The Inbox Logo Racket

Every email vendor sells the same picture: your logo in a round badge beside your company name, in every inbox, trusted at a glance. The standard behind it, BIMI, is open and free to publish. The part that makes it appear in Gmail is not. It is sold by three certificate authorities, expires every year, and does nothing at all for the largest business mailbox in the world, Microsoft 365.

I went through this as a small consulting firm with a Google Workspace domain. I wanted an open, vendor-neutral way to show a logo. What I found is a trust system where the identity check is outsourced to a paid cartel, the one provider that does it for free is Apple, and the one that matters most for business mail does not play at all. This article is the map I wish I had before starting.

BIMI was designed to be free#

Brand Indicators for Message Identification is a DNS record and an SVG file. You publish a TXT record at default._bimi.yourdomain that points to a square logo in the SVG Tiny Portable/Secure profile. A receiving mail server checks that the message passed DMARC with an enforced policy, fetches the SVG, and shows it. That is the whole specification.

The specification explicitly allows this without any certificate. The working group calls it a self-asserted logo. Fastmail honours it today. Open-source clients such as SnappyMail and FairEmail honour it. Yahoo honours it for bulk senders. The only real prerequisite is DMARC at quarantine or reject, which every domain should have anyway because it stops other people sending mail as you.

In other words, the open standard works. The problem is not the standard. The problem is what the two largest receivers decided to layer on top of it.

Where the paywall went in#

Gmail will not read a self-asserted record. It requires the BIMI record to carry an a= tag pointing to a Mark Certificate, and it only trusts certificates issued by authorities approved by the BIMI Group. There are two kinds. A Verified Mark Certificate needs a registered trademark and unlocks a blue checkmark. A Common Mark Certificate, introduced in 2024 as the cheaper option, drops the trademark requirement but still requires paid organisation validation and gives no checkmark.

Three things make this a racket rather than a service. The issuers sit on the working group that writes the rules. Certificates expire every twelve months and need a fresh validation each time, so the fee is a subscription. And there is no non-profit issuer, no Let's Encrypt for logos, and no automated path, so the price never falls. Resellers compete on discounts of ten percent, not on the model.

The justification offered is impersonation. A logo is a trust signal, so someone has to confirm that the company behind the domain is real and owns the mark. That is a legitimate concern. It is also exactly the check a domain registrar, a business registry, or Apple already do for free.

The scorecard#

Here is what each receiver actually shows for a small business sending ordinary one-to-one mail, checked against the providers' own documentation and, for the open-source clients, their source code.

Read the first two rows together. Gmail and Microsoft hold the overwhelming majority of business mailboxes. For one of them a free solution exists only as a side effect of being a Google customer. For the other no solution exists. Everything the certificate industry sells reaches the remaining slice.

Apple proved the check can be free#

In late 2024 Apple added Branded Mail to Apple Business Connect. You create a free business account, Apple verifies the company, you prove domain ownership with a TXT record, your DMARC policy must be quarantine or reject with every message signed by DKIM, and you upload a PNG. Review takes up to seven working days. No certificate, no trademark, no annual fee.

This is the same identity check the certificate authorities charge four figures for. Apple does it as part of running a platform, the way a bank verifies a new account holder. The existence of Branded Mail removes the only technical argument for the paywall. Gmail could do exactly this through Google Business Profile tomorrow. It has chosen not to.

Microsoft did not bother, which deflates the whole thing#

Microsoft is the one name the BIMI Group lists under "does not support". Outlook.com, Exchange Online and Microsoft 365 render no sender logo for external mail, with or without a certificate. Outlook shows photos only from the recipient's own directory. It does not query Gravatar or favicons either. In September 2025 Microsoft confirmed it supports BIMI only as a sender through Dynamics 365 marketing, and in May 2026 it said again that no receiver-side date exists.

For a company whose clients run Microsoft 365, this settles the question. The most expensive certificate on the market buys a logo that the majority of your recipients will never see. The vendors selling BIMI setup services rarely lead with that.

What a small company should actually do#

Spend an afternoon, spend no money, and stop there.

1. Move DMARC to p=quarantine with pct=100, watch the aggregate reports for two weeks, then go to p=reject. This is worth doing for spoofing protection alone, and every logo mechanism requires it.
2. If you are on Google Workspace, have each user upload the logo as their own profile photo and set its visibility to "Anyone". An admin-set photo is only visible inside the organisation. This is the only free way into Gmail and it reaches every Gmail recipient.
3. If your clients use iPhones, register in Apple Business Connect and submit the logo. Thirty minutes, free, done once.

Skip the rest unless you enjoy it. A self-asserted BIMI record takes twenty minutes and reaches Fastmail and a few open-source clients. Gravatar reaches some third-party apps. A self-hosted Libravatar server is a fun weekend and reaches one Android client. None of them move the needle for a business audience.

Buy a Common Mark Certificate only if you send volume mail where a Gmail logo measurably lifts open rates, and treat it as a 650 dollar annual marketing cost. For one-to-one professional mail, it is not worth it. Nothing buys Outlook.

What would fix it#

Two changes, either of which would end the racket. Gmail could accept self-asserted logos from domains with enforced DMARC and a clean reputation, as Yahoo and Fastmail already do, and reserve the checkmark for certificate holders. Or a non-profit could become an approved Mark Verifying Authority and issue certificates at cost, the way Let's Encrypt turned paid TLS certificates into a free utility in under five years.

Neither has been announced. Until one happens, the honest summary for a small business is this: the open standard is fine, the two companies that control your recipients' inboxes have either paywalled it or ignored it, and the free paths that remain are the ones that happen to serve those companies' own ecosystems. Set up the three free steps, keep the DNS record ready, and check the authority list once a year.

Sources#

• Google Workspace: Set up BIMI
• Google Workspace: Add or change a user's profile photo
• Apple: Intro to Branded Mail
• Apple: Verify your email domain for Branded Mail
• Yahoo Sender Hub: BIMI
• Fastmail: Using BIMI
• BIMI Group: provider support
• BIMI Group: Mark Verifying Authority FAQs
• Suped: Does Microsoft Outlook support BIMI
• The SSL Store: Can I get a BIMI certificate for free?
• DMARCTrust: CMC and VMC 2026 prices
• Tallyfy: VMC certificate pricing
• SnappyMail avatars plugin source
• Nextcloud Mail avatar sources
• FairEmail settings strings
• Libravatar API