Gmail BIMI Logos and Verified Checkmarks

Gmail can show your brand logo beside authenticated email. It can also show a verified checkmark next to your sender name. These two indicators have different requirements.

A Common Mark Certificate (CMC) or Verified Mark Certificate (VMC) can qualify your logo for Gmail's BIMI display. Gmail reserves the verified checkmark for senders verified with a VMC. A CMC can support the logo, but it does not qualify the sender for that checkmark.

Both paths depend on effective DMARC enforcement, an aligned message, a compliant SVG logo, public certificate evidence, and a BIMI record in DNS. You can inspect the public evidence with the email authentication checker before testing fresh email in Gmail.

What BIMI does

Brand Indicators for Message Identification (BIMI) lets a sending domain publish a logo that supporting mailbox providers can consider displaying beside authenticated email. It is a display signal on top of email authentication. It does not change how a message is delivered, and it does not guarantee inbox placement.

The visible From domain matters. A message must pass DMARC through aligned SPF or DKIM, which means the authenticated domain matches the domain recipients see in the From header. A DNS lookup can confirm that your policies and public assets exist. It cannot prove that a specific message aligned.

Mailbox providers also apply their own reputation and display policies. A technically valid setup can therefore produce no logo or checkmark in a particular mailbox or view.

Gmail logo versus verified checkmark

Google documents two certificate paths for Gmail BIMI:

• Verified Mark Certificate (VMC): A certificate authority validates your organization and an eligible registered trademark used for the logo. Gmail can show the BIMI logo and a verified checkmark for a sender verified with a VMC.
• Common Mark Certificate (CMC): A certificate authority validates your organization and rights to a logo that does not follow the VMC trademark path. Gmail can show the BIMI logo, but its verified checkmark does not apply to CMC-backed senders.

Google recommends a VMC when your logo is eligible. Certificate authorities set the evidence, jurisdiction, and mark requirements they will accept. Ask a BIMI certificate issuer about your exact mark before starting an application. Mailbox providers decide which issuers and certificates they accept. Treat that review as a legal and procurement step, not a DNS task.

The Gmail BIMI readiness chain

Each part of the chain has to support the same visible From domain.

1. Enforce DMARC

Your effective DMARC policy must be p=quarantine or p=reject, with pct=100. A monitoring policy such as p=none, or enforcement applied to less than 100 percent of mail, is not enough for BIMI.

The BIMI Group's implementation guidance also calls for enforcement on the organizational domain and its sending subdomains. Check the effective policy, including sp=, when a subdomain does not publish its own DMARC record.

Move to enforcement only after reviewing your DMARC reports and confirming every legitimate sender. An abrupt policy change can quarantine or reject valid email that still lacks alignment. Start with the email authentication guide for SPF, DKIM, DMARC, and alignment fundamentals; Samva's deliverability guide explains the product operating context.

2. Align a real message

At least one authentication path must align with the visible From domain:

• DKIM passes and its d= domain aligns with the From domain.
• SPF passes and the authenticated Mail From domain aligns with the From domain.

DNS readiness is necessary, but it is not message-level evidence. Send a fresh message after every configuration change and inspect its authentication results.

3. Prepare an SVG Tiny PS logo

A normal SVG export is not automatically BIMI-compatible. The file must use the SVG Tiny Portable/Secure profile. At minimum, check that it includes:

<svg version="1.2" baseProfile="tiny-ps" ...>
  <title>Example Company</title>
  ...
</svg>

The file cannot contain scripts, animation, interactive elements, or external references. Google also requires absolute width and height values of at least 96 pixels for Gmail. It recommends a square, centered logo, a solid background, a <desc> element for accessibility, and a file size of 32 KB or less.

Test the mark at small sizes. A detailed wordmark may be valid and still become unreadable inside a circular or rounded inbox avatar.

4. Obtain the certificate evidence

Your certificate authority supplies a PEM file containing the mark certificate and embedded logo evidence. The certificate type determines the Gmail indicator you can pursue:

• VMC evidence can support the logo and verified checkmark.
• CMC evidence can support the logo, without the Gmail checkmark.

Check the certificate type, issuer, validity dates, and certificate chain before publishing its URL. A parseable PEM is only evidence about the file. It does not prove that every mailbox provider trusts the chain or will display the indicator.

5. Host the SVG and PEM over HTTPS

The URLs in your BIMI record must be publicly retrievable over HTTPS. They cannot require cookies, authentication, an IP allowlist, or a browser challenge.

Common fetch failures include:

• an HTTP URL or invalid TLS configuration
• redirects that end on the wrong file or host
• hotlink protection, bot blocking, or geographic restrictions
• a forced download response or incorrect Content-Type
• an incomplete or inaccessible certificate chain

Request each URL from outside your normal browser session. Confirm a successful response, the final URL, and the expected content type.

6. Publish the BIMI TXT record

The default selector normally lives at default._bimi.<domain>. Its TXT value points to the logo through l= and the certificate through a=:

default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"

Publish one valid BIMI record at that name. Duplicate records, a missing v=BIMI1, malformed tags, or an unreachable l= or a= URL can stop evaluation.

Check the public evidence

Open the email authentication checker and enter the domain used in your visible From address. Its BIMI inspection reads the public record at default._bimi.<domain>, evaluates the effective DMARC policy, fetches the record-declared SVG and PEM through a bounded public network path, and reports factual findings about those assets.

Use the result in this order:

1. Fix missing, duplicate, or malformed BIMI records.
2. Move the effective DMARC policy to full enforcement after legitimate senders align.
3. Repair SVG Tiny PS structure and public asset retrieval.
4. Review the certificate type, issuer, dates, and chain shape.
5. Send a fresh aligned message to Gmail and inspect the provider result.

The checker does not buy or issue a certificate, change your DNS, prove message-level alignment, assert universal certificate trust, or guarantee mailbox-provider display. It gives you a reproducible view of the public evidence so you can isolate the next fix.

Why a valid setup may still not display

DNS and mailbox interfaces both cache state. Wait for the old DNS TTL to expire, then recheck the public record and send a new message. Reopening an old message may show cached provider state.

If the evidence passes and a fresh message still has no indicator, inspect these failure modes:

• The message does not align. The DNS policy is eligible, but the live DKIM or SPF identity does not align with the visible From domain.
• The certificate does not match the intended path. A CMC does not qualify for Gmail's verified checkmark. An expired, incomplete, or otherwise unacceptable certificate can also block display.
• The provider cannot fetch an asset. TLS, redirects, content type, access controls, or transient availability can differ from what your browser sees.
• The logo is valid but unsuitable for the UI. Cropping, transparency, or fine detail can make the rendered result unusable.
• The mailbox provider applies additional policy. Reputation, abuse signals, mailbox type, client, and interface can affect whether an eligible indicator appears.

Technically valid evidence is a readiness result, not a display promise. The BIMI Group implementation guide states that each participating mailbox provider has its own display criteria. Google's BIMI setup guide and troubleshooting guide remain the primary references for Gmail-specific behavior.

Gmail BIMI checklist

Before you expect a Gmail brand indicator:

1. DMARC effectively enforces quarantine or reject at pct=100.
2. A fresh message passes aligned DKIM or SPF for the visible From domain.
3. The logo is a compliant SVG Tiny PS file and meets Gmail's dimension requirements.
4. A certificate issuer has provided a current VMC or CMC and complete PEM evidence.
5. The SVG and PEM are publicly retrievable over HTTPS.
6. One valid TXT record exists at default._bimi.<domain> with the correct l= and a= URLs.
7. The checker reports the public evidence you expect.
8. You have allowed for DNS and provider caching, then tested a fresh message.

Choose a VMC if you need Gmail's verified checkmark and your mark qualifies. Choose a CMC if you need Gmail logo eligibility without the VMC trademark path. In both cases, keep provider display separate from technical readiness.