Open Gmail and look at the little circles next to sender names. Some show a letter on a colored disk — the default Gmail draws when it has nothing better. A few show an actual brand logo. And once in a while there’s a logo with a blue checkmark beside it, the mark Gmail added in 2023 to say this sender is who they claim to be.
That logo is the payoff of a standard called BIMI — Brand Indicators for Message Identification. The pitch is simple and appealing: put your verified logo in the inbox, get recognized, get trusted, get opened. The part nobody leads with is the invoice. To make that logo appear in Gmail or Apple Mail, you don’t configure a protocol. You buy a certificate, and it runs to roughly a thousand to fifteen hundred dollars a year, every year, forever.
Here’s the strange thing about that price: almost none of it pays for BIMI. BIMI itself is free.
The protocol is a DNS record and a picture
Strip BIMI down and there’s very little to it. You publish a DNS TXT record at default._bimi.yourdomain.com. It points to an SVG file you host — specifically SVG Tiny Portable/Secure, a locked-down profile with no scripts, no external references, no animation, square aspect ratio. That’s the protocol. A text record and an image on your own server. It costs nothing but the ten minutes to set it up.
If that were the whole story, every domain on earth would have a logo in the inbox by now. It isn’t, because the two mailbox providers that matter added a condition. Gmail and Apple Mail will not render your logo from the DNS record alone. They demand you also point that record at a Verified Mark Certificate — a VMC — issued by one of a short list of certificate authorities, led by DigiCert and Entrust. The certificate is where the thousand dollars goes. As of mid-2026, DigiCert’s list price for a mark certificate sits around $1,400 a year.
So the recurring cost of BIMI is not the cost of BIMI. It’s a toll the inbox providers chose to erect, collected by a certificate authority, for the privilege of displaying an image you already own and already host.
What the certificate actually verifies
It’s worth being precise about what your thousand dollars buys, because it is not what most people assume. A VMC does not verify that you send good email, that you’re not a spammer, or that your messages are safe. It verifies one narrow thing: that the logo in your BIMI record matches a registered trademark you hold, in a jurisdiction the CA recognizes — USPTO, EUIPO, and a handful of others.
That trademark requirement is a second, hidden cost most BIMI cost breakdowns skip. If you don’t already own a registered trademark for your logo, you can’t get a VMC until you register one, and trademark registration is its own multi-year process with its own government fees and, usually, a lawyer. The “thousand dollars a year” is the visible edge of a much longer prerequisite chain.
There is a genuine reason for the trademark check, and I want to give it its due. Without some form of vetting, anyone could drop a bank’s logo into their own BIMI record and paint a perfect impersonation right where users have been trained to look for trust signals. The VMC exists so the logo means this brand actually controls this mark, not someone typed a URL to a PNG. As anti-impersonation mechanisms go, tying the logo to a registered trademark is a defensible design.
The problem is who it defends, and who it prices out.
The people who can afford it are the ones least at risk
To even qualify for BIMI, you must already be at DMARC enforcement — a policy of p=quarantine or p=reject, applied to all your mail, with SPF and DKIM aligned underneath it. That’s not optional; Gmail and Apple check for it before they’ll show anything. And reaching enforcement is the hard part of email authentication. It’s the work that actually stops your domain from being spoofed. It takes months of monitoring reports, fixing every legitimate sending source, and finally turning the policy from advisory to binding.
Notice what that means. By the time a domain is eligible for a logo, it has already done the entire security-relevant part of the journey — for free. DMARC enforcement is the control that matters, and it costs nothing but effort. BIMI is bolted on top as a cosmetic reward for work you’d already finished. The logo doesn’t make your mail more authentic. Your mail was already as authentic as the protocols can make it before the logo showed up.
Then add the trademark requirement, and the population that can get a BIMI logo narrows to organizations that (a) have reached DMARC enforcement, (b) own a registered trademark, and (c) will pay four figures a year indefinitely. That’s a description of established, well-resourced brands. It is almost exactly the set of senders least likely to be the source of cheap, high-volume phishing — the senders whose domains are already the best defended on the internet. The impersonation problem BIMI closes is real, but it’s narrow, and the toll gate is placed in front of the people who needed it least.
The “cheap” option that isn’t
The industry noticed that the trademark requirement was locking out everyone without a registered mark, so in 2023 a second certificate appeared: the Common Mark Certificate, or CMC. A CMC drops the trademark requirement — you can prove logo ownership other ways — which sounds like the budget door into BIMI.
Look at the price and the door isn’t much cheaper. CMCs run around $1,089 to $1,099 a year, a discount of maybe a few hundred dollars against a VMC that lists near $1,400. And the CMC buys you less: it gets your logo shown, but it does not get you Gmail’s blue verified checkmark, which remains VMC-only. So the “affordable” tier saves you a rounding error and costs you the one visual element — the checkmark — that arguably carries the trust signal people actually notice. If the logo is worth paying for, the CMC is a bad deal; if it isn’t, the CMC is still a thousand dollars.
What I’d actually tell you to do
Do the DMARC work. All of it. Get to p=reject with aligned SPF and DKIM, because that is the part that stops your domain from being forged, protects your recipients, and — as of the 2024 sender requirements from Gmail and Yahoo — increasingly determines whether your mail lands at all. It’s free, it’s the real security win, and it’s the thing every domain should have regardless of whether a logo ever appears.
Then treat BIMI as what it is: a marketing line item, not a security control. The certificate doesn’t harden anything. It rents you a picture in the inbox, priced like an extended-validation cert, gated by two companies who could have chosen to render your logo from a DNS record for nothing and decided a CA should stand in the middle instead. For a consumer brand that lives or dies on recognition, a logo in millions of inboxes might genuinely be worth $1,400 a year — that’s a real marketing calculation, and for some brands it comes out positive. Just run it as a marketing calculation. Don’t let it ride into the budget disguised as security, and don’t believe the discount tier is saving you anything.
The picture is fine. Be clear-eyed about what you’re buying, and who set the price.