated in different worlds. Marketing cared about brand consistency, open rates, and inbox placement. PKI cared about ciphers, chain construction, and revocation. Then Brand Indicators for Message Identification (BIMI) arrived, and the two disciplines discovered they suddenly had a joint deliverable: a Verified Mark Certificate (VMC) that authorizes an organization's trademarked logo to appear next to its authenticated emails.
BIMI has been in slow rollout since 2020, but 2025 and 2026 pushed it from "interesting to try" to "operationally required." Gmail's expansion of BIMI support to more sender categories, Apple Mail's Continued rollout of BIMI display in iOS and macOS, and Yahoo's mandatory sender authentication policies for bulk email have combined to make VMCs a real budget line for any organization that sends transactional or marketing email at scale.
This article breaks down what BIMI is, what a VMC is, why the two are different from ordinary TLS certificates, how the 2026 landscape changed, and how to manage VMC lifecycles alongside the rest of your enterprise PKI.
BIMI in Plain Language
BIMI is a specification that tells email clients where to find a sender's authorized logo. It relies on three prior standards:
- SPF (Sender Policy Framework): which servers are authorized to send email for a domain.
- DKIM (DomainKeys Identified Mail): cryptographic signature that proves an email was authorized by the domain.
- DMARC (Domain-based Message Authentication, Reporting and Conformance): policy that tells receivers what to do with mail that fails SPF or DKIM.
BIMI adds a fourth layer on top of a strict DMARC policy: a DNS TXT record at default._bimi.example.com that points to (a) an SVG image of the sender's logo, and (b) optionally, a VMC that cryptographically attests the sender's right to use that logo.
When a receiving mail client (Gmail, Apple Mail, Yahoo, Fastmail, etc.) processes an incoming message from example.com:
- It checks that DMARC passes with a strict policy (p=quarantine or p=reject).
- It looks up the BIMI record for the sending domain.
- It fetches the SVG logo.
- If a VMC is present and required by the receiver, it validates the VMC.
- If all checks pass, it displays the logo next to the sender in the inbox.
The visible result is a small logo in the inbox. The invisible result is a substantial set of PKI, DNS, and mail-authentication commitments the sender must make and maintain.
What Makes a VMC Different
A VMC is a specialized X.509 certificate governed by a distinct CA/Browser Forum working group. Unlike a TLS server certificate, a VMC does not authenticate a server. It attests three things:
- The organization's legal identity (through Extended Validation-style vetting).
- The organization's ownership of a registered trademark for the logo.
- The organization's control of the domain in the BIMI record.
VMCs are issued only by a small set of CAs qualified to issue them: DigiCert and Entrust are the primary providers, with a handful of resellers. As of 2026, the vetting process typically requires:
- Legal documentation of the entity's registration in an accepted jurisdiction.
- Trademark registration for the logo in one of a defined set of trademark offices (USPTO, EUIPO, JPO, IPO, and others).
- Domain control verification.
- The logo itself as an SVG-P/S (a restricted SVG Tiny Portable/Secure profile).
The vetting can take days to weeks depending on the completeness of the applicant's documentation. Once issued, VMCs typically have a lifetime of one year and must be renewed with revalidation of trademark rights.
An emerging alternative is the Common Mark Certificate (CMC), which uses evidence of "prior use" rather than a registered trademark. CMCs are useful for logos that predate trademark registration or are ineligible for registration, but their acceptance across mail providers is narrower than that of VMCs.
What Changed in 2026
Several concrete developments through 2025 and 2026 have pushed BIMI/VMC from novelty to standard:
Broader Gmail support
Gmail's initial BIMI rollout limited logo display to specific sender categories. Expanded eligibility through 2025 and 2026 means the practical majority of enterprise senders can now qualify for logo display in Gmail inboxes.
Apple Mail continued expansion
Apple Mail's BIMI display, rolled out incrementally across iOS and macOS versions, is now broadly available in the current major releases. This adds hundreds of millions of endpoints where a logo can appear next to authenticated email.
Sender authentication mandates
Yahoo and Gmail's 2024 bulk-sender authentication requirements — mandatory DMARC alignment for high-volume senders — became prerequisites for BIMI in practical terms. Any organization already compliant with those bulk-sender rules has cleared the highest bar for BIMI eligibility.
CMC acceptance
Common Mark Certificates gained traction with additional receiving providers, extending BIMI benefits to organizations whose logos are not registered trademarks in a supported jurisdiction.
Focus on inbox brand fraud
Phishing campaigns increasingly mimic well-known brands. BIMI's logo-in-inbox display is now positioned by security and marketing teams as an anti-phishing signal: recipients learn that legitimate mail from a brand shows a logo, and unauthenticated impersonation attempts do not.
Operational Realities Enterprises Discover
Organizations that treat BIMI as a marketing task discover the operational realities midway through implementation:
Strict DMARC is a precondition
BIMI requires DMARC at p=quarantine (with at least 100% enforcement) or p=reject. Enterprises whose DMARC policy is p=none cannot participate. Moving from monitoring-only DMARC to enforcement is a project in itself, often taking months to identify and fix legitimate mail sources that were failing SPF or DKIM.
Every sending domain matters
BIMI records are per-domain. Organizations that send from many subdomains (marketing.example.com, notifications.example.com, careers.example.com) may need per-subdomain BIMI setups, and the VMC scope must cover the intended domains.
SVG constraints are strict
The SVG-P/S profile is restrictive. Logos with gradients, complex paths, or specific font choices may need substantial rework. Marketing teams that hand off a "final" SVG frequently discover it does not conform.
Trademark documentation
Registering a trademark takes months. Organizations that do not have a registered trademark for the specific mark they want to display face either a delay for registration or a fallback to a Common Mark Certificate with narrower support.
Renewal choreography
VMCs are 12-month certificates. Because they touch legal, marketing, and PKI teams, renewal preparation should start 60–90 days before expiry. VMC expiry silently removes the logo from inboxes — an outcome that marketing will notice and PKI will be asked to explain.
The Governance Case for CLM-Aware VMC Management
VMCs are low-volume compared to TLS certificates — an organization might have a handful of VMCs across its major sending domains. But they carry outsized attention. When a VMC expires, the executive question is not "why did the certificate lapse?" It is "why did our logo disappear from Gmail?" That question generates escalation that other certificate expirations do not.
For that reason, VMCs should be governed with the same discipline as TLS certificates — arguably more:
- Inventory: Every VMC across every sending domain and subsidiary brand should be in the certificate inventory.
- Ownership: Marketing owns the brand; PKI owns the certificate lifecycle. Joint ownership is documented, with named individuals accountable in each function.
- Alerting: VMC expiry alerts should fire at 90, 60, and 30 days, and should route to both marketing and PKI to prevent the "someone else was renewing it" gap.
- Trademark tracking: The trademark registration underlying a VMC also expires and requires renewal. VMC governance should reference the underlying trademark's renewal date.
- Logo change management: When marketing updates a logo, the VMC must be reissued. Logo refreshes should trigger a documented VMC update workflow.
- CA relationship: Because only a handful of CAs issue VMCs, contract negotiation and vetting-time SLAs matter more than for high-volume TLS certificates.
Metrics and Reporting
Organizations running a meaningful BIMI program should report on:
- BIMI eligibility coverage: Percentage of sending domains with strict DMARC.
- VMC coverage: Percentage of authenticated mail streams protected by a valid VMC.
- Logo display rates: Where measurable, percentage of inbox impressions where the logo displayed.
- Time to VMC issuance: From application to certificate for new domains and refreshes.
- VMC renewal lead time: Days between renewal start and expiry.
These metrics translate BIMI from a checkbox marketing initiative into a governed program that the business can measure and improve.
The Broader Trend: PKI as a Brand Asset
BIMI/VMC is one example of a broader trend: PKI is increasingly a brand and trust asset, not just a security control. Code signing certificates authenticate software. Document signing certificates authenticate PDFs. Verified Mark Certificates authenticate emails. Each represents a moment when a customer sees a trust indicator that a certificate produced.
The organizations that treat PKI as a strategic capability — one that produces measurable trust in every customer interaction — are pulling ahead of those that treat it as pure infrastructure. BIMI/VMC is the first mainstream trust indicator that customers actively look for in a common interaction (checking email). It will not be the last.
How TigerTrust Supports VMC Programs
TigerTrust extends its certificate lifecycle discipline to VMCs and integrates them into your broader PKI governance:
- VMC lifecycle tracking: Every VMC in your organization is inventoried alongside TLS and code-signing certificates, with linked metadata for trademark, logo, and sending domain.
- Cross-team alerting: Expiry alerts route to both marketing and PKI, with configurable escalation to prevent silent lapses.
- DMARC and BIMI DNS validation: TigerTrust monitors DMARC policy strength and BIMI DNS records so a VMC does not silently become non-functional due to upstream configuration drift.
- Trademark reference tracking: Trademark registration dates and renewal cycles are surfaced alongside VMC lifecycles.
- CA integration for supported VMC issuers: Native support for the CAs that issue VMCs, reducing the friction of application and renewal.
- Logo change workflow: When marketing changes a logo, TigerTrust provides the workflow to update the SVG, reissue the VMC, and verify inbox display.
BIMI made your inbox a brand surface. Make sure the certificate behind that logo is governed. Learn more at tigertrust.io.