BIMI Certificate Renewalbefore it expires

A BIMI certificate does not last forever. When your VMC or CMC expires, the logo stops showing next to your emails, and nothing warns you unless someone notices. This page explains when to renew, what you need, what it costs, and how to move off an Entrust certificate.

SimpleDMARC renews certificates from DigiCert, Sectigo and GlobalSign. We can also issue a new certificate if yours came from somewhere else.

What Happens When a Certificate Expires

The certificate is the proof mailbox providers check before they show your logo. Once it expires, the check fails. Your DMARC policy and your BIMI DNS record can still be perfectly fine, and the logo still disappears.

The effects are quiet:

• Your logo and, for a VMC, the Gmail checkmark vanish from new emails.
• Nothing bounces and nothing breaks, so there is no error to catch.
• Recipients just see a plain sender again.

This is why renewal is better done early. A gap of even a few days means every email you send in that window goes out without your branding.

When to Renew

Start 30 to 45 days before the expiry date. That window covers the parts you do not control:

• Validation time. Typically 1–3 business days for a VMC and 1–2 for a CMC once documents are complete, but a missing document can add days.
• Trademark and logo checks. Renewal re-checks your organization, and for a VMC, your trademark. If the registration has changed or lapsed, you want to know early.
• Your own approvals. Someone may need to sign off on the purchase or find the paperwork.

Find your expiry date in the certificate itself, in the email from the authority, or ask us. Send us the domain and we will look it up.

A Simple Renewal Timeline

Here is a schedule that works for most organizations. Adjust it to your own approval process.

When	What to do
60 days before expiry	Find the expiry date. Check DMARC is still enforced with the DMARC Checker.
45 days before	Send us the renewal request and any changes (logo, company name, trademark).
30 days before	Documents submitted and validation under way.
14 days before	Certificate issued and uploaded, record tested with the BIMI Checker.
Expiry day	Old certificate ends. The new one is already live, so nothing changes for recipients.

If you are already inside 30 days, do not wait. Send the request today and tell us the expiry date.

What You Need to Renew

• Your domain and your current certificate details, if you have them
• Your current logo, in SVG Tiny P/S format. If it changed, convert the new one with the BIMI SVG Converter.
• For a VMC: proof your trademark registration is still valid
• For a CMC: proof your logo is still in use
• DMARC still enforced: p=quarantine or p=reject, with pct=100. Check with the DMARC Checker.
• Organization details unchanged, or an update if your company name or address changed

If anything changed since your last order (new legal name, new logo, lapsed trademark), tell us on the form. It is much easier to sort out before the order than during validation.

Replacing an Entrust VMC

Entrust stopped issuing VMCs in 2025. If your current VMC came from Entrust, you will need a replacement from an authority that still issues them when it expires.

What stays the same: your DMARC policy, your SVG logo, and the shape of your BIMI record.

What changes: the certificate file, and the authority that verifies you.

We can order the replacement from Sectigo, DigiCert or GlobalSign. See the Sectigo page if you want details on moving an Entrust certificate.

Switching Authority When You Renew

You are not locked into the authority that issued your first certificate. A renewal is a good moment to compare, because you already know what the process involves. We will tell you honestly which of the three suits your terms and timeline. See the full comparison.

Renewal Pricing

Renewal uses the same starting prices as a new certificate:

	VMC	CMC
Starting price	From $749 / year	From $649 / year
Terms	1, 2 or 3 years	1, 2 or 3 years

Multi-year terms lock in your price, which also means fewer renewals to keep track of. We confirm the exact price in writing before you pay.

Never Miss a Renewal Again

Two simple ways to stop this from catching you out:

1. Put the expiry date in a calendar with a reminder at 60 days and another at 30.
2. Let us remind you. Let our automated alerts do the work. Our system automatically tracks your active expiration dates and triggers email notifications directly to your registered address at 60, 30, and 7 days prior to expiry, complete with a direct renewal link.

Your free DMARC Growth plan with a certificate order also keeps your DMARC monitored, which is the other half of keeping BIMI working. A certificate that is current but sitting on a domain that dropped back to p=none still shows nothing.

After Renewal: Update Your Record

When the new certificate arrives, it replaces the old file at the address in the a= tag of your BIMI record:

``default._bimi.yourdomain.com. IN TXT "v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/certificate.pem"``

If you keep the same file name and address, you only replace the file. If the address changes, update the record. Then run the BIMI Checker to confirm the new certificate is being served. With Hosted BIMI, we replace it for you.