The Free Step Does the Work

I do not sign off on a thing because the vendor says it works. I sign off because I put my hand on it.

So when a checklist has five steps and one of them costs $1,668 a year, my first question is not whether the five steps work. It is which step is holding the weight, and whether the expensive one is doing anything the free one is not already doing.

TL;DR: BIMI puts your logo next to your name in the inbox. The full requirements are SPF and DKIM, DMARC set to quarantine or reject, an SVG logo, a trademark registered with an approved office, and a Verified Mark Certificate from DigiCert at $1,668 a year, $1,501.20 with the promo code, renewed annually. Yahoo, AOL, Gmail and Apple Mail support it, covering 89.9% of the market. Microsoft Outlook and Office do not. My verdict: step two is the entire deliverable, it is free, and most people who ask me about BIMI have not done it.

What is actually being sold here?

A logo. That is the product. Your mark appears next to the sender name in the inbox list, which is a real trust signal and a real differentiator in a crowded folder.

Support is uneven and the unevenness matters. Gmail and Yahoo display the logo in the mobile inbox view and inside opened messages on desktop and mobile. Apple is more limited: logos appear only after the message is opened, and only on mobile. Microsoft shows nothing at all, in Outlook or Office.

The 89.9% figure is the coverage number people quote, and it is accurate for the three providers that support it. Read it carefully though. Coverage of the market is not coverage of your list. If a meaningful share of your subscribers are at work behind Outlook, your effective coverage on this feature is whatever fraction of your list is not, and nobody quotes that number because only you can compute it.

The five steps, and which one holds the load

Walk it in order.

Step 1: SPF and DKIM. Sender authentication. Free, configured through whatever service sends your mail. Table stakes, and if you are sending any real volume you almost certainly have this already.

Step 2: DMARC at quarantine or reject. This is the step. The article is explicit that BIMI does not function unless DMARC enforcement is set to quarantine or reject, and that a policy of none disqualifies you.

Here is what that setting actually does, stated plainly, because the BIMI framing buries it. DMARC tells receiving mail servers what to do with a message that claims to be from your domain and fails authentication. At none, the answer is “deliver it anyway and send me a report.” At quarantine or reject, the answer is “put it in spam” or “refuse it outright.”

In other words: none means anyone can send mail as you and it will land in inboxes. quarantine or reject means they cannot.

That is anti-spoofing. It protects your subscribers from someone impersonating your newsletter to phish them, and it protects your domain reputation from being burned by traffic you did not send. It costs nothing. It is a DNS record.

Step 3: SVG logo and a BIMI DNS record. Free, mechanical, half an hour.

Step 4: A registered trademark. Your mark must be registered with an approved trademark office, and the article lists the US, EU, UK, Canada, Japan, Australia and eight others. This is the quiet gate. If you do not have a registered trademark, you are not getting a VMC, and trademark registration is its own multi-year, multi-hundred-dollar process with a lawyer attached.

Step 5: The VMC. $1,668 annually through DigiCert, $1,501.20 with the promo code. Verification includes an identity confirmation over video chat and notarized documentation. Multiple logos require multiple certificates. It renews every year, at full freight, forever.

The verdict

Steps 1 through 3 are free and do real work. Step 2 is the one that changes your security posture. Steps 4 and 5 buy a picture.

The article’s own recommendation is that BIMI makes sense primarily for “large business or a major sender of emails,” and I agree, but I want to put a harder number on why.

$1,668 a year, every year, before you have paid for the trademark. Against a benefit you cannot measure, and the article is honest about this too: Apple’s Mail Privacy Protection interferes with open-rate tracking, so the metric you would use to prove the logo is working is the metric least able to prove it.

I have failed things on less than that. A control you cannot measure is a control you are taking on faith, and faith is not a QA result. If you cannot A/B it, you cannot claim it worked, and with this one you cannot A/B it, because BIMI is domain-level. You do not get a holdout group.

What I would actually do

The order I would work it, for anyone sending to a list of any size:

• Set DMARC to quarantine or reject. This week. Start at p=quarantine with a low percentage if your setup is complicated, read the reports, then move to full enforcement. This is the single highest-value item and it has nothing to do with logos.
• Confirm SPF and DKIM actually pass. Not that they are configured. That they pass, on a real message, checked from the receiving side. Send yourself mail at a Gmail address, open the original, read the authentication results header. Configured and working are different states and I have found a gap between them more often than not.
• Do the SVG and the BIMI record anyway if you already hold a trademark. Some providers show a logo without a VMC under certain conditions, the cost is an hour, and the record does no harm.
• Skip the VMC until the logo is worth $1,668 to you. That threshold arrives when you are large enough that impersonation is an active problem and brand recognition in the inbox list is a measurable part of your open rate. If you cannot say out loud what it would earn you, you are buying reassurance.

Resend has a walkthrough for the Apple Mail side of this if you want the specific provider steps, and the Common Mark Certificate piece covers the cheaper certificate class for anyone without a registered trademark, which has its own narrower support.

The gate gets stamped when the seam holds. Not when it looks good.

Frequently asked questions

Is a Common Mark Certificate a cheaper way to get the same result?

It is a different certificate class intended for senders without a registered trademark, and the tradeoff is narrower support across mailbox providers. It is worth reading the specifics before assuming it substitutes cleanly, because the value of the whole exercise depends entirely on which of your subscribers’ providers will actually render the logo. A cheaper certificate that displays for a smaller share of your list is not obviously a better deal than no certificate at all.

Will moving DMARC to quarantine break my existing mail?

It can, and that is exactly why you test rather than flip it blind. Any service sending on your behalf that is not covered by your SPF record or signing with DKIM will start failing, and the usual casualties are a form provider, a CRM, or an invoicing tool somebody set up years ago. Run at p=none first, read the aggregate reports until you can account for every sending source, then enforce. The reports exist precisely so this is a measured change instead of a gamble.

If I cannot measure whether BIMI works, how would I ever justify it?

By measuring the thing it is a proxy for rather than the logo itself. A sender large enough for this generally has evidence of the underlying problem already: phishing complaints from subscribers, spoofed messages in the wild, support tickets asking whether an email was really from you. When that evidence exists, the certificate is buying a mitigation you can point at. Absent that evidence you are purchasing a visual upgrade, which is a legitimate thing to want and should be budgeted as one.