BIMI logo display in major inboxes generally requires DMARC at enforcement, a compliant SVG Tiny P/S logo, and a mark certificate (VMC or CMC, sometimes GMC). Google’s BIMI Help describes VMC as recommended when you can trademark the logo, and CMC when you cannot. The steps below turn that into a purchase-prep runbook.
- Confirm DMARC enforcement. Move to p=quarantine or p=reject with aligned SPF/DKIM. Certificate issuers and mailbox providers expect this before BIMI works.
- Inventory trademark status. If the logo is registered with an office VMC issuers recognize, prefer the VMC path for checkmark-oriented goals.
- If no trademark, gather prior-use evidence. Collect ~12 months of public logo display on a domain you control (archives, site history). That supports CMC eligibility discussions with a CA.
- Run this site’s checklist. Copy the path and ship checklist into your ticket so legal/marketing/infra agree on VMC vs CMC vs wait.
- Prepare SVG Tiny P/S artwork. Most design tools do not export this profile cleanly — budget conversion time before paying the CA.
- Pick a CA product. Compare DigiCert/SSL.com/others for VMC vs CMC availability, price, and evidence checklists.
- Host certificate and logo over HTTPS. Point BIMI
l=anda=URLs at reachable resources; publishdefault._bimionly when both work. - Validate with your provider’s expectations. Gmail checkmark behaviour and Apple Mail docs differ by certificate type — re-read live Help the week you go live.
This is not a CA substitute and not trademark legal advice.