Topic starter
24/06/2026 7:13 pm
TL;DR: BIMI only works when SPF, DKIM, and DMARC are aligned and enforced, and DigiCert’s guide shows how VMCs and CMCs fit into that workflow for logo display in supported inboxes. For identity teams, the real issue is not branding but whether mail authentication has reached a trust threshold that resists spoofing.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “DigiCert Mark Certificates for BIMI: Setup guide for VMC and CMC”.
Key questions
A: The main failure is trust mismatch.
Q: Why do SPF and DKIM still matter if BIMI uses a mark certificate?
A: Because the certificate does not replace message authentication.
Q: What are the signs that a BIMI deployment is failing in practice?
A: A BIMI deployment is usually failing when authenticated mail is still not showing the logo in supported inboxes.
Practitioner guidance
- Enforce DMARC after sender inventory is complete Move from p=none to quarantine or reject only after every legitimate sender, subdomain, and third-party mail flow is mapped and aligned.
- Validate SPF and DKIM alignment on real sends Check message headers from production mail, not test-only paths, to confirm the visible From domain aligns with authenticated sending identities.
- Publish and test a BIMI-compliant SVG Use a square logo file with the expected SVG Tiny PS constraints, then verify that no scripts or external references are present before DNS publication.
Bottom line: BIMI depends on enforced email authentication, not just a branded logo or a valid certificate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
25/06/2026 4:24 am
DMARC enforcement is the real trust threshold for BIMI, not the logo asset itself. BIMI depends on the mailbox provider believing the domain has reached an enforced authentication state, which makes the control question about sender legitimacy rather than marketing presentation. That shifts the programme conversation from visual branding to domain trustworthiness across every sending source. The practitioner conclusion is simple: if DMARC is not enforced, BIMI is not yet a reliable identity signal.
A few things that frame the scale:
- 48% of organisations cite cloud-based services as a driver for PKI deployment, according to the 2023 State of Machine Identity Management report.
A question worth separating out:
Q: Should teams use a VMC or a CMC for BIMI?
A: Use the certificate type that matches the assurance level and mark status you can actually support. A VMC is tied to registered trademark conditions and may support a stronger verification experience in some inboxes, while a CMC broadens access for organisations that cannot meet that requirement. The decision should follow governance and legal readiness, not visual preference.
👉 Read our full editorial: BIMI depends on DMARC enforcement and verified mark setup
This post was modified 4 days ago by NHI Mgmt Group