Do I need a registered trademark for the Gmail blue checkmark?

For the checkmark, yes. It is tied to a Verified Mark Certificate, and Google says the logo has to be trademarked with an intellectual property office that VMC issuers recognize. Without a registration you can still get a Common Mark Certificate, which Google says shows the brand avatar without the verified checkmark.

Will BIMI improve my deliverability?

Not by itself. BIMI only controls whether a mark is displayed next to mail that already authenticated. The DMARC enforcement it requires is what affects how your domain is treated, and that work stands on its own whether or not you ever buy a certificate.

Can I test BIMI before buying a certificate?

Partly. Yahoo, Fastmail and LaPoste accept self-asserted records, so a compliant SVG plus a DMARC policy at quarantine or reject can show a mark there with no certificate. Gmail does not accept self-asserted records, so it will show nothing until a VMC or CMC is in place.

Gmail blue checkmark: what BIMI needs before it shows

Say a 20-person logistics company sends a few thousand invoices and pickup notices a month. The owner forwards us a screenshot of a bank's email, which arrives with a small round mark and a check beside the sender name, and asks a fair question: why does the bank get that and we get a grey circle with a letter in it?

It is a reasonable thing to want, and there is no switch for it in the Google Admin console. The mark and the check are the visible end of an authentication chain, and nearly every domain that asks for them fails the first requirement long before any money needs to be spent.

What the checkmark actually proves

BIMI, Brand Indicators for Message Identification, is a small DNS record that tells a mailbox provider two things: where your logo file lives, and where to find the certificate that ties that logo to your domain. It is still an IETF draft rather than a finished standard, which matters mostly because the details move and each provider implements its own subset.

The Gmail checkmark is narrower than people assume. It is not a verdict on your content, your list hygiene or your reputation. It says that the message authenticated against your domain and that a third party checked that this particular mark belongs to that domain. That is all. It will not rescue mail that fails DMARC, it does not reduce spam complaints, and on its own it does not move you out of the promotions tab.

Step zero is DMARC, and this is where most domains stop

Google's BIMI setup guide is unambiguous about the prerequisite: the domain's DMARC policy must be set to quarantine or reject, and the percent option must be set to 100. The BIMI Group's implementation guide states the same rule from the other side, that policies of none, or a pct below 100 percent, are not accepted, and it applies the same condition to subdomains.

That last clause ends a lot of projects quietly. A root domain sitting at p=reject with sp=none underneath it is not at enforcement in the sense BIMI means, and the subdomain policy is exactly the tag people leave loose while they finish a migration. If you are not sure which of your names is at what policy, that audit comes first.

If your domain is at p=none today, the honest timeline for a logo is months, not days, and the work has nothing to do with logos. It is the inventory of every service that sends as your domain, SPF and DKIM alignment for each one, then reading aggregate reports until the rows are boring. We wrote that sequence up as moving DMARC from p=none to p=reject, and the sender side of it in the p=reject checklist for third-party senders. The subdomain half is in DMARC subdomains, the sp tag and delegation.

Check where your domain actually stands before reading on. The rest only applies once enforcement is real.

VMC or CMC: the certificate decides whether you get the check

Google requires third-party certification of your domain and your logo. Two kinds exist, and the difference is what most comparisons get wrong.

A Verified Mark Certificate is issued against a registered trademark. Google's guide puts it plainly: the logo must be trademarked with an intellectual property office that VMC issuers recognize. A Common Mark Certificate is the route for a mark that is not registered. Google announced support for CMCs in September 2024, and the announcement is explicit that the certificate displays the brand avatar without the Gmail verified checkmark. Google also recommends getting a VMC whenever possible, and treats the CMC as the option for an untrademarked logo.

So the checkmark is a trademark question before it is a technical one. If the business has never registered its mark, a CMC gets the logo into the avatar slot and that is the end of what is available. Registering a trademark to earn a checkmark is a legal project with its own timeline and cost, and it is a decision for the owner, not for whoever runs DNS.

Both certificates are annual and bought from a commercial certificate authority, and that is the real cash cost of the exercise. We check the issuer's current list price with the client before anyone commits, because it is the number that decides whether the project is worth doing.

Route	What it needs	What Gmail shows	Who it suits
No BIMI record	Nothing	The default avatar: an initial, or a contact photo the recipient saved	Any domain not yet at DMARC enforcement
Self-asserted record	A compliant SVG at an HTTPS URL, no certificate	Nothing. Gmail does not accept self-asserted records	Testing, or an audience that reads mostly at providers which do accept them
CMC, Common Mark Certificate	The SVG plus a CMC delivered as a `.pem` file	Your mark in the avatar slot, without the verified checkmark	Brands with no registered trademark
VMC, Verified Mark Certificate	The SVG plus a VMC as a `.pem` file, and the mark registered with a trademark office the issuers recognize	Your mark plus the blue verified checkmark	Brands that already own a registered mark
Certificate in place, DMARC at `p=none` or a percent below 100	Not accepted by Google	Nothing	Nobody. This is the most common failed setup we are asked to review

The logo file is where projects stall

The file has to be an SVG in the SVG Tiny PS profile, and Google's own file rules are specific. At least 96 by 96 pixels. Absolute pixel dimensions, not percentages. The file 32 KB or smaller. A desc element present. No scripts, no animation, no external references. Google also suggests a solid background rather than a transparent one, because transparency might not display the way you expect.

Square is the part that surprises people. Most brand kits ship a horizontal wordmark, which is useless in a round avatar slot, so the practical outcome is a new square mark drawn for the purpose. For a VMC it has to be the mark that is actually registered, which is a conversation with whoever handled the registration rather than with your designer.

Hosting has one rule that trips up multi-domain setups: Google's troubleshooting page says the web server has to be on the same domain where the BIMI DNS record was added. Parking the SVG and the .pem on a shared assets domain will not work. Both files need to be publicly reachable over HTTPS, with no login and no redirect chain in front of them.

The DNS record, and the character that breaks it

One TXT record, at the default selector:

default._bimi.example.com.  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

The v tag must read BIMI1; if it does not match, the whole record is ignored. The l tag is required and carries the HTTPS URL of the SVG. The a tag is optional in the draft and assumed empty when absent, which is why so much writing about BIMI treats it as optional. For Gmail it is not: Google states that displaying a logo in Gmail requires the record to point at a PEM file, and that an SVG on its own is not supported there. Some other providers accept the SVG-only form.

Google adds a warning to its record instructions that sounds trivial and is not: in this syntax the digit 1, the uppercase letter I and the lowercase letter l look almost identical. Most broken records we are asked to look at are a mistyped URL or that exact confusion, not a policy problem. After the record goes in, Google says it can take up to 48 hours for logos to start appearing, so nothing should be declared broken on the same afternoon.

What we check before a client buys anything

The DMARC policy on the organizational domain, and the sp tag underneath it. Quarantine or reject, percent at 100, no loose subdomain policy.
SPF and DKIM alignment for every service that sends as the domain, because enforcement has to hold without breaking invoices or the booking system.
Whether a registered trademark exists, in which office, and whether the registered mark can work as a square.
Where the audience reads mail. A rough split of recipient domains across Gmail, Yahoo, Apple and Microsoft tells you what the certificate actually buys.
Who controls the DNS zone and a web server on the same domain, since both files have to sit there and stay reachable for the life of the certificate.

If any of the first two is unfinished, the answer is to fix that and revisit the logo in a quarter. Nothing is lost: enforcement is the thing that protects the domain, and the logo is a reward for having done it.

Where it shows, and where it never will

The BIMI Group keeps a provider list, and Apple, Fastmail, Google and Yahoo all appear on it as supporting BIMI. Apple's own support page scopes it to Apple Mail on iOS 16, iPadOS 16, macOS Ventura 13 and later, plus iCloud.com, and notes that nothing shows if the sender has not met the requirements. Microsoft's mailboxes are not on that list, which is the single fact that should decide the budget for a business-to-business sender whose customers all work in Outlook.

Support is uneven in the other direction too. Yahoo, Fastmail and LaPoste accept self-asserted records, so a compliant SVG and an enforcing DMARC policy can be enough to show a mark there with no certificate at all. Gmail does not. If most of your list is on Yahoo, there is a free experiment available before you buy anything.

One honest caveat to carry into the decision: each provider decides where logos appear in its own apps, and can decline to show yours if it doubts your sending reputation. A valid certificate is permission, not a guarantee. That is also why we treat reputation work as the main project and the logo as the last step rather than the first.

How Guanacos Tech helps

Most of the value here is in the order of operations, and in telling a client early when the answer is no. Getting a domain to real DMARC enforcement without breaking its mail is the part that takes skill, and it is the part that protects the business whether or not a logo ever appears. We do that as email deliverability consulting for small business, and we handle the BIMI record, the SVG profile and the certificate paperwork once the domain is ready for them. Book a 30-minute call and bring your domain plus a rough idea of where your customers read their mail; that is enough for us to say whether a certificate is worth buying this year.

The Gmail blue checkmark: what BIMI actually requires, in the order you have to do it