Why does BIMI require a certificate, and what’s the real difference between VDM and VMC?

You’ve uploaded your logo, formatted it correctly, and set up BIMI in your DNS. But your brand icon still doesn’t show up in inboxes. You’re not alone. The issue isn’t your logo—it’s the certificate your domain uses for verification.

BIMI only works when your domain cryptographically proves ownership and authenticity. This is done through a DNS record containing a certificate—specifically, either a VDM or a VMC. Confusingly, they are not interchangeable. Using the wrong one breaks the chain. This article explains exactly what each does, why the distinction matters, and how to get BIMI working.

Key takeaways

  • BIMI requires a valid cryptographic certificate in DNS to display your brand logo; without it, the logo won’t appear, regardless of logo format.
  • VDM (Verified Domain Model) is the standard certificate type for BIMI, used to prove domain-level ownership and authenticity.
  • VMC (Verified Message Certificate) is intended for individual email messages, not domain-wide BIMI, and is not accepted in BIMI DNS records.

What is BIMI, and why does it matter for email deliverability?

BIMI is a DMARC-based standard that lets brands display their logo next to emails in supported inboxes like Gmail, signaling legitimacy, improving recognition, and reducing false spam reports. Without it, your emails may appear generic and less trustworthy, even if they’re technically deliverable. Proper BIMI setup—including the correct certificate—is required to unlock these benefits.

How BIMI builds trust and boosts inbox placement

When you enable BIMI, you’re not just adding a logo—you’re signaling to inbox providers that you’re a verified, consistent sender. Gmail and others use BIMI compliance as a positive marker in their delivery algorithms. Verified logos reduce the chance of your emails being flagged as suspicious, even if the content is benign.

Brands with BIMI often see better engagement rates because recipients recognize the sender instantly. This reduces confusion, lowers unsubscribe rates, and cuts down on accidental spam reports. It’s not a magic bullet, but it’s a signal that your brand is stable and accountable—something inbox providers prioritize.

Why VDM and VMC certificates matter in BIMI setup

BIMI requires a digital certificate to verify that the logo is officially linked to your brand. The two common certificate types are VDM (Verified Display Message) and VMC (Verified Marketing Certificate), though the standard uses a format based on the DMARC specification, which outlines how branding can be authenticated.

The certificate must be hosted on a secure, publicly accessible URL and linked in your DNS DMARC record. While VDM and VMC are sometimes used in vendor-specific contexts, the actual implementation depends on how your email service provider or security infrastructure handles BIMI. The key point is that your certificate must be correctly configured—any misstep breaks the chain of trust.

Even if your emails deliver, lacking BIMI means missing a chance to stand out. For senders aiming for strong deliverability, especially in competitive industries like e-commerce or finance, BIMI is a small but meaningful differentiator. It signals stability, consistency, and brand integrity.

Before you deploy BIMI, check your domain’s DNS setup, ensure your DMARC policy is enforced, and verify your certificate is accessible and valid. Use tools that check real-time deliverability and email health—like inbox placement testing—to confirm your setup is properly recognized across inboxes.

What is a VDM certificate, and when should you use it?

A VDM (Verified Digital Mark) certificate is the required digital credential that verifies your brand’s logo for display in email clients via BIMI (Brand Indicators for Message Identification). You need it when you want your logo to appear next to your emails in supported inboxes—provided the certificate is correctly issued by a BIMI-compliant CA and properly published in your DNS as a TXT record under the BIMI tag.

How a VDM certificate works in BIMI

The VDM certificate is issued by a trusted certificate authority that supports the BIMI specification. Unlike standard TLS certificates, it’s not used to encrypt data—it’s used to authenticate that your logo belongs to your brand. The certificate contains your logo’s hash and is signed by a CA that’s recognized by BIMI adopters.

You embed the VDM certificate in your domain’s DNS as a TXT record using the BIMI tag format. If the record is misformatted, missing, or contains incorrect fields (like a wrong signature), BIMI will fail silently. This means your logo won’t display, even if you’ve done everything else right.

When to use a VDM certificate

You should use a VDM certificate only if you’re implementing BIMI. Not all email providers support BIMI (Gmail, Yahoo, and others do), but using it gives your brand a trusted visual presence in inboxes. For brands with large email volumes—especially those using marketing automation or transactional systems—BIMI can improve recognition and reduce phishing risk.

Important: BIMI doesn’t work without a valid VDM certificate. You cannot use a standard SSL/TLS certificate for BIMI. Only certificates issued specifically under the BIMI specification by compliant CAs will work. If you're setting up BIMI at scale, ensure your DNS record is correct before sending. Even a single typo can break the chain.

BIMI is defined in the IETF BIMI draft specification—a standard developed by email security experts. It builds on existing email authentication (SPF, DKIM, DMARC), so your foundation must already be solid.

If you're managing a large email list, it’s wise to verify your sender infrastructure beforehand. Use a tool like bulk email verification to clean up invalid or risky addresses, ensuring your list is healthy. A clean list improves deliverability and supports BIMI’s goal: showing trustworthy, branded emails to real recipients.

What is a VMC certificate, and how does it differ from a VDM?

You don’t need a VMC certificate for BIMI verification—only a VDM (Verified Digital Mark) certificate is valid for BIMI. VMCs are used in separate messaging frameworks for message-level authentication and don’t support brand logo validation in BIMI. Using a VMC in a BIMI DNS record will cause verification to fail because it doesn’t meet the BIMI specification.

What VMC actually is (and why it’s not for BIMI)

VMC stands for Verified Message Certificate, a type of digital credential used in some enterprise email systems to authenticate individual messages at the transport level. It's designed to prove a message came from a trusted source, not to display a brand's logo in inboxes.

It’s often confused with VDM due to similar naming, but they serve different purposes. While VMCs are part of broader authenticated messaging protocols, BIMI is specifically about visual brand identity. The BIMI specification requires a VDM—a cert issued by a trusted provider and verified through the BIMI standard—not a VMC.

Why using a VMC in BIMI fails

If you attempt to include a VMC in your BIMI DNS record, the receiving mail server will reject it. BIMI servers validate entries using strict criteria defined by the BIMI standard (see the BIMI specification on bimi.org). A VMC does not meet those criteria, which require a VDM from an approved provider. This results in a validation error, meaning your brand logo will not display.

Let’s be clear: even if a VMC appears legitimate, it won’t work in BIMI. The system isn’t just checking for any certificate—it checks for one that fulfills BIMI's exact requirements, including proper signing and validation by an accredited registry.

Using the right certificate ensures that your brand appears consistently and trustworthily across inboxes. If you’re setting up BIMI, verify the certificate you’re using is a VDM—not a VMC. Double-check the certificate type before publishing your BIMI record.

For organizations managing large email lists, ensuring technical accuracy from the start saves time and prevents brand visibility issues. You can verify your email addresses and their associated domains for potential delivery issues using tools like bulk email verification, which helps spot problems before they affect your deliverability and branding.

How to validate your BIMI setup using the correct certificate type

You must use a VDM (Verified Domain Model) certificate, not a VMC (Verified Mark Certificate), for BIMI verification. A VDM is issued by a BIMI-recognized Certificate Authority and must be correctly embedded in your BIMI DNS record. If you're using a VMC, your logo won't display reliably across email providers, even if your DMARC policy is in place.

  1. Confirm your domain has a valid DMARC policy published in DNS. Without a published DMARC record with at least p=none or p=quarantine (and not p=reject unless fully tested), BIMI will not activate. Run a query via MxToolbox or dig TXT yourdomain.com to check.
  2. Generate your BIMI record with a VDM URL, not a VMC. The BIMI DNS record should point to a publicly accessible URL hosting your VDM certificate, not a VMC. The format is BIMI1; l=URL; where the URL resolves to a valid, BIMI-compliant VDM. Use inbox placement testing to verify real-world display across providers like Gmail and Outlook.
  3. Verify your certificate is issued by a BIMI-recognized CA and includes the correct subject. Only CAs listed in the BIMI specification (see BIMI.org) can issue valid certificates. Ensure the certificate’s subject matches your domain exactly and has a validity period of at least three months.
  4. Test your BIMI record using DNS tools. Use DNS lookup tools like MxToolbox or dig TXT yourdomain.com to confirm the BIMI record resolves and contains the correct URL. Any syntax error here prevents logo display.
  5. Check inbox placement across major email clients. BIMI behavior varies: Gmail displays logos consistently; Outlook and Apple Mail require specific conditions. Use a service that simulates delivery across these environments to confirm your logo appears where it should.

Why the type matters

VMC certificates are meant for brand marks used in non-email contexts, like product packaging. BIMI relies on VDMs because they’re designed for email authentication and are validated through the DMARC framework. A mismatch here results in non-display or inconsistent rendering—wasting your brand’s trust signal.

Real-world testing is non-negotiable

Even with a correct BIMI record and valid VDM, delivery and logo display depend on the recipient’s client. Some providers ignore BIMI entirely unless DMARC is set to reject. Test your setup in actual inboxes, not just DNS checks. Use email verification tools to detect deliverability issues that might prevent BIMI from applying.

The only correct certificate for BIMI: VDM, not VMC

You need a VDM (Verified Domain Model) certificate for BIMI verification. VMC is not part of the BIMI standard and has no role in logo display. BIMI only accepts VDMs, which are specifically structured to enable secure, verifiable logo delivery. Confusion often arises from outdated guides or mislabeled tools — stick to the official specification.

Why VDM is the only valid format

  • BIMI relies on DNS-based verification using the v=VDM1; format, defined in the official BIMI specification published by the IETF.
  • VMC is not referenced in any BIMI RFC or framework document — it's not part of the standard, even if some tools mention it.
  • Mail systems and BIMI-enabled email clients (like Gmail) validate only VDM entries — an invalid or non-VDM certificate will result in no logo display.
  • Let’s be clear: if your certificate doesn’t start with v=VDM1;, it’s not compatible with BIMI.
  • Always validate your DNS record using a tool like MXToolbox or RFC 8985 to check format compliance.

Common sources of confusion

  • Some older documentation incorrectly refers to VMC as a BIMI variant — these are outdated and no longer accurate.
  • Third-party tools sometimes use inconsistent terminology, leading users to believe VMC is valid.
  • Double-checking against the actual BIMI specification (RFC 8985) removes any ambiguity.
  • Never rely solely on summary blogs or marketing copy — the spec itself is the final authority.
  • If you’re generating certificates, ensure your tool outputs the v=VDM1; format, not custom or non-standard variants.
BIMI doesn’t work with guesses. Only the correct certificate format ensures logo visibility in the inbox.

If you're managing email infrastructure or working on brand visibility, verify your BIMI setup with real DNS checks. For teams running bulk email campaigns, maintaining clean, verified domains is critical — use tools like bulk verification to catch invalid or risky addresses before they harm deliverability.

Common BIMI setup mistakes that prevent logo display

You need a VDM (Verified Domain Model) certificate for BIMI verification—using a VMC (Verified Message Certificate) won't work. BIMI relies on a domain-aligned, publicly trusted, and properly issued SSL/TLS certificate tied directly to your domain. If your certificate is self-signed, expired, issued by a non-BIMI-recognized CA, or has misaligned protocols or domains, the logo won’t display, even with a valid DMARC policy. It’s not enough to have DMARC; the certificate must match exactly. Always test your setup using industry-standard tools like RFC 8616 or public validation services.

Common DNS and certificate errors

  • Using a VMC instead of a VDM in your BIMI DNS record. BIMI only recognizes VDM, not VMC. Double-check your TXT record syntax and value to ensure it starts with v=VDM1;, not v=VMC1;.
  • Uploading a self-signed or expired certificate. BIMI requires a certificate issued by a CA that’s trusted by browsers and email clients. A self-signed cert fails validation and blocks logo rendering.
  • Using a certificate from a non-BIMI-recognized CA. Certificate authorities must be listed as BIMI-aware by the BIMI Association. If your CA isn't on the list, your logo won’t display, regardless of validity.
  • Deploying the BIMI record without a published DMARC policy. You cannot have BIMI without DMARC. If no DMARC policy exists for your domain, BIMI will be ignored by receiving systems.

Alignment and configuration issues

  • Incorrect protocol alignment in the BIMI URL—using https:// instead of http:// in the DNS record is a common typo. BIMI uses http for URL resolution, not https. Even if your site uses HTTPS, the BIMI link must point to http:// to pass validation.
  • Domain or subdomain mismatch. The BIMI record must be published at the same level as your email domains. For example, if you send from mail.company.com, your BIMI record should be on company.com, not mail.company.com.
  • Incorrect logo format or size. BIMI requires a PNG file under 100KB with a 32x32 pixel minimum size. Larger or unsupported formats will be ignored.
  • Failing to test BIMI after setup. Use public tools like MXToolbox or BIMI validation services to confirm your DNS record resolves correctly and the certificate is properly issued.

Even small missteps—like a single typo in the BIMI record—can stop your logo from appearing. Always verify your setup step by step. Tools like bulk email verification help you confirm that your domain and delivery infrastructure are clean and aligned, reducing the chance of BIMI failures due to misconfigured or invalid email routes.

How Emaillistchecker.io can help ensure your BIMI-ready domains are valid

You don’t need a VDM or VMC certificate for BIMI verification—BIMI relies on a properly published BIMI record in DNS, not on SSL certificates. What matters is that your domain’s DNS and mail infrastructure are stable, your email addresses are valid, and your sending practices follow inbox placement best practices. Using Emaillistchecker.io, you can validate every layer of readiness before deploying BIMI.

Validate your email list and infrastructure

BIMI is only effective if your emails reach inboxes. If your list includes invalid syntax, role accounts, or disposable domains, your messages won’t land reliably—no BIMI logo will help. The real-time verification API lets you check individual addresses in milliseconds, confirming not just syntax but whether mail servers accept emails from your domain.

Let’s say you’re preparing to publish a BIMI record. You first run your entire list through bulk verification. It flags outdated addresses, catch-all domains, and disposable email providers. This eliminates risk of sending to spam traps or bounce-prone addresses—common pitfalls that damage sender reputation and undermine BIMI’s credibility.

Diagnose and fix DNS and email issues

BIMI requires a stable, well-configured DNS setup. If your SPF, DKIM, or MX records are misconfigured, deliverability fails regardless of BIMI. Emaillistchecker.io checks your domain’s SMTP and DNS configuration directly, flagging misconfigurations that could block BIMI enforcement.

For users without deep DNS expertise, the in-app AI assistant simplifies troubleshooting. It explains why an email is marked “risky” or why DNS checks fail, often pointing to a missing or malformed TXT record. You don’t need to be a network engineer to validate your BIMI readiness.

For ongoing campaigns, you can integrate Emaillistchecker.io with Mailchimp, HubSpot, or SendGrid to verify lists before every send. This ensures every batch you send is clean. A clean sending list reduces bounce rates, keeps you off blocklists, and supports consistent inbox placement—proven to be essential for BIMI to be seen.

Learn more about how to maintain sender reputation and improve inbox placement at inbox placement testing. You can also check bulk verification to audit entire domains instantly. And if you’re starting fresh, explore our pricing—100 free verifications to begin with, no expiration on purchased credits.

Why deliverability and brand trust start with correct authentication

BIMI isn’t a standalone checkmark—it requires working SPF, DKIM, and DMARC records first. If any layer fails, BIMI won’t display, and your inbox placement can still suffer, even if messages send. You must verify every authentication layer to prove your domain’s legitimacy to mailbox providers.

Authentication is a stack, not a checklist

Think of email authentication like a door with multiple locks: SPF confirms the sender’s IP is authorized, DKIM signs the message body to prevent tampering, and DMARC tells receivers what to do with messages that fail either check. BIMI sits on top—it only activates when all three are validated and correctly published. A single misconfigured record breaks the chain.

Spammers often bypass one or more layers. Mailbox providers like Gmail and Outlook use these checks as part of their spam filtering pipeline. A BIMI record with errors, like a mismatched or expired certificate, signals that your domain’s defenses aren’t fully active. That’s why a failed BIMI test may not mean your emails aren’t delivering—but it does mean your sender reputation is at risk.

Brand trust begins with clean, valid email data

Even with perfect DNS settings, BIMI won’t help if your list contains invalid, disposable, or role-based addresses. These are frequently flagged or quarantined. A high volume of bounces or complaints erodes your sender reputation, which directly impacts inbox placement.

Consider this: a BIMI logo displayed on an email sent to a disposable inbox (like @tempmail.com) does nothing to build trust—you’re just showing a logo on a low-value recipient. That’s why maintaining a clean, verified list is foundational. Use tools like bulk email verification to remove invalid, risky, or catch-all addresses before sending.

According to the BIMI spec (RFC 7489), the BIMI record is only honored for domains with a valid DMARC policy that includes enforcement. It’s not a branding gimmick—it’s a deliverability signal backed by standardization. If your DMARC policy allows delivery but doesn’t enforce it (p=none), BIMI won’t display. That’s by design.

Let’s be realistic: no single certificate—VDM or VMC—fixes deliverability alone. Your reputation, list hygiene, and authentication stack matter more. Use inbox placement testing to validate how your messages are being delivered and filtered, and ensure your domain setup supports every stage of the journey from send to inbox.

Final takeaway: Only VDM works for BIMI, and accuracy matters

BIMI verification requires a Verified Domain Model (VDM) certificate. A VMC certificate will not work and will cause BIMI to fail.

The BIMI standard explicitly defines VDM as the only valid certificate type. Using a different format—whether by mistake or misinterpretation—breaks the verification process.

Why accuracy and trust matter beyond the certificate

A valid VDM certificate is only one part of BIMI’s success. Your domain must also maintain a strong sender reputation, which relies on clean, accurate email lists.

Email lists with high invalid or disposable addresses hurt deliverability. This weakens sender reputation and can lead to BIMI icon suppression, even with the correct certificate.

Verify your setup with real-world tools

Always validate your VDM record using a trusted DNS checker. A record that passes internal checks may still fail in production.

Use a Certificate Authority known to support BIMI. Not all CAs issue BIMI-capable certificates. A trusted CA ensures your domain is recognized by email clients that support BIMI.

Sources

Keep reading

Ready to put this into practice? Emaillistchecker.io verifies emails with 98.9% accuracy — start with 100 free verifications.

Frequently asked questions

Is VMC required for BIMI verification?

No. VMC is not used in BIMI verification. Only the VDM certificate is accepted by the BIMI specification.

What happens if I use a VMC certificate in my BIMI record?

The BIMI verification will fail. BIMI systems reject VMC because it is not part of the required standard.

Can I use a self-signed certificate for BIMI?

No. The certificate must be issued by a BIMI-recognized certificate authority. Self-signed certificates are not trusted.

How do I check if my BIMI setup is working?

Use a BIMI validator tool or check your inbox in Gmail with a test message. Only valid VDM certificates will trigger logo display.

Does BIMI affect email deliverability?

Yes. BIMI is a trust signal. Domains with BIMI are more likely to land in the inbox, especially in competitive inboxes.

What is the relationship between DMARC and BIMI?

BIMI requires a valid DMARC policy. Without DMARC, BIMI verification cannot proceed.

Do all email providers support BIMI?

No. Only providers like Gmail, Yahoo, and some enterprise solutions support BIMI. Support is growing, but not universal.

How can I verify my domain’s email addresses before setting up BIMI?

Use an email verification service like Emaillistchecker.io. It checks syntax, deliverability, and validity—ensuring your domain is BIMI-ready.

Can I test BIMI for my brand without sending a live email?

Testing usually requires sending to live inboxes. BIMI behavior cannot be fully replicated in staging environments.

What’s the difference between VDM and VMC beyond BIMI?

VDM is specific to BIMI. VMC is used in other message authentication systems. The two are not interchangeable, even outside BIMI.

How often should I revalidate my BIMI certificate?

Revalidate when the certificate expires—typically every 90 days. Monitor your DNS records regularly for changes.

Can a bad email list hurt my BIMI performance?

Indirectly, yes. A poor list with many bounces or spam traps degrades sender reputation. This can reduce BIMI visibility even with correct setup.