Get your logo in the inbox: a BIMI and Mark Certificate checklist 

A practical path from email authentication to a Mark Certificate—so your brand can show up as you in the inbox.

You already know a professional email address builds trust. The next step is visual: helping customers recognize your brand the moment a message lands, before they even open it.

That’s the promise of Brand Indicators for Message Identification (BIMI). Participating mailbox providers can display a brand-controlled logo next to messages that pass strong authentication. 

The catch? Hosting a Scalable Vector Graphic (SVG) of your logo isn’t enough. You need proof that the logo belongs with your domain—and that proof is a Mark Certificate.

This guide walks through a practical checklist: prepare authentication, choose VMC or CMC, get your logo ready, publish BIMI DNS, and set the right expectations for what recipients may see.

What is a Mark Certificate?

A Mark Certificate is a digital certificate, issued by a certificate authority (CA), that verifies your organization's identity and its right to display a specific logo in email. Think of it as a credential for your brand mark: the CA checks who you are, confirms you control the sending domain, and validates that the logo belongs to you—then packages that proof into a certificate that mailbox providers can check automatically.

There are two types. A Verified Mark Certificate (VMC) is built on a registered trademark. A Common Mark Certificate (CMC) is built on documented prior use or an allowed modification of a registered mark. Both embed a verified representation of your logo so relying parties know exactly what was validated—and by whom.

Without a Mark Certificate, a BIMI record is just a pointer to an image file. With one, it's a verified claim.

What is BIMI?

Brand Indicators for Message Identification (BIMI) is an email specification that lets you publish your brand logo in DNS, so participating mailbox providers can display it next to your messages without a recipient opening them first. Instead of a generic initial or a blank avatar, customers see your logo in the inbox, tied to your authenticated sending domain.

BIMI doesn't work in isolation. It sits on top of email authentication: your domain needs SPF, DKIM, and DMARC in place first, and DMARC typically needs to be at enforcement. Only once those pass does a mailbox provider have enough confidence to fetch and display the logo your BIMI record points to.

The BIMI specification handles where to find your logo. A Mark Certificate handles why it should be trusted.

What BIMI and a Mark Certificate actually do

BIMI is the display standard. Your domain publishes a DNS record that points mailbox providers to your logo (and usually a certificate).

A Mark Certificate is the trust artifact. A certificate authority verifies your organization, your domain, and your right to use the mark, then embeds a verified logo representation in the certificate.

Together, they help mailbox providers answer: Is this sender allowed to show this brand mark?

That matters because lookalike senders try to borrow trust from familiar logos. Strong authentication (SPF, DKIM, DMARC) reduces spoofing; a Mark Certificate adds verified branding on top. 

How to get your logo displayed with a Mark Certificate

1. Use a domain-based professional email

BIMI is built for authenticated mail from your domain—not a free consumer inbox.

If you’re still sending as you@freemail.com, start with a professional email address on your domain. Brand recognition in the inbox begins with the address customers see.

2. Get SPF, DKIM, and DMARC healthy

Mailbox providers will not treat BIMI as a shortcut around authentication.

Aim for:

• SPF: Which servers may send for your domain
• DKIM: Cryptographic signature on outbound mail
• DMARC: Policy that tells receivers what to do when SPF/DKIM fail

For BIMI’s verified path, you typically need DMARC at enforcement (p=quarantine or p=reject), not monitor-only. Some providers (notably Gmail) also expect DMARC to be applied to 100% of mail.

Use the DNS for email guide to check records, then confirm mail is authenticating before you invest in a Mark Certificate.

3. Choose VMC or CMC

Under Mark Certificate rules, the big fork is how your mark is verified—not how much “crypto” is in the file.

Display varies by mailbox provider. In Gmail, both types can show a logo; the blue checkmark is associated with VMCs. Other clients may support VMC only, or apply different rules. Always frame results as what participating/supporting clients may show—not a promise that every inbox will render your mark.

4. Prepare your logo the right way

Mark Certificates won’t accept just any PNG from the brand folder.

Prepare to:

1. Supply a logo as SVG Tiny PS (the secured SVG profile used for Mark Certificates)
2. Match the evidence path you chose (trademark record vs. prior-use history vs. allowed modifications)
3. Follow color rules that apply to your mark type (especially for registered design/combined marks)

Product tip: if your logo only lives at a mutable website URL, pixels can change later. The Mark Certificate embeds a verified representation, so relying parties check what the CA actually validated.

If you’re still defining visual identity (colors, logo usage, brand kit), tighten that first with the brand identity guide—then convert the approved mark into SVG Tiny PS.

5. Apply for the Mark Certificate

Expect more than a same-day domain validation. Issuance typically includes:

• Organization identity checks
• Proof you control the email domain
• Mark verification (VMC or CMC path)
• Additional security checks used by modern public CAs

Bring your trademark number (for VMC) or archive evidence (for prior-use CMC), plus the SVG you want embedded. Clear expectations up front reduce back-and-forth: “pretty logo” that doesn’t match the trademark or the 12-month history won’t pass.

For a deeper look at how GoDaddy’s Mark Certificate validation works, see How GoDaddy issues Mark Certificates for BIMI.

6. Publish BIMI DNS

After you have the certificate and a hosted logo/certificate bundle per your CA’s instructions:

1. Add the BIMI TXT record for your domain
2. Point it at the logo and certificate locations your provider specifies
3. Allow DNS and mailbox-provider processing time (often up to ~48 hours, sometimes longer)

Your BIMI record only helps if SPF/DKIM/DMARC still pass on the messages you send.

7. Validate and maintain

• Send test messages to supporting mailbox apps (for example, Gmail) and confirm authentication first, then branding
• Monitor certificate expiration and renewal like any other public certificate
• Revisit the mark if you rebrand—logo changes can require a new validation path

Also, keep everyday email hygiene strong. Authentication and branding help, but they’re not a substitute for protecting accounts against business email compromise.

Common roadblocks (and how to unblock them)

Closing

Getting your logo in the inbox isn’t a single DNS toggle. It’s a sequence: professional domain email → authenticated sending → the right Mark Certificate → BIMI DNS → realistic expectations by client.

Do that well, and customers get a clearer signal of who’s emailing them—backed by evidence, not just a pretty attachment.

Related reading

• Configuring DNS for email: a quick beginner’s guide
• Benefits of professional email for business
• Brand identity guide
• What is business email compromise
• Minimum Security Requirements for Issuance of Mark Certificates