Do I need a VMC for BIMI to work with Google and Gmail?

Summary

The overwhelming consensus from email marketers, experts, and official documentation is that a Verified Mark Certificate (VMC) is required for BIMI to display logos in Gmail. While BIMI can technically function without a VMC at other Mailbox Providers (MBPs), Google mandates it for increased trust, security, and brand legitimacy. Alternative methods for displaying logos in Gmail exist (like Google profile images), but these are not BIMI-related, may not be permanent, and don't offer the same security benefits. BIMI with VMC helps mitigate risks like brand impersonation and phishing, validating logo ownership, although the authentication provides a branding benefit more than making the actual email traffic more secure.

Key findings

  • Gmail VMC Requirement: Gmail requires a VMC for BIMI logos to be displayed.
  • Other Providers: Some providers (e.g., Yahoo, Fastmail) may not require a VMC for BIMI.
  • Trust & Security: VMC helps build trust with email recipients and confirms brand legitimacy.
  • Alternative Methods: Alternative methods for displaying logos in Gmail are available but aren't BIMI and might be impermanent.
  • DMARC alignment: To leverage BIMI you will first need to have your DMARC policies setup.

Key considerations

  • Future-Proofing: BIMI with VMC provides a more stable, long-term solution than alternatives.
  • Workarounds limitations: A VMC validates brand legitimacy and ownership of the logo helping to mitigate risks such as brand impersonation and phishing.
  • Without VMC: Without a VMC, your logo will not show in Gmail, even if you've correctly set up BIMI.
  • Branding vs Security: BIMI is more of a branding enforcement, you will still need other security measures for your emails.

What email marketers say
18Marketer opinions

The consensus among email marketers and documentation sources is that a Verified Mark Certificate (VMC) is required for BIMI to display a logo in Gmail. While BIMI can function without a VMC for other mailbox providers like Yahoo and Fastmail, Google mandates it for increased trust and security. Some marketers noted alternative logo display methods for Gmail (like Google profiles), but these are not BIMI-related and may not be permanent. While not making traffic more secure, BIMI with VMC confirms the legitimacy of the brand and is important for future-proofing brand presence. There are still considerations to be had regarding branding and security.

Key opinions

  • VMC Requirement: A VMC is mandatory for BIMI to display logos in Gmail.
  • Other Providers: Some other providers (e.g., Yahoo, Fastmail) may not require a VMC for BIMI.
  • Alternative Methods: Alternative logo display methods exist for Gmail but are not BIMI-related.
  • Security vs. Branding: BIMI with VMC is more about branding and authentication than direct security enhancement; DMARC reject provides security.

Key considerations

  • Future-Proofing: BIMI with a VMC is more future-proof than alternative methods like Google profile images.
  • Workarounds: Be aware of the limitations and potential impermanence of workarounds for displaying logos without BIMI and a VMC.
  • Security: A VMC verifies brand legitimacy and ownership of the logo; and helps to mitigate risks like brand impersonation and phishing.
  • Holistic approach: Even with BIMI and VMC, a Google-profile icon may still be needed for some parts of the Gmail interface.
Marketer view

Email marketer from Mailhardener explains that, for Gmail, a VMC is necessary for your BIMI logo to appear. This is because Gmail prioritizes security and requires proper verification.

October 2022 - Mailhardener
Marketer view

Marketer from Email Geeks states that a VMC is absolutely needed for BIMI to work with Google.

April 2021 - Email Geeks
Marketer view

Marketer from Email Geeks explains that BIMI with VMC is just branding, and DMARC = reject is what provides security. BIMI is a branding benefit for DMARC.

January 2024 - Email Geeks
Marketer view

Email marketer from Entrust states that BIMI requires a VMC to display a logo next to authenticated emails on platforms like Gmail, enhancing brand recognition and trust. The VMC verifies that the logo owner is legitimate and has the right to use the brand.

January 2022 - Entrust
Marketer view

Email marketer from Reddit says that if you specifically want the logo to show up in Gmail, you absolutely require a VMC. Without it, BIMI does not function with Gmail’s display of logos.

May 2023 - Reddit
Marketer view

Email marketer from OnlyMyEmail specifies that, for BIMI implementation in Gmail, a VMC is a mandatory requirement to have your logo displayed. It's the verification key that confirms you own the logo.

March 2022 - OnlyMyEmail
Marketer view

Marketer from Email Geeks mentions a spammer can use the workaround approach using a dummy domain with logo and create Google profile.

May 2021 - Email Geeks
Marketer view

Marketer from Email Geeks says that while Google profile image works for vanity/branding, BIMI with VMC represents an actual authorization/security upgrade.

March 2024 - Email Geeks
Marketer view

Marketer from Email Geeks clarified that the word secure in the context of BIMI is misused or misunderstood. In itself the tools involved don't necessarily make that specific traffic more secure, but it can help in the grand scheme of things.

July 2024 - Email Geeks
Marketer view

Email marketer from EmailSecuritySPF states that Gmail enforces the requirement for a VMC to display logos in conjunction with BIMI. The VMC provides a level of assurance needed to display branded logos.

September 2021 - EmailSecuritySPF
Marketer view

Email marketer from StackOverflow shares that a VMC is a must for BIMI to work with Gmail and other supporting providers. It’s a security step that provides confidence to the email platform that your logo is genuinely yours.

August 2021 - StackOverflow
Marketer view

Email marketer from Valimail confirms that a VMC is required to display your logo in Gmail inboxes using BIMI. While BIMI can technically function without a VMC at other mail providers, Google requires it to ensure a higher level of trust and security.

March 2022 - Valimail
Marketer view

Email marketer from DigiCert says that to show your logo next to emails in Gmail, BIMI requires a VMC. The certificate validates the authenticity and ownership of your logo, confirming the brand is legitimate and preventing abuse.

July 2023 - DigiCert
Marketer view

Marketer from Email Geeks mentions implementing BIMI without a VMC alongside a Google-profile icon, giving clients time to work on getting a VMC. They add that even with BIMI and VMC, a Google-profile icon is still needed for some parts of the Gmail interface.

July 2024 - Email Geeks
Marketer view

Email marketer from Agari (HelpSystems) clarifies that Gmail requires a VMC for BIMI to display a logo, asserting that a VMC increases the level of authentication and demonstrates ownership of the logo, which improves trust and protects against brand impersonation.

September 2021 - Agari (HelpSystems)
Marketer view

Marketer from Email Geeks clarifies that a VMC is currently required for BIMI to work with Gmail, but other Mailbox Providers (MBPs) may not require it.

October 2023 - Email Geeks
Marketer view

Marketer from Email Geeks shares that logos can be added to Gmail without BIMI using a Google profile and Gmail Annotations. They suggest a setup with DMARC reject, BIMI without VMC (for Yahoo!), a Google-profile, and Gmail Annotations.

November 2023 - Email Geeks
Marketer view

Marketer from Email Geeks mentions that Fastmail and Yahoo currently do not require a VMC for BIMI.

June 2023 - Email Geeks

What the experts say
3Expert opinions

Experts agree that while BIMI can be implemented without a VMC, Gmail requires it to display logos in the inbox. A VMC helps establish trust, protects users from phishing attacks, and provides a more future-proof solution compared to methods like using a Google profile image.

Key opinions

  • Gmail VMC Requirement: Gmail mandates a VMC for BIMI logo display.
  • Trust and Protection: VMC helps establish trust and protects against phishing.
  • Future-Proofing: BIMI with VMC offers a more stable, long-term solution than alternative methods like Google profile images.

Key considerations

  • Alternative Methods: While Google profile images might work currently, they aren't a long-term solution and aren't the same as BIMI logos.
  • VMC Importance: Without a VMC, your logo will not show in Gmail, even with BIMI setup.
Expert view

Expert from Word to the Wise explains that while BIMI can be implemented without a VMC, Gmail requires a VMC for displaying logos. Without a VMC, your logo won't show in Gmail, even if you've set up BIMI.

January 2022 - Word to the Wise
Expert view

Expert from Email Geeks explains that while the Google profile image works currently, it's not expected to last forever and isn't the same as a BIMI logo. BIMI is considered more future-proof.

July 2023 - Email Geeks
Expert view

Expert from Spam Resource states that Gmail requires a VMC (Verified Mark Certificate) for BIMI (Brand Indicators for Message Identification) to display your logo in the inbox. This helps establish trust and protect users from phishing attacks.

November 2024 - Spam Resource

What the documentation says
3Technical articles

Official documentation confirms that a VMC is required for BIMI to display logos in Gmail. This requirement is enforced by major providers like Gmail to ensure only legitimate senders display brand indicators, protecting users from phishing and spoofing. A VMC validates logo ownership, making it essential for BIMI's correct functionality with Gmail.

Key findings

  • VMC is Mandatory: Gmail requires a VMC for BIMI logo display.
  • Security Measure: The VMC requirement aims to prevent phishing and spoofing.
  • Validates Ownership: A VMC validates the ownership of the logo.

Key considerations

  • Functionality with Gmail: BIMI will not function correctly with Gmail without a VMC; the logo will not display.
  • DMARC Requirement: DMARC authentication is also a prerequisite for BIMI implementation.
  • Visual Impact: Without a VMC, the visual impact of the email is reduced as the logo will not be displayed.
Technical article

Documentation from BIMI Group explains that while BIMI itself can function without a VMC, major providers like Gmail require it for logo display, ensuring that the visual brand indicator is only displayed for legitimate senders. This helps protect users from phishing and spoofing attacks.

November 2024 - BIMI Group
Technical article

Documentation from Red Sift mentions that a VMC is essential for BIMI to function correctly with Gmail and other providers as it validates logo ownership. Without it, Gmail will not display the logo, reducing the visual impact of the email.

November 2022 - Red Sift
Technical article

Documentation from Google Workspace Admin Help specifies that to display your brand logo in Gmail, senders must authenticate their emails with DMARC and have a VMC (Verified Mark Certificate) associated with their BIMI record.

October 2023 - Google Workspace Admin Help