Every few months someone asks whether BIMI will improve their cold email placement. The short answer is no, and the longer answer is more useful than it sounds, because the reasons BIMI excludes cold senders explain something about where mailbox providers are heading.
What BIMI is
Brand Indicators for Message Identification. It puts your logo next to your messages in the inbox, and in Gmail’s case can produce a verified checkmark beside the sender name.
To get it you need three things:
1. DMARC at enforcement. A policy of p=quarantine or p=reject, at pct=100. A monitoring-only p=none does not qualify, and a certificate cannot activate BIMI on a domain still in monitoring mode. SPF or DKIM must authenticate and align with the visible From domain.
2. A logo in SVG Tiny PS format, published at a known location and referenced from a DNS record.
3. A certificate, which is where the gate really is.
The certificate, and the two kinds
Two types exist, and the distinction matters more than most summaries suggest.
A Verified Mark Certificate (VMC) requires an eligible registered trademark or government mark. This is the one that unlocks Gmail’s blue verified checkmark.
A Common Mark Certificate (CMC) does not require a registered trademark, but the logo must be protected through documented prior use, the issuer decides what evidence suffices, including how long and in what manner you have used the mark. Google’s documentation accepts either for logo display in Gmail, but only VMC-backed senders get the checkmark.
The cost. Certificate authorities and resellers set their own prices, so there is no universal rate, but to give a sense of scale, DigiCert’s public page showed a starting subscription of $1,416 per certificate per year when checked in mid-2026. Treat older figures quoted around the web as dated, and get a current quote rather than planning on a number from a blog post.
Each certificate covers a domain. That phrase is doing all the work in this post.
Why cold senders are excluded
Four reasons, and they compound.
1. Your sending domains have no trademark
Cold email is sent from secondary domains, close variants of your brand, bought specifically to keep cold volume away from your primary domain. getacmenow.com and acme-team.io are not trademarked, will not be, and should not be.
A VMC requires a registered trademark. A CMC requires documented prior use of the mark, assessed by the issuer. A domain you registered six weeks ago for a sending pool satisfies neither, and that is the intended outcome rather than an oversight.
2. The per-domain arithmetic is absurd
A cold email programme of any size runs on multiple domains, ten, twenty, forty. Certificates are issued per domain.
At four figures per certificate per year, that is a five- or six-figure annual bill for logo display on domains whose entire purpose is being disposable. Nobody is doing this, and nobody should.
3. DMARC enforcement is a real prerequisite
Most cold senders run p=none. Moving to p=quarantine or p=reject at full coverage is achievable and it requires knowing every legitimate source sending as your domain, which is exactly the work most teams have not done. Reading DMARC reports is where that starts.
This is the one prerequisite worth pursuing on its own merits. More on that below.
4. BIMI does nothing for placement
The important one.
BIMI is a display feature. It changes how your message looks once it has reached the inbox. It does not improve your odds of reaching the inbox, because the logo only renders for messages that already arrived and already passed DMARC.
So even if a cold sender somehow obtained a certificate for a sending domain, the placement would be unchanged. There is no version of this that solves a deliverability problem.
What it is actually for
BIMI makes sense on the domain where your brand matters: transactional mail, product notifications, invoices, newsletters, support. Mail recipients expect from you and should be able to recognise instantly.
That is the opposite end of your estate from cold outreach, which leads to the correct conclusion:
Pursue BIMI on your primary domain, and keep cold email off that domain entirely.
If you are already following good practice, separate domains for cold outreach so reputation damage cannot touch your main domain, you are already in the right structure for this. BIMI simply reinforces a separation you should have. Buying domains for cold email covers the split, and subdomain strategy covers where subdomains fit.
The part worth doing anyway
The BIMI prerequisite that pays for itself regardless of whether you ever buy a certificate: getting DMARC to enforcement.
Moving from p=none to p=quarantine or p=reject means you have:
- Identified every legitimate source sending as your domain
- Fixed alignment on all of them
- Confirmed SPF is within the ten-lookup limit
- Confirmed DKIM is signing correctly everywhere
That work materially reduces the chance of your domain being used for spoofing, and it is the thing that actually protects your brand in the inbox. The logo is cosmetic; the enforcement policy is not.
The sensible order: get DMARC to enforcement on your primary domain, keep cold outreach on separate domains at whatever policy suits them, and consider a certificate only if brand recognition in the inbox has commercial value for your transactional and marketing mail.
The trend worth noticing
Here is the strategic reading, and it is the reason this post exists at all.
BIMI, verified checkmarks, and the bulk sender requirements introduced by Gmail and Yahoo all push in the same direction: a widening gap between mail from identifiable, accountable brands and everything else.
Cold email sits on the wrong side of that line by construction. Secondary domains, no trademark, no brand recognition, no logo. As providers add more signals that distinguish the branded lane, mail without those signals becomes more visibly unbranded.
The response is not to chase the branded-lane signals, which cold email cannot obtain. It is to be excellent at the things that do govern cold placement: clean authentication, genuine warmup, verified lists, complaint rates under 0.1%, bounce under 2%, and targeting tight enough that recipients do not complain. What sender reputation actually is covers what moves and what does not.
And one strategic implication worth stating: as the branded lane gets stronger, the value of converting a cold conversation onto your real domain rises. Once someone has replied, the follow-up should come from a human at your actual company domain, with whatever brand signals that domain carries. The throwaway domain’s job ends at the reply.
The short version
BIMI puts your logo in the inbox. It needs DMARC at enforcement, an SVG Tiny PS logo, and a certificate, a VMC backed by a registered trademark, or a CMC backed by documented prior use, at roughly four figures per domain per year.
Cold senders cannot have it, for four reasons: secondary sending domains have no trademark, certificates are per domain so the arithmetic is absurd across a sending pool, most cold senders run p=none, and most importantly BIMI changes display rather than placement.
Put BIMI on the domain where your brand matters, keep cold email off that domain, and do the DMARC enforcement work regardless, that part pays for itself.
Then move replies onto your real domain, because the gap between branded mail and everything else is widening and that is where it works in your favour.
Next: reading DMARC reports without a tool, or buying domains for cold email.
Frequently asked questions
Does BIMI improve email deliverability?
No. BIMI is a display feature that renders a logo for messages which have already reached the inbox and already passed DMARC. It cannot improve inbox placement, so it does not solve a deliverability problem.
Can you use BIMI for cold email?
In practice, no. Cold email runs on secondary domains that carry no registered trademark and no documented prior use of a mark, certificates are issued per domain at roughly four figures a year, and BIMI would not change placement even if obtained.
What is the difference between a VMC and a CMC?
A Verified Mark Certificate requires an eligible registered trademark and unlocks Gmail’s verified checkmark. A Common Mark Certificate requires documented prior use of the logo instead, assessed by the issuer, and supports logo display without the checkmark.
What DMARC policy does BIMI require?
Enforcement, p=quarantine or p=reject at pct=100, with SPF or DKIM authenticating and aligning with the visible From domain. A monitoring-only p=none policy does not qualify.
Sources: BIMI certificates in 2026: VMC vs CMC pricing · BIMI with VMC and CMC, Encryption Consulting