The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To add a verified logo to business email, configure Brand Indicators for Message Identification (BIMI): authenticate mail with aligned SPF and DKIM, enforce DMARC, publish a compliant logo and BIMI DNS record, and meet the evidence requirements of the inbox providers you want to reach. A valid setup makes a logo eligible to display; it does not guarantee that every recipient will see it.
What “verified logo” means for business email
BIMI is a DNS-based display signal layered on top of email authentication. It is not itself a security solution, and it does not change whether a message is delivered. As the BIMI Group FAQ explains, “BIMI does not change message delivery; it is a display signal on top of strong authentication.” Mailbox providers decide whether and how to show the logo.
For Gmail, Google’s documented BIMI setup requires a Verified Mark Certificate (VMC) or a Common Mark Certificate (CMC). Google associates the Gmail checkmark with VMC verification: “In Gmail, you’ll see a checkmark next to senders verified with a VMC.” Do not assume a CMC produces that checkmark. See Google Workspace’s BIMI setup requirements.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
In Apple Mail, a configured BIMI record alone is not enough. Apple says the recipient’s mail provider must support the process, check compliance and evidence, and add the required message headers. If the provider has not done that work, the logo will not appear in Apple Mail, even when the client software is compatible. See Apple’s developer guidance on branded mail.
#1 Best Overall
Sale
Thetis Nano-C for Business - USB C FIDO2 Security Key L1 MFA & Passkey Access for School ERP, Employee Online Account, Compatible with Coinbase Google Workspace Apple ID Window Salesfore - 2 Pack
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- USB TYPE C Connectivity & DONGLE Design: Designed for PCs, Macs, laptops, iPhones, and Android devices that utilize a USB-C port. Plug and stay, or carry it on a keychain. (Item Size: 0.73 x 0.60 x 0.30 inches)
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC functionality is not supported.
What you need before setup
- Control of the domain used in your business email and access to its DNS records.
- An inventory of every service that sends mail for the domain, such as your mailbox platform, website, billing system, and marketing service.
- Working SPF and DKIM authentication, with alignment for legitimate mail streams, plus a DMARC policy that meets BIMI requirements.
- An official logo prepared as a BIMI-compatible SVG Tiny PS asset, not simply an unvalidated website SVG.
- The certificate or other evidence required by each target provider, plus publicly accessible hosting for the logo and any certificate file.
How to add a BIMI logo step by step
- Inventory your sending sources. List every system that sends as your domain. Verify that legitimate mail is authenticated with SPF or DKIM and that the authentication aligns with the visible From domain. The BIMI Group implementation guide calls for organizational email authentication using SPF, DKIM, and DMARC, with alignment.
- Bring DMARC to an accepted enforcement policy. BIMI Group’s implementation guidance requires a DMARC policy of
quarantineorreject; a policy ofnoneor a policy applied to less than 100% of mail does not meet that guidance. First account for legitimate senders and resolve authentication failures. The official guidance does not prescribe one migration schedule for every organization, so avoid tightening policy blindly if it could affect valid mail. - Prepare and validate the logo. Create the official logo in the required SVG Tiny PS format and check it against current BIMI and recipient-provider specifications. Ordinary SVG files can contain features or formatting that are not suitable, so do not assume a logo that works on your website will work for BIMI.
- Choose and obtain provider-required evidence. Check the current requirements of the providers important to your recipients. Google’s documented setup accepts a VMC or CMC. A VMC is tied to the applicable registered trademark or registered government mark requirements; BIMI Group describes CMC as a certificate route that extends beyond those VMC mark requirements. If Gmail’s VMC-associated checkmark matters to you, a CMC should not be treated as a substitute for it. Trademark registration can take 6 to 12 months according to Google Workspace Help; that is an estimated process duration, not a guaranteed timeline.
- Host the files and publish the BIMI DNS record. Make the logo and, when required, certificate publicly retrievable over HTTPS. BIMI Group describes a TXT record at
default._bimicontaining a logo URL in thel=tag and an optional certificate URL in thea=tag. Follow the exact syntax and hosting requirements of the certificate issuer and target mailbox providers; do not copy a record format without checking current requirements. - Test authentication, DNS, and actual recipient display. Confirm that messages pass aligned authentication, the BIMI record resolves publicly, and every referenced asset can be retrieved. Send test messages to accounts at the providers you care about and inspect their supported clients. A successful DNS lookup proves the record is published, not that a provider will display the logo.
VMC or CMC: which certificate path fits?
Choose based on the recipient providers’ current acceptance rules and what you need recipients to see. The available guidance establishes Gmail’s VMC-or-CMC setup requirement and links its checkmark specifically to VMC verification; it does not establish a universal provider-acceptance list, live issuer prices, or a complete comparison of renewal terms.
| Decision point | VMC | CMC |
|---|---|---|
| Eligibility basis | Associated with the applicable registered trademark or registered government mark requirements, as described by BIMI Group. | BIMI Group describes this as a certificate path extending beyond the VMC registered-mark requirement; check issuer terms for exact eligibility. |
| Google’s documented BIMI setup | Accepted by Google. | Accepted by Google. |
| Gmail verification checkmark | Google says Gmail shows a checkmark next to senders verified with a VMC. | Not established by the cited Google guidance; do not promise the VMC-associated checkmark. |
| Current issuer price and renewal terms | Not stated in the cited sources; confirm directly with certificate issuers. | Not stated in the cited sources; confirm directly with certificate issuers. |
Certificate availability, eligibility, and cost can change. Confirm the issuer’s live terms and the requirements of each inbox provider you are targeting before committing to a certificate path.
Rank #2
Thetis PRO-C for Business - USB C FIDO2 Security Key L1 MFA & Passkey Access for School ERP, Employee Online Account, Compatible with Coinbase Google Workspace Apple ID Window Salesfore - 2 Pack
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C & NFC): The Thetis PRO-A features integrated USB Type C and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Why a correctly configured logo may not appear
- Authentication is not aligned or complete: a message that does not pass the required authentication path may not qualify for BIMI display.
- DMARC is not at enforcement: a
p=nonepolicy or a policy covering less than all mail does not meet BIMI Group’s implementation guidance. - The asset or record is unusable: an incompatible SVG, incorrect DNS record, or inaccessible logo or certificate URL can prevent validation.
- The provider has additional conditions: certificates, evidence, provider-specific checks, or other requirements may apply.
- The receiving provider does not display it in that context: display support varies. Apple Mail, for example, depends on the provider’s verification and required headers as well as compatible Apple software.
Use the recipient provider’s current documentation to diagnose provider-specific behavior. BIMI eligibility is not a universal promise of inbox placement or identical branding across clients.
Free tools Windows power users keep installed
One-click scans. No signup required.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
Quick Recap
Best Value
Thetis Pro For Business - FIDO2 Security Key L2 MFA & NFC Passkey Access For School ERP, Employee Online Account, Compatible with Coinbase Google Workspace Apple ID Window Salesforce,Dual USB A +USB C
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L2 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Fully compatible with ID Austria, this hardware key meets the mandatory FIDO2 Level 2 (L2) security standard. Check FIDO2 compatibility before purchase - Known limitations: Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Rank #4
Thetis Pro For Business - FIDO2 Security Key L1 MFA & NFC Passkey Access For School ERP, Employee Online Account, Compatible with Coinbase Google Workspace Apple ID Window Salesforce,Dual USB A +USB C
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-C, USB-A, & NFC): Designed for PCs, Macs, iPhones, and Android. For mobile use, simply unfold the key, align it with your phone’s NFC antenna, and hold for a few seconds to authenticate.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Rank #3
Thetis PRO-A for Business - USB A FIDO2 Security Key L1 MFA & Passkey Access for School ERP, Employee Online Account, Compatible with Coinbase Google Workspace Apple ID Window Salesfore - 2 Pack
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Universal Connectivity (USB-A & NFC): The Thetis PRO-A features integrated USB Type A and NFC for a near-instant account unlock. Simply unfold the key and hold it to your smartphone’s NFC antenna to authenticate on the go.
- Enhanced MFA (FIDO2 & TOTP/HOTP): Strengthen your security with flexible options. Use the Manager App to access TOTP/HOTP features for accounts that do not yet support FIDO2.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID. NFC is supported only through mobile authentication, Not MacOS/windows.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
