[ BIMI & brand ]

BIMI and Gmail's visible verification indicators

Distinguish Gmail logo display from its VMC-associated verification indicator, then test the actual Gmail surface without treating the symbol as approval of message content.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Specify the desired indicator
  • Test the actual Gmail surface
  • Keep payment controls independent
On this page
  1. Key points
  2. Takeaway
  3. By role
  4. Frequently asked questions
  5. Sources
  6. Glossary
  7. Related guides

[ Takeaway ]

Distinguish Gmail logo display from its VMC-associated verification indicator, then test the actual Gmail surface without treating the symbol as approval of message content.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Test the actual Gmail surface

Client and message context affect interpretation.

Next steps

  1. Record certificate category.
  2. Preserve authentication evidence.
  3. Control contact-image confounders.

CISO / SecOps

Keep payment controls independent

An indicator is not approval of a request.

Next steps

  1. Retain out-of-band verification.
  2. Train users on bounded meaning.
  3. Investigate compromised legitimate senders.

Founder / Non-technical

Specify the desired indicator

Certificate choices should match the intended recipient experience.

Next steps

  1. Distinguish logo and checkmark.
  2. Confirm target applications.
  3. Avoid guaranteed-display promises.

[ FAQs ]

Frequently asked questions

Can a CMC display a Gmail logo?

Google documents CMC avatar support, without the VMC-associated checkmark.

Google Workspace: Set up BIMI

Does a missing checkmark prove CMC failure?

No. It can be the expected certificate-category behavior.

Google Workspace: Set up BIMI

Is Gmail on iOS the same test as Apple Mail?

No. They are different applications with different display conditions.

Does purchasing a VMC guarantee the indicator?

No. Other deployment and receiver conditions still matter.

Google Workspace: Set up BIMI

Can a contact image confuse testing?

Yes. Record and control other avatar sources where possible.

Does the checkmark approve an invoice?

No. Verify consequential business requests independently.

Should forwarding be recorded?

Yes. A forwarded path is a different test condition from direct delivery.

Were the example outcomes observed?

No. They are documented expectations for a synthetic test design, not live Gmail results.

[ Sources ]

Sources

  1. Google Workspace: Set up BIMI

    Sections VMC and CMC logo and checkmark eligibility

[ Glossary ]

Glossary

Brand avatar
A visual sender image shown in a mailbox interface.
Verification indicator
A receiver-specific visual symbol associated with its verification criteria.
Test surface
The particular application and environment in which an outcome is observed.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base