How to Get the Blue Checkmark in Gmail

What the checkmark actually is

Two separate things create it. The first is BIMI, which stands for Brand Indicators for Message Identification. BIMI is a DNS record, a small line of text published in your domain's settings, that tells inboxes where to find your logo. The second is a Verified Mark Certificate, or VMC, a digital certificate from an approved certificate authority that proves the logo is really yours.

BIMI alone gets you a logo in some inboxes. The VMC is what turns on the checkmark in Gmail. Google's own documentation is direct about it: in Gmail you see a checkmark next to senders verified with a VMC.

It helps to understand what Gmail is telling the recipient, because it is narrower than people assume. The checkmark means the message genuinely came from the domain it claims to come from, and that a certificate authority checked that the organization behind the domain owns that logo. That is all. It is not a rating of your business, an endorsement, a trust score, or a statement that the email is not a scam. A verified sender can still send you a terrible offer. The checkmark verifies identity, not intent.

The prerequisite chain, in order

This is a chain, not a checklist. Each step depends on the one before it, and skipping ahead wastes money. A certificate authority will not issue you a certificate if your DMARC is not already at enforcement, and Gmail will not display anything if any link is broken.

The order is: SPF and DKIM passing, then DMARC at enforcement, then the SVG logo file, then the certificate, then the BIMI DNS record. Buy the certificate first and you will sit on an expensive file you cannot use.

Step one: SPF, DKIM, and DMARC at enforcement

SPF and DKIM are two email authentication methods. SPF lists which servers may send mail for your domain. DKIM adds a cryptographic signature to each message. You need at least one of them passing and aligned, meaning it matches the domain in the visible From address, not just some technical envelope domain underneath.

DMARC sits on top and tells inboxes what to do when authentication fails. It has a policy setting called p, and it accepts three values: none, quarantine, or reject. Google is explicit that BIMI does not support p=none. You must be at p=quarantine or p=reject.

There is a second setting called pct, short for percent, which applies your policy to only a portion of your mail. Google requires pct=100. A policy at p=reject with pct=20 looks like enforcement and is not. If you leave pct out of the record entirely, it defaults to 100, which is fine.

Do not jump straight to p=reject. Publish p=none first, collect DMARC reports for several weeks, find every legitimate service sending on your behalf, your invoicing tool, your booking system, your newsletter platform, and get each one signing properly. Then move to quarantine, then reject. Rushing this sends your own real email to spam.

Step two: the logo file, which is where most projects stall

Your logo must be an SVG in a specific restricted profile called SVG Tiny Portable/Secure, usually written SVG Tiny PS. SVG is a vector image format. Tiny PS is a stripped down version of it designed so that an image cannot carry anything active or reach outside itself.

A normal SVG export from Illustrator, Figma, or Canva will almost always fail. The file must declare baseProfile="tiny-ps" and version="1.2" on the root element. It must contain a title element holding your company name. It must be 32 kilobytes or smaller. It must be square. It needs a solid background color, because transparent backgrounds do not render predictably. Google also wants the dimensions written as absolute pixels, at least 96 by 96.

What is forbidden matters more. No scripts, no animation, no interactive elements. No external links or references of any kind other than the XML namespaces. No x or y attributes on the root svg element. And no embedded raster images, which is the single most common failure, because designers often trace a logo and leave a PNG buried inside the file. That file will be rejected.

Practically, this means your logo has to work as a simple square mark. A wide horizontal wordmark will not survive the square crop. Many businesses discover here that they need a redrawn icon version of their logo, and that is a design job, not a DNS job.

Step three: VMC or CMC, and why only one gets the check

There are two certificate types, and the difference decides your outcome.

A Verified Mark Certificate requires a registered trademark. Not a pending application, a registered one. It must be registered with one of roughly 18 accepted intellectual property offices, including the USPTO in the United States, EUIPO for the European Union, the UK IPO, CIPO in Canada, IP Australia, the JPO in Japan, KIPO in South Korea, IPONZ in New Zealand, plus offices in Germany, France, Spain, Brazil, India, Sweden, Denmark, Switzerland, and the Benelux region. The accepted list changes, so confirm with the certificate authority before you assume your registration qualifies. A VMC gets you the logo and the Gmail checkmark.

A Common Mark Certificate is the alternative for organizations with no registered trademark. Instead of a trademark, the certificate authority verifies that your logo has been publicly displayed on a domain you control for at least 12 continuous months, checked against web archive records. A CMC gets you the logo in supporting inboxes. It does not get you the checkmark. Gmail reserves the checkmark for VMCs.

This is the fork in the road. If you want the blue checkmark specifically and you have no registered trademark, your real first step is trademark registration, which typically runs 12 to 18 months and has its own filing and legal costs. That is the honest answer, and it is why the checkmark is not a quick win.

One more constraint: only three certificate authorities are authorized to issue these, DigiCert, GlobalSign, and SSL.com. Several other well known certificate vendors publish articles that rank well for these searches and read as though they issue VMCs. They do not. Check the BIMI Group's issuer list before you buy.

What it actually costs

The certificate is the main line item. DigiCert lists mark certificates at roughly $1,416 to $1,500 per year direct. Authorized resellers commonly sell the same certificates for less, with VMCs around $749 to $780 per year and CMCs around $650. Certificates are valid for a maximum of 397 days, so this is a genuine recurring annual cost, not one time.

Everything else you likely already pay for. The SVG and the certificate file are hosted on your own web server over HTTPS, and the BIMI record lives in your existing DNS. There is no fee to Google. Google does not sell verification and there is nothing to pay them for.

If you need a trademark first, that dominates the budget and the calendar. Budget for government filing fees per class plus attorney fees if you use one, and expect the wait measured in quarters, not weeks.

The identity verification step

Certificate authorities verify a human, not just a domain. DigiCert's process runs five stages: organization and domain validation to Extended Validation standards, SVG compliance checking, trademark verification by a specialist, identity verification, then issuance.

The identity step gives you two options. Either a live video call with a validation specialist, where you show a government issued photo ID and complete a liveness check in a well lit room with virtual backgrounds off, or a signed identity declaration witnessed by a certificate authority approved notary or lawyer, who confirms your ID in person and whose signature the CA then verifies by phone or email.

The person who does this must be an authorized representative of the organization, someone with documented authority to bind the company. In practice CAs expect an officer, a director, or someone whose signing authority appears in your corporate records. An office manager or an outside marketing contractor will not clear this step. Plan for whoever that person is to be available, because their calendar is often the actual bottleneck.

One useful detail: the notarized identity verification remains valid for 10 years, so renewals do not repeat it.

What each inbox actually shows today

Coverage is narrower than most vendor marketing suggests, and it is worth knowing before you spend.

Gmail displays your logo as the sender avatar and shows the checkmark, but only with a VMC. This is the only major provider that shows the checkmark at all.

Apple Mail displays the logo in iOS 16, iPadOS 16, macOS Ventura and later, and on iCloud.com. Apple requires a certificate and DMARC at enforcement. It shows the logo, not Gmail's checkmark.

Yahoo Mail displays the logo and does not require a certificate, so a correctly configured BIMI record with DMARC at enforcement is enough there.

Outlook shows nothing. Outlook.com, Exchange Online, and Microsoft 365 do not render inbound BIMI logos, and as of August 2026 Microsoft has announced no date for supporting it. Microsoft runs its own unrelated brand indicator system that has nothing to do with your BIMI record or your certificate. If a large share of your list is on Outlook or corporate Microsoft 365, that share sees no benefit from any of this.

How long this really takes

Assume six to eight weeks to get from no DMARC to safe enforcement, longer if you send through many third party services. Certificate validation itself runs from one business day to over a week depending on how fast you complete the identity step, and provisioning is commonly quoted at seven to ten days end to end.

So for a business that already holds a registered trademark, a realistic total is seven to ten weeks. For a business that needs to register a trademark first, add 12 to 18 months.

DNS changes then need time to propagate, and inbox providers cache aggressively. Do not panic if the logo does not appear the same day.

Why it silently does not work

Nothing errors out. Your logo just does not appear, with no notification, which makes this genuinely hard to debug. These are the usual causes, roughly in order of frequency.

Misconfigured records are by far the most common. DMARC left at p=none, or at enforcement but with pct below 100, or a subdomain policy of sp=none while you send from a subdomain. SPF or DKIM passing but not aligned to the visible From domain.

The SVG is the next biggest bucket: an embedded raster image inside the file, the wrong baseProfile, an incorrect XML namespace, a non square canvas, a file over 32 kilobytes, or any external reference.

Then the plumbing. The DNS record must be a TXT record at default._bimi.yourdomain.com. Both the logo URL in the l tag and the certificate URL in the a tag must be HTTPS and publicly reachable, with no login, no redirect, and no firewall rule blocking them.

A subtle one that catches experienced teams: the SVG published at your BIMI URL must match the logo embedded inside the certificate exactly. Re-export the file, tweak a color, or let a build process minify it, and the match breaks and the logo silently stops rendering. Treat the published SVG as frozen. Similarly, the logo must match your registered trademark as registered, not a newer refreshed version of it.

Finally, meeting every published requirement still does not guarantee display. The BIMI Group states plainly that appearing on the approved issuer list does not guarantee a mailbox provider will honor your certificate. Gmail applies its own sending reputation criteria that it does not publish. A domain with poor reputation or almost no sending history may qualify on paper and still show nothing.

Should you even do this?

For a lot of small businesses, honestly, no. Here is how to tell.

It is worth it if you send real volume to consumers, tens of thousands of messages a month or more, a meaningful share of your list is on Gmail, Apple Mail, or Yahoo, you already hold a registered trademark, and your logo works as a square mark. Retail, ecommerce, financial services, healthcare, and anyone whose brand gets impersonated in phishing attempts get the clearest return. There is a real secondary benefit too: the DMARC enforcement work protects your domain from spoofing and usually improves deliverability on its own, whether or not a logo ever appears.

Skip it if you send low volume or mostly one to one email, because recipients who already know you gain nothing from a logo. Skip it if your audience is primarily business users on Outlook and Microsoft 365, where none of this renders. Skip it if you have no registered trademark and no plan to file, since a CMC gets a logo in a subset of inboxes and never the checkmark. And skip it if you are not prepared to maintain DMARC at enforcement, because that is an ongoing operational commitment, not a one time change.

A reasonable middle path: do the DMARC work regardless, since it is the part with security and deliverability value. Then decide on the certificate later with real data on where your subscribers actually read mail. Pull that breakdown from your email platform before you spend anything.

If you decide it is not worth it, that is a legitimate outcome. The checkmark is a small visual cue, not a growth lever.

If you would rather not do it yourself

Everything above is the complete process, and a capable person with DNS access can absolutely do it without help. That is why we published it in full. If you would rather hand off the DMARC rollout, the SVG conversion, and the certificate application, that is what Verified Everywhere does, and we will tell you up front if we think your situation does not justify the spend. We never take passwords, ID documents, or card numbers, the identity check happens directly between you and the certificate authority, and we cannot promise an outcome, because Gmail and Apple decide what displays, not us.