BIMI with VMC — Cost, Process, and Whether It's Worth It

VMC (Verified Mark Certificate) costs $1,500/yr per domain and takes 4-8 weeks to obtain. This guide walks the cost math, the trademark requirements, the alternative paths, and a decision framework for whether VMC is right for your sending program.

Quick decision framework

You should get a VMC if... You should skip VMC if...
Gmail is >30% of your audience Audience is mostly Yahoo / Apple Mail / B2B
List size >100k subscribers List <10k subscribers
Brand has registered trademark in target market No registered trademark; just a logo
Engagement (open rate) is your conversion driver You sell on click-through, not visibility
Budget for $1,500/yr + 4-8 week setup Tight budget; need BIMI now

Below 100k subscribers, the VMC cost rarely pays back from incremental opens. Above that, payback is typically 3-6 months for Gmail-heavy lists.

Cost breakdown

Item Cost Notes
VMC certificate $1,500-$2,000/yr per domain From Entrust or DigiCert
Trademark application (if not already registered) $250-$2,000 $250 USPTO filing fee + attorney time if needed
SVG logo prep 0-$500 Free if designer can do BIMI-compatible SVG; paid service if not
DNS / hosting setup 0 Standard DNS + your web host
Ongoing renewal Same as cert cost Renew yearly
TOTAL Year 1 $1,500-$5,000 Depends on trademark status
Year 2+ $1,500-$2,000 Just renewal

The 8-week setup timeline

Week 1:  Submit trademark application (if not already registered)
Week 1:  Submit VMC application at Entrust or DigiCert
Week 2-6: VMC issuer verifies trademark registration via USPTO / equivalent
Week 4-6: VMC issuer requests SVG logo (must match trademark exactly)
Week 6-7: SVG validation + certificate creation
Week 7-8: Certificate delivered + customer publishes BIMI DNS record
Week 8+: Gmail's BIMI cache picks up the record (24-48h)

For trademark applications, allow 3-6 MONTHS for USPTO approval if starting from scratch. Most senders already have registered trademarks for their brand — VMC is a renewal-style purchase.

VMC providers

Two main providers:

Provider Cost Notes
Entrust $1,500-$1,800/yr Larger market share; more documentation
DigiCert $1,500-$2,000/yr Faster issuance for fully-prepared applications

Both offer multi-year discounts (Year 1 + Year 2 paid upfront = ~10% off).

Trademark requirements

VMC requires a registered trademark for your logo. Specifics:

  • United States: USPTO registration (live application; not pending)
  • EU: EUIPO or national trademark
  • Canada: CIPO
  • Asia: National-trademark per jurisdiction

VMC issuer checks the public trademark database. Logo on the SVG MUST match the trademarked logo exactly — no minor variations.

If your logo isn't trademarked:

  1. File at the appropriate office ($250 USPTO + ~3-6 month wait in the US)
  2. Wait for registration approval
  3. THEN apply for VMC

Most senders treat this as a brand-protection investment they'd do anyway.

Alternative: BIMI without VMC

Yahoo + Apple Mail + Fastmail support BIMI without VMC. Skip the VMC; publish only the SVG + BIMI DNS record:

TXT default._bimi.yourdomain.com  "v=BIMI1; l=https://yourdomain.com/bimi/logo.svg"

Result:

  • Logo appears in Yahoo, Apple Mail, Fastmail
  • Logo does NOT appear in Gmail (uses default circle-initial fallback)

For senders whose audience is <30% Gmail, this is the cost-effective starting point. Add VMC later if Gmail engagement scaling becomes a priority.

Verify your BIMI setup

After publishing the DNS record + SVG (with or without VMC):

Open the sending-domain detail

In AcelleMail's sidebar, Sending → Sending domains. The list shows every domain you've registered with status chips (Verified / Pending / Failed) and per-auth indicators:

Sending domains list

Click into your domain row. The detail page surfaces exactly which DNS records to publish (TXT for SPF, CNAMEs for DKIM, TXT for DMARC) with copy-paste-ready values + current verification state per check:

Sending-domain detail — DNS records + auth status

Send a test campaign. Open on the supported clients:

  • Gmail (US/EU): needs VMC
  • Yahoo: supports BIMI; no VMC needed
  • Apple Mail (iOS 16+, macOS Sequoia+): supports BIMI; no VMC needed
  • Fastmail: supports BIMI; no VMC needed
  • Outlook: pilot only as of 2026; check current state

If logo appears: BIMI working. If not: check the BIMI setup walkthrough for diagnostic flow.

Decision: pay for VMC or skip?

Build the math from your own audience + list size:

Annual VMC cost: $1,500
Expected open rate lift: 10% (industry baseline for BIMI)
Your current open rate: X% (check your AcelleMail campaign reports)
Your monthly campaign sends: N
Conversion rate of opens to revenue: Y%
Per-conversion value: $V

Annual incremental opens = (open rate lift) × (sends) × (your Gmail %)
Annual incremental revenue = Annual incremental opens × Y × V

If Annual incremental revenue > $1500: VMC pays back. Get it.
If Annual incremental revenue < $1500: Skip VMC; revisit when list grows.

For most senders with >100k subscribers + >25% Gmail audience, the math is clear positive.

Common UI signals + fixes

Symptom Likely cause Action
Yahoo shows logo, Gmail doesn't Expected behavior without VMC Apply for VMC if Gmail audience matters
VMC issued but Gmail still doesn't show logo DNS cache propagation in progress Wait 24-48h; verify dig TXT default._bimi.yourdomain.com includes a= parameter pointing to VMC
BIMI inspector says SVG invalid Not SVG Tiny PS format Re-export via designer's BIMI-compatible profile
Trademark application rejected Logo too similar to existing mark Brand redesign OR file in different class
VMC issuer takes >8 weeks Trademark verification edge cases Provide additional documentation; some applications take 12+ weeks
Advanced: multi-domain VMC strategies + selector-based BIMI + cost optimization at scale

Multi-domain VMC:

Per-domain VMC cost — each unique From: domain needs its own VMC + DNS record. If you send from 3 brand subdomains:

mail.brand.com    — separate VMC
news.brand.com    — separate VMC
events.brand.com  — separate VMC

3 × $1,500 = $4,500/yr. Multi-domain VMC discounts available from both providers (15-25% off for 5+ certificates).

Selector-based BIMI for A/B testing or per-campaign logos:

TXT default._bimi.brand.com    "v=BIMI1; l=https://.../primary.svg; a=https://.../vmc.pem"
TXT holiday._bimi.brand.com    "v=BIMI1; l=https://.../holiday.svg; a=https://.../vmc.pem"

In campaign email headers:

BIMI-Selector: holiday

Same VMC, different logo per campaign. Useful for seasonal campaigns.

Cost optimization at scale:

For SaaS operators offering BIMI as a customer feature:

Option Math
Per-customer VMC $1,500/yr × N customers = expensive
Single SaaS VMC + customer-pays-trademark $1,500/yr ÷ N customers — much cheaper
White-label aggregator (e.g. ValiMail BIMI service) $5-50/customer/mo with VMC handling included

Most SaaS providers offering BIMI use option 3 — turnkey BIMI via partner aggregator vs. building per-customer VMC ops.

Alternative DNS-only approach (no VMC) for trademark-pending brands:

If trademark application is pending, you can:

  1. Publish BIMI DNS record without a= parameter (no VMC)
  2. Yahoo + Apple + Fastmail show logo
  3. Apply for VMC once trademark approved
  4. Update DNS record with a= parameter
  5. Gmail then shows logo

Two-phase rollout. Easier than waiting for full setup.

Renewal monitoring:

# Daily check — alert if VMC expires within 60 days
expiry=$(openssl x509 -in /path/to/vmc.pem -noout -enddate | cut -d= -f2)
days_left=$(( ($(date -j -f "%b %d %T %Y %Z" "$expiry" +%s) - $(date +%s)) / 86400 ))
if [ $days_left -lt 60 ]; then
  echo "🚨 VMC expires in $days_left days — initiate renewal"
fi

Wire to Slack / PagerDuty. VMC expiry without renewal causes Gmail to silently stop showing your logo (no auto-alert from Gmail or Entrust/DigiCert; bring-your-own-monitoring).

Aggregator services for the hassle-free path:

  • ValiMail — manages BIMI + VMC for ~$25-50/customer/month
  • Red Sift / OnDMARC — comprehensive DMARC + BIMI management
  • DMARCLY — budget-friendly DMARC + BIMI

For small senders ($1500/yr VMC = significant cost), aggregators amortize the cost across many customers.

Related articles

14 Kommentare

8 Kommentare

  1. sofia.costa.pt
    If you use Vercel or Netlify for the apex, watch out — they sometimes override TXT records via their auto-DNS feature. Bit us once with a stripped SPF record.
  2. akira.tnk88
    What's your recommendation for sub-domains? We send from mail.example.com AND notifications.example.com. Same DKIM selector or separate?
    1. admin
      Good catch. The bounds (200/32) are hardcoded in the runtime. We've discussed making them configurable; not a near-term priority but it's tracked...
  3. linhpm.devs
    The SPF flattening explanation finally made it click for me. I'd been hitting the 10-lookup limit and didn't understand why nesting includes counted. fwiw
    1. admin (bearbeitet)
      Appreciate it. If anything in this needs updating, ping us — we revisit articles every few months.
  4. bos.devops
    How do you handle DNS for clients in white-label setups? The customer would need to add records to their domain — is there a clean way to bulk-verify those?
    1. admin
      For your specific case, I'd recommend testing with `--dry-run` first. The behavior under high load isn't 100% deterministic and we want you to see your own pattern before committing.
  5. danrey.dev
    Our DKIM rotation broke for 2 days because we updated the active selector first, then waited to delete the old. Should be the other way — publish new, wait 48h for cache, switch sending, THEN remove old
    1. admin (bearbeitet)
      Thanks for sharing. The pattern you describe is exactly the use case we built that feature for — glad it landed for you
  6. priya.iyer.ops
    Hit the 10-lookup SPF limit when we tried to layer SES on top of an existing Google Workspace setup. Flattened with a tool (spfwizard.com) and its been fine since. That tool's worth a mention.
  7. jmorrison.itop…
    worth noting: our dns provider (cloudflare) caches negative responses for 1 hour. we added a txt record, dig showed it, but mail-tester said missing for another 40 minutes. almost lost our minds. ttl was set to 300 but the parent zone ns cache held...
    1. admin (bearbeitet)
      Useful context. The fact that it took 3 weeks end-to-end is realistic; we sometimes get pushed to say 1-week timelines and theyre not honest
  8. m.schmidt78
    DNS setup is one of those things where you dont know what you don't know. This article should be required reading for anyone running their own mail
    1. admin (bearbeitet)
      Thanks. Pass it along if it helps your team

More in DNS & Domain Setup