BIMI without VMC: is it possible (and is it a good idea)?

What actually shows without a certificate

In practice, a BIMI record with no certificate produces a very uneven result: a few smaller, historically more permissive inboxes may display the logo from the l= alone; but the majority inboxes will not. In other words, the preparation gets done (DMARC enforcement, compliant logo, hosting) without the bulk of the benefit being captured — visibility in Gmail and the large inboxes.

That coverage evolves and depends on each provider's policies, but the underlying rule is stable: the larger and more fraud-exposed an inbox, the more proof it requires. It is logical, and no relaxation should be expected.

The CMC: the certificate for logos without a registered trademark

Between "nothing" and "VMC" there is a middle ground: the CMC (Common Mark Certificate). It addresses precisely the organisations that cannot obtain a VMC because they have no registered trademark — government-entity logos, longstanding marks of use, organisations that never filed.

The CMC attests use and identity without resting on a trademark registration, which makes it accessible to organisations excluded from the VMC. In return, it is not accepted by all providers: to date, Apple Mail recognises it, but Gmail relies on the VMC. The CMC is therefore a real option when the Apple ecosystem is the priority, or when a VMC is structurally out of reach — but it does not unlock Gmail. The choice between the two comes down to the inboxes being targeted, a trade-off also covered in the verified-mark certificate article.

Provider requirements at a glance

Deciding whether a certificate is needed means knowing what each inbox requires — the general rule being "the larger the inbox, the more proof it demands":

• Gmail: requires a VMC. Without it, no logo, period. It is the inbox that, on its own, most often justifies the investment.
• Apple Mail (recent versions): accepts a VMC or a CMC. It is the main entry point for organisations without a registered trademark.
• Yahoo Mail: requires a certificate (VMC).
• Smaller inboxes: some display the logo from the l= alone, with no certificate — but their weight in a consumer base is marginal.

The practical consequence: targeting Gmail mandates a VMC; targeting Apple only opens the CMC path; settling for permissive inboxes sharply reduces reach.

VMC or CMC: how to decide

The choice comes down to two questions. Is there a registered trademark? If yes, the VMC is the full path, covering Gmail and the rest. If not, it is out of reach without first registering a mark (several months). Which inboxes are targeted? When Gmail is unavoidable for the audience, there is no alternative to the VMC. When that audience sits mostly on Apple, or when a logo "where possible" is worth having without the cost and delay of a trademark filing, the CMC becomes a serious option. Many organisations end up aiming for the VMC eventually, while starting more modestly — but the move is worth making eyes open on what each level unlocks.

"Published" is not "displayed"

The most common reasoning error around BIMI: believing that publishing a record is enough. Publishing a BIMI record is trivial; getting the logo to display is the real work, and it depends entirely on compliance (DMARC enforcement, correctly-formatted logo, certificate accepted by the targeted inbox). A record published with no certificate, for a Gmail audience, is a record that produces no visible logo — technically valid, practically inert. Measuring BIMI's success means looking at what recipients actually see, not at what the DNS zone contains.

The hidden cost of doing nothing

One point gets forgotten when weighing a VMC's cost: the absence of a logo is not neutral. Where competitors display theirs, a grey avatar or generic initial looks, by contrast, less established — and above all, it offers no visual protection against impersonation. A fraudulent email sent in a brand's name, in an inbox where that brand has no logo, does not stand out; in an inbox where the logo is usually present, its absence becomes a warning sign for the attentive recipient. Forgoing the certificate therefore means forgoing both a brand asset and an anti-fraud cue. It is not necessarily the wrong call — for a small organisation with no registered trademark, the maths can favour waiting — but the call deserves to be made deliberately, cost against benefit, rather than by default.

The trend does not reward waiting

Is it worth waiting for providers to relax their requirements? Nothing suggests they will. The ecosystem's direction is toward more proof, not less: domain authentication has become a prerequisite for bulk sending, and logo verification follows the same anti-fraud logic. Betting on a Gmail that would one day accept the l= alone would be unwise. Where the verified logo figures among the goals, better to start the path — trademark, enforcement, certificate — than to wait for a leniency that has no reason to come.

A staged approach

For many organisations, BIMI is not a single decision but a progression. A sensible staging: first, reach DMARC enforcement (the non-negotiable base) and publish an l=-only record to validate the DNS and logo pipeline; then, where Apple is the target and no registered trademark exists, add a CMC to light up that ecosystem; finally, where Gmail matters to the audience, invest in the trademark and VMC for full coverage. Each step is reversible and builds on the last, so nothing stays blocked waiting for the most expensive piece before any value is captured. The mistake is to treat it as all-or-nothing — either skip BIMI entirely or wait months for a VMC — when a staged path shows something to some recipients much sooner, then widens coverage as the pieces fall into place. Just keep the measure honest at every stage: track what recipients actually see, inbox by inbox, rather than assuming a published record equals a visible logo. And document which stage the setup has reached, so the next person to touch it knows whether the absence of a Gmail logo is a bug or simply the stage that was chosen.

The real prerequisite is still DMARC

A reminder that holds for all these variants: nothing shows, VMC or not, until the domain is at DMARC enforcement. The certificate question only arises after reaching p=quarantine or p=reject. A domain at p=none will display no logo, with or without a certificate — the foundation is recalled in getting to p=reject without breaking the mail flow and the verified BIMI logo in Gmail.

Recommendation

For a consumer-facing brand that is already registered, the VMC is the target: it is the only path to Gmail, and the benefit justifies the cost, especially for spoofed sectors like finance. Without a registered trademark, the CMC deserves evaluation for the Apple ecosystem, or an l= alone in the meantime — bearing in mind that the bulk of the Gmail audience will stay out of reach without a VMC.

And before anything, the foundation deserves a check: a pass through our free DMARC analyzer confirms whether the domain is enforcing, and the DMARC Observatory situates that posture among peers. Bringing a domain to p=reject — the step that conditions everything else — is precisely what Thomas, the virtual CISO, takes on. Analyze a domain for free · explore the Observatory · get started with Thomas.