20227 Certificates.
109 Countries. One Structural Shift. The Complete BIMI Intelligence Report 2026.

The compound annual growth rate (CAGR) for BIMI certificate issuances from 2021 to 2025 is approximately 88% — one of the most sustained technology adoption curves in enterprise email history. Even as growth normalises in 2026–2027, the base continues expanding. At the projected 2026 pace, the ecosystem will cross 20,000 active certificates before year end.

The BIMI certificate authority market was built by two founding CAs — DigiCert and Entrust — who co-created the VMC standard and together issued every BIMI certificate from 2019 through mid-2024. In 2026, that duopoly has ended. Entrust discontinued its CA business — following the public distrust of Entrust by Google Chrome and Mozilla Firefox in November 2024, which revoked its right to issue browser-trusted certificates — ceasing all public certificate issuance. Two new CAs entered the market in 2025: GlobalSign, which conducted a deliberate market entry with 202 certificates, and SSL Corp, which entered both directly (123 certs) and through the Sectigo channel brand (207 certs, with SSL Corp as Root CA).

The Sectigo brand operates as a distribution channel under SSL Corp’s Root CA infrastructure. When examining a Sectigo-branded BIMI certificate’s trust chain, SSL Corp appears as the Root CA. This architecture is a standard channel distribution model — Sectigo’s brand heritage traces back to earlier DigiCert infrastructure before its rebrand and subsequent repositioning under SSL Corp.

• 🔴
  Entrust’s exit affects 21.9% of all active global BIMI certificates

  4431 certificates issued by a CA that has discontinued its business. None can be renewed through Entrust. Migration to DigiCert, GlobalSign, or Sectigo is required before each certificate’s expiry date. The UK (663 Entrust certs = 38.1% of UK BIMI), India (317 = 33.7%), and Canada (207 = 30.9%) face the most concentrated exposure.
• 🟡
  96.2% of active certificates are older than 1 year — renewal management is the largest operational gap

  The average BIMI certificate age globally is 585 days (~19 months). 32.9% are older than 2 years. Silent failure — logos disappearing because a certificate expired without the email team noticing — is the most underreported risk in the ecosystem. A formal renewal management process is not optional at this stage of the ecosystem’s maturity.
• 🟢
  38.3% of certificates belong to below-median notability organisations — BIMI is genuinely mid-market

  Score 1–4 organisations account for 7756 certificates. The Technology sector (notability avg 4.81) and Education sector (4.81) confirm that mid-market companies and institutions are adopting BIMI, not just global enterprises. The inbox trust standard is democratising.
• 🟢
  GlobalSign and Sectigo expand competition in what was previously a two-CA market

  For the first time since BIMI certificates launched commercially, buyers have four CA options. GlobalSign’s strength in Japan and India and Sectigo’s presence in North America create genuine alternatives to DigiCert. Competitive CA evaluation is now warranted — particularly for Entrust migration buyers who should not automatically default to DigiCert without comparison.
• 🟡
  March 2027 is the global BIMI renewal peak — 820 certificates expiring in 31 days

  The 2023 and 2025 high-growth years created two future renewal concentration points. The largest single month in the dataset’s expiry schedule is March 2027 at 820 certificates globally — 4.1% of the entire ecosystem expiring in one month. Organisations with Q1 2027 expiry dates should initiate renewal no later than December 2026.

Total Volume

The projected 2026 full-year issuance of ~9079 certificates — if achieved — would represent the highest single-year addition to the ecosystem in its history. The underlying growth drivers (DMARC enforcement mandates, mailbox provider display improvements, mid-market adoption) remain intact. The Entrust exit removes one CA’s contribution to new issuance volume, which DigiCert, GlobalSign, and SSL Corp are collectively absorbing.

Geography

India will likely surpass Germany for the #3 global ranking in 2027, driven by continued BFSI expansion and the arrival of Technology and Healthcare sectors in greater volume. Japan’s 2025 surge (+218% YoY) suggests it has reached a tipping point in enterprise adoption that will sustain high issuance rates through 2026–2027. The DACH cluster (Germany, Austria, Switzerland) faces a Q1 2027 renewal concentration that will stress-test renewal management capabilities across the region.

Certificate Authority Market

DigiCert’s 85.4% share of 2026 new issuances will likely moderate as GlobalSign and Sectigo build capacity and brand recognition. The Entrust migration wave — 4431 certificates requiring CA change over their respective expiry windows — provides a structural opportunity for challenger CAs to win accounts that DigiCert’s scale alone might not fully capture. The four-CA market is more competitive than the two-CA founding era, which is better for buyers.

Sectors

Healthcare and Education remain the two most under-indexed sectors relative to their email volume and brand trust needs. Both have characteristics — high-volume sending, recipient trust dependencies, and active CMC pathway usage — that point toward accelerating adoption in 2027. Telecom and Media/Publishing, while high-notability, remain small in absolute volume: the non-adopted majority of both sectors represents a significant opportunity for CAs and BIMI deployment specialists.