What Is a BIMI Common Mark Certificate (CMC)?

You click “Send” on an email, but the recipient doesn’t know it’s from you—just another gray inbox line. Not all authentic emails are trusted. What if your brand could be instantly recognizable in inboxes, even when you don’t have a relationship with the user?

A BIMI Common Mark Certificate (CMC) is a digital credential that confirms a brand’s identity in email traffic, using standardized branding. It allows email clients to display your verified logo alongside authenticated messages—building instant recognition and trust, especially in crowded inboxes.

Think of it like a digital business card built into the email layer itself. It’s not just for look and feel: it’s a signal that your domain has passed key email authentication checks, like DMARC, and that your logo is officially approved.

Key takeaways

  • A BIMI Common Mark Certificate (CMC) is a digital proof of branding identity tied to a domain, verified through DNS.
  • It enables email clients to display a brand’s logo next to authenticated messages, improving recognition and trust.
  • The CMC relies on existing email security protocols—specifically DMARC—to ensure the logo is only displayed for legitimately authenticated senders.

How Does BIMI Work with DMARC, SPF, and DKIM?

You need a valid DMARC policy in place for BIMI to work at all—no DMARC, no logo display. SPF and DKIM authenticate your messages, which lets DMARC enforce email policies. When DMARC is enforced and your domain passes checks, BIMI can trigger your brand's logo in supported email clients like Gmail and Yahoo.

DMARC is the gatekeeper

BIMI doesn’t work without a DMARC record that includes the p=reject or p=quarantine policy. If your DMARC policy is set to p=none, BIMI won’t activate, regardless of other settings. This means you must be actively enforcing domain-level authentication to unlock BIMI.

Once DMARC is enforced and your messages pass alignment checks, you can publish a BIMI record. That record tells the receiving mail server: “This logo is officially authorized for this domain.” The email client then checks the BIMI DNS record and, if valid and aligned, displays your logo next to the sender name.

SPF and DKIM enable the foundation

SPF (Sender Policy Framework) checks whether the sending IP is authorized to send from your domain. DKIM (DomainKeys Identified Mail) validates that the message content hasn’t been altered in transit. Both are required for DMARC to pass.

Without SPF or DKIM, your messages won’t pass DMARC alignment, and your BIMI record won’t be triggered. Even if you have a BIMI logo published, it won’t show up if the email fails authentication—your domain is essentially invisible to the DMARC system.

It’s a chain: SPF and DKIM authenticate. DMARC evaluates that authentication. If both pass, BIMI can display your logo. You can test this entire flow using tools like inbox placement testing to see how your emails are perceived across real client environments.

BIMI is not a standalone technology—it’s an extension of existing email authentication standards, not a replacement.

For brands building trust, BIMI adds a visual signal. But it only works if you're already doing domain authentication right. If you’re unsure about your current setup, verify your domain’s email infrastructure with a real-time verification API or test your full list with bulk verification before launching campaigns.

For more on email authentication standards, refer to the IETF’s RFC 7489 (DMARC) and RFC 6376 (DKIM) — foundational documents that define how these systems work together.

What Role Does the Common Mark Certificate (CMC) Play?

The Common Mark Certificate (CMC) is a signed, publicly accessible document hosted over HTTPS that verifies your brand owns a specific logo and links it to your domain. It’s not an SSL/TLS certificate, but a cryptographic proof that ensures email clients can safely display your logo in inboxes. The CMC is discovered via a TXT record in your DNS, which points to the certificate’s location, allowing receiving servers to validate it without reaching out to your site directly.

How the CMC Works in Practice

Let’s say you run an e-commerce brand and want your logo to appear next to your emails in Gmail or Outlook. You generate a CMC—a digital signature that binds your logo file to your domain. This certificate is hosted on your server at a predictable HTTPS URL, like https://yourdomain.com/.well-known/bimi/yourbrand.cmc. The key is that it’s signed with your private key, making tampering detectable.

When a receiving email server parses your BIMI record, it checks your DNS TXT record for the CMC location. It then downloads the certificate over HTTPS and verifies the signature using your public key. If the signature matches and the URL is valid, the email client displays your logo next to the sender’s name. This process is defined in the BIMI specification (RFC 8559) and trusted by email providers like Google, Yahoo, and Microsoft.

Why the CMC Is Not an SSL Certificate

It's a common misunderstanding that the CMC is just another kind of SSL certificate. It’s not. An SSL certificate encrypts traffic between a browser and a server. The CMC, instead, serves as a brand verification mechanism. It doesn’t encrypt data but provides a digital seal proving the logo is authentic and tied to your domain. This prevents attackers from hijacking your brand’s visual identity in email.

Because the CMC is a signed document, any change to the logo or domain affiliation invalidates the signature. This makes tampering evident. For this reason, it’s crucial that the CMC is hosted on a secure, stable HTTPS endpoint. You can’t use a self-signed or expired certificate—the signature must be trusted by all major clients.

For teams managing email deliverability, ensuring your CMC is correct is part of protecting your sender reputation. If the certificate is malformed or unreachable, email clients will fall back to displaying no logo or a default one, diluting brand recognition. Tools like MailTester’s inbox placement can help verify whether your BIMI setup is working across real client inboxes.

Ultimately, the CMC is the backbone of BIMI. It’s not just a logo—it’s a trust signal. And in a world where phishing campaigns often mimic legitimate brands, that signal matters.

Who Validates and Issues a BIMI CMC?

Only accredited BIMI Certificate Authorities (CAs), verified by the Internet Society’s BIMI working group, can issue and validate a BIMI Common Mark Certificate (CMC). These CAs must follow the official BIMI standard and undergo rigorous technical and operational review. Right now, only a handful of CAs are authorized, and they mainly serve large enterprises with branded email needs.

The Role of BIMI Certificate Authorities

Think of a BIMI CA as a trusted gatekeeper. When you want to display your brand logo in inboxes using BIMI, you apply through one of these CAs. They validate your ownership of the domain, confirm your branding meets BIMI’s specifications, and issue the digital CMC that enables logo display. Without a CA’s stamp of approval, your BIMI setup won’t work.

These CAs aren’t arbitrary — they must comply with the BIMI specification defined by the Internet Society. The working group oversees this ecosystem, ensuring technical consistency and security. You can find the core standard in the official BIMI RFC, which outlines how certificates are structured and verified.

Who’s Authorized Today?

Currently, the universe of approved BIMI CAs is narrow. Most focus on enterprise-grade customers who need brand consistency at scale. Smaller organizations or individual senders typically don’t qualify — BIMI is built for recognized, high-volume senders with robust security practices.

It’s important to note that not all certificate authorities can issue BIMI CMCs. For example, while Let's Encrypt is widely used for TLS, it does not currently support BIMI. This limitation reinforces the need for specialized, standards-compliant providers. The BIMI working group maintains a list of accredited CAs, but detailed public records remain sparse.

For your own email verification and deliverability checks — like confirming if a domain supports BIMI — a reliable tool like MailTester’s bulk verification can help you detect problematic addresses before sending. You can also test inbox placement with our inbox tester to see how your messages land across inboxes, including those that support BIMI branding.

As BIMI gains traction, more CAs may enter the space. But for now, the gatekeeping remains tight. If your brand is serious about email identity and inbox recognition, understanding which CAs are trusted today is a critical first step.

Can You Test BIMI and CMC Deployment Before Full Rollout?

Yes — you can test BIMI and CMC deployment before going live. Use inbox-placement testing tools that simulate real email client behavior, including BIMI logo retrieval. These tools check DNS setup, certificate accessibility, DMARC alignment, and whether logos render across major email clients, reducing the risk of misconfiguration when you roll out BIMI to all users.

How to Validate BIMI and CMC Readiness

  • Use inbox-placement testing tools that mimic actual client behavior across inboxes like Gmail, Outlook, and Yahoo.
  • Verify your BIMI DNS record is correctly published at v=BG; l=https://yourdomain.com/bimi.xml and reachable from public resolvers.
  • Ensure your CMC is properly signed, valid, and accessible via the URL specified in your BIMI DNS record.
  • Check that your domain’s DMARC policy is set to reject or quarantine and aligned with SPF and DKIM.
  • Confirm your BIMI-enabled domain shows the logo in multiple test inboxes across client clusters, including web and mobile.
  • Test across different client versions and platforms — BIMI rendering can vary even within the same email service.

Why Testing Matters

Deploying BIMI without testing exposes you to brand trust erosion. Even a single misconfigured CMC can prevent logo display in major clients. According to the BIMI specification (RFC 8617), logo retrieval is conditional on correct BIMI, DMARC, and certificate alignment — if any part fails, the logo is not shown.

Tools like MailTester’s inbox-placement testing service provide a real-world simulation of email delivery. It checks whether your BIMI-enabled domain triggers logo display across client clusters, including verification of DNS setup, CMC accessibility, and DMARC alignment. This gives you confidence before scaling to high-volume sends.

For a more thorough validation, integrate with tools that support full client simulation. Test with different senders, domains, and email clients to catch edge-case issues early.

Run your tests now — you can start with 100 free verifications at MailTester’s inbox tester and scale up as needed. No credit expiration. Use the API for automated checks in your workflow.

What Does a Failed CMC Verification Mean?

A failed CMC verification means your BIMI Common Mark Certificate isn’t valid or properly configured. This could be due to an expired SSL certificate, a mismatched domain, a missing or incorrect TXT record, or a signature issue. Without a working CMC, your brand logo won’t display in inboxes, even if your DMARC policy is set to enforce.

Common Causes of CMC Failure

  • The HTTPS URL pointing to your logo is invalid, unreachable, or serving a certificate that has expired. Check the URL and SSL chain with tools like SSL Labs’ SSL Test.
  • Your CMC’s domain doesn’t match the one in your DMARC policy. BIMI requires the domain in the CMC to exactly match the one in your DMARC record’s adkim=relaxed or asp=relaxed setting.
  • The CMC is signed incorrectly or uses a private key that doesn’t match the public key stored in the certificate. This breaks the chain of trust.
  • The required DNS TXT record for BIMI (e.g., default._bimi.example.com) is missing, misformatted, or not yet propagated across the internet. DNS propagation can take up to 72 hours.
  • You’re using a certificate that isn’t issued by a trusted Certificate Authority (CA), or it’s issued for a domain that doesn’t match your brand’s domain.

How to Fix It

Let’s walk through what to check step by step:

  • Verify your BIMI logo URL returns a valid, publicly accessible image over HTTPS. Use digwebinterface.com to check for certificate validity and expiry.
  • Confirm your DMARC record includes the correct domain for BIMI. The BIMI selector (e.g., default._bimi.example.com) must resolve to your CMC and match the domain in your DMARC policy.
  • Double-check your CMC is issued and signed by a trusted CA. You can validate the signature and chain using OpenSSL or online validators.
  • Use a DNS lookup tool like MXToolbox to confirm the BIMI TXT record exists and is properly configured.
  • Wait for DNS propagation. If you recently updated your record, wait up to 72 hours before testing again.
Even if your email passes SPF, DKIM, and DMARC, a failed CMC means your brand won’t appear in BIMI-enabled inboxes — a missed visibility opportunity at scale.

If you're managing large email lists and want to validate DMARC, CMC, and deliverability health, our inbox placement tester can help. Run your domain through inbox placement testing to see how your messages land across providers. For bulk domains or lists, check our bulk verification tool to validate infrastructure before deployment.

How Do BIMI and CMC Impact Inbox Placement and Deliverability?

BIMI (Brand Indicators for Message Identification) with a verified Common Mark Certificate (CMC) improves inbox placement by signaling authenticity to email clients like Gmail and Yahoo. When a brand shows a verified logo, it’s treated as a trusted sender—reducing the chance of filtering into spam. This visual trust signal can boost deliverability, especially in competitive inboxes.

BIMI as a Trust Signal in Spam Filtering

Major email providers use BIMI as a positive signal during spam scoring. Gmail and Yahoo incorporate BIMI verification into their filtering logic: a visible, validated logo means the sender has passed domain-level authentication checks. This doesn’t guarantee inbox delivery, but it removes a layer of suspicion that might otherwise trigger filtering.

Think of BIMI not as a magic bullet, but as an indicator that you’ve done the technical work right—SPF, DKIM, DMARC all in place, and your identity confirmed. It complements, not replaces, solid deliverability practices.

Visual Recognition Builds User Trust

When users see a consistent brand logo in their inbox, they’re far less likely to mark it as spam or skip it entirely. A real brand logo increases recognition and familiarity, especially in crowded inboxes or automated workflows.

Even small brands benefit: a verified logo doesn’t need to be flashy—it just needs to be real and consistent. This reduces the likelihood of false positives in spam detection and improves engagement over time.

Let’s be clear: BIMI doesn’t fix poor list hygiene or weak sender reputation. But for legitimate senders with clean practices, it’s a tangible way to stand out. You can test how your branding appears in real inboxes using inbox placement testing, which checks deliverability and visual rendering across major clients.

BIMI isn’t required for delivery, but it’s increasingly seen as a benchmark for brand maturity in email. The CMC is just the entry point—verifying that the logo matches a real, authenticated brand domain. Once set up, it acts as a long-term trust signal without ongoing effort. It’s one of several layered defenses that help maintain consistent inbox placement, especially when reputation is under pressure.

What Is the Relationship Between BIMI and Email Verification Tools?

MailTester and other email verification tools can’t validate a BIMI Common Mark Certificate (CMC) directly, since BIMI is about branding and visual rendering in inboxes. But they’re essential for ensuring your sending domain and individual email addresses are real, deliverable, and not tied to spam traps or disposable domains — prerequisites for BIMI to work effectively. Without proper list hygiene, even a valid CMC won’t help if your emails never reach inboxes.

Why Verification Comes Before BIMI Deployment

Before you even consider adding BIMI, your email list must be clean. A single spam trap in your send list can trigger blacklisting. Tools like MailTester help filter out invalid, disposable, or role-based addresses—common sources of bounce and reputation damage. This is not optional. You can’t deploy a visual brand signal like BIMI if your sender reputation is unstable.

Let’s be clear: BIMI works best when paired with strong deliverability practices. The CMC itself is only a marker; it doesn’t ensure delivery, inbox placement, or trust. If your sender IP is on a blocklist or your domain lacks proper SPF/DKIM alignment, BIMI will simply fail to render or may even be ignored by providers.

How MailTester Supports BIMI-Ready Lists

MailTester’s bulk verification checks entire lists in seconds, flagging invalid, risky, or disposable addresses. Use it before campaigns or BIMI rollout to ensure only valid, high-quality emails are touched. For real-time use, the MailTester API integrates with platforms like HubSpot, Klaviyo, and SendGrid, enabling instant validation during sign-up or data entry.

Even if you don’t use BIMI, cleaning your list reduces bounce rates and protects your sender reputation. But if you do want to use BIMI, you start with a list that’s verified, secure, and trustworthy. That’s what allows the CMC to be recognized across inboxes. You can't have a visual brand if the foundation is weak.

For teams managing large volumes, the inbox placement tests help verify not just address validity, but how your messages appear in real inboxes—giving insight into how BIMI might render across providers like Gmail, Outlook, or Apple Mail. Check real inbox placement here, and ensure your entire message stack supports branding.

Use MailTester’s bulk verification for large lists, or integrate the real-time API for continuous validation. Start with 100 free verifications, and never lose credits—your purchased balance never expires.

How to Check if Your Domain Supports BIMI and CMC?

You can verify BIMI and CMC support by confirming your domain has a valid BIMI TXT record in DNS, a DMARC policy set to quarantine or reject, and a CMC hosted at a trusted HTTPS URL with the correct image/svg+xml MIME type. These steps ensure your brand’s visual identity appears in supported inboxes and that your email authentication is enforceable.

  1. Check for a BIMI TXT record using a public DNS lookup tool. Use services like MxToolbox or DNS Checker to query your domain’s DNS records. Look for a BIMI TXT record with a valid v=BIMI1; version tag and a reference to your CMC URL. Without this, BIMI won’t activate.
  2. Confirm your DMARC policy is enforceable. Your DMARC record must be set to p=quarantine or p=reject — not p=none. This signals to receiving servers that failing authentication should result in action, not silence. Include a rua tag to collect aggregate reports, which help track enforcement effectiveness.
  3. Validate that your CMC is hosted securely and correctly. The CMC (Common Mark Certificate) must be served over HTTPS from a domain you control. The server must return an image/svg+xml MIME type and a valid certificate chain. Misconfigured hosting breaks BIMI rendering even if the record exists.
  4. Test the CMC URL with a real image validator. Use tools like W3C’s SVG validator to ensure the file conforms to the SVG specification. Invalid or malformed SVGs will not render in inboxes, even with correct DNS and DMARC.
  5. Verify the entire flow through inbox placement testing. Use a trusted service like MailTester’s inbox placement test to send a real message through multiple major providers. Check if the brand icon appears. Not every inbox renders BIMI, but those that do use the CMC to verify authenticity.

Why Each Step Matters

Skipping DNS validation or misconfiguring DMARC undermines the entire email trust stack. A BIMI record without enforceable DMARC is ineffective — mail providers will ignore it. Even correct DNS records fail if the CMC is not served with the right MIME type or a valid TLS certificate.

Common Pitfalls to Avoid

  • Using HTTP instead of HTTPS for CMC hosting — most clients block insecure content.
  • Hosting the CMC on a third-party domain you don’t control — undermines trust.
  • Using a non-SVG format like PNG or JPG — BIMI only supports SVG.
  • Not setting p=reject — weak policies don’t trigger enforcement.

Correctly configured BIMI and CMC improve brand recognition and signal legitimacy, but only when all components are present, correct, and tested. Use MailTester’s bulk verification or API to assess domain-level readiness across large lists.

Common Misconceptions About BIMI and CMC

You don’t need a BIMI Common Mark Certificate (CMC) to show your logo in all email clients, and displaying a logo doesn’t raise your domain authority or guarantee inbox placement. BIMI is about visual trust, not deliverability. A logo only appears in clients that support BIMI standards, and your sender reputation — built over time through engagement, authentication, and sending behavior — still determines if your email reaches the inbox.

BIMI Is Not a Deliverability Shortcut

  • BIMI does not improve inbox placement on its own — even with a verified logo, poor sender reputation or high complaint rates will still trigger filters.
  • Having a BIMI logo doesn’t mean your domain has higher authority; it’s a visual signal, not a technical one.
  • Only email clients that support BIMI (like Gmail, Yahoo, and some Outlook implementations) will display the logo — most clients won’t show it regardless of CMC.
  • You can test real-world inbox placement and detect delivery issues using tools like MailTester’s inbox placement tester to see how your message lands across major providers.

CMC: Not Always Required, Not a Silver Bullet

  • A CMC is only needed if you’re using a third-party BIMI service; some organizations host BIMI records directly via DNS.
  • Not every BIMI-enabled client requires a CMC — the standard allows for multiple implementation paths, including direct DNS or third-party services.
  • BIMI’s primary role is to build brand recognition through logo display — not reduce spam filtering or increase open rates on its own.
  • You can validate email addresses and detect risky sender behavior with MailTester’s bulk verification or the real-time API to ensure your list is clean before relying on BIMI.
“BIMI is not a deliverability fix. It’s a trust signal.” — RFC 8913: BIMI

Let’s be clear: a logo doesn't mean trust. It only signals that your domain has verified ownership of a brand asset. Real trust comes from consistent sending, low bounce rates, and user engagement. Check your sender reputation and list hygiene regularly using proven tools. A BIMI-compatible logo is a nice-to-have, not a must-have for email success.

Why BIMI Matters for Email-Driven Marketing in 2026

As inboxes grow more crowded, visual branding is no longer optional. It's a functional tool to cut through noise and signal legitimacy.

BIMI, through the BIMI Common Mark Certificate (CMC), enables brands to display a verified logo in recipients’ inboxes—establishing recognition before the email is opened.

This early trust improves engagement, reduces accidental deletions, and lowers spam complaint rates by reinforcing sender authenticity.

Sources

Keep reading

Ready to put this into practice? MailTester verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Does every email client support BIMI?

No—only clients like Gmail, Yahoo, and certain enterprise email platforms support BIMI. Others may ignore it.

Can I use BIMI without a DMARC record?

No. A valid DMARC policy with enforcement is required for BIMI to function. Without it, BIMI is ignored.

How long does it take to deploy a BIMI CMC?

After securing the CMC from a trusted CA and publishing the DNS record, it can take 24–72 hours for propagation.

Do I need a separate CMC for each brand subdomain?

Yes—each domain or subdomain that wants to display a BIMI logo needs its own approved CMC and DNS record.

What happens if my CMC expires?

The logo will no longer display in supported clients until the certificate is renewed and re-published.

Can BIMI help avoid spam filters?

It helps indirectly by improving sender reputation and trust signals, but does not bypass technical filters.

Is BIMI required for email deliverability?

No—BIMI is a branding and trust enhancement tool. It is optional but beneficial for recognized brands.

Can I test BIMI without sending real emails?

Yes—tools like MailTester’s inbox-placement testing simulate BIMI display without sending actual messages.

What file format should the BIMI logo be?

SVG is preferred, though PNG and other formats may be accepted if properly served with the correct MIME type.

Does a BIMI logo affect email file size?

Minimal impact—SVG files are small, but the logo is cached. Performance is not significantly affected.

How does MailTester help with BIMI readiness?

MailTester does not issue CMCs, but its verification tools clean and validate your email list, which supports sender reputation—critical for BIMI success.

Can BIMI prevent spoofing?

It reduces the chance of spoofed emails appearing as your brand, but only when paired with DMARC enforcement.