A Verified Mark Certificate (VMC) lets Gmail, Apple Mail and other BIMI-ready inboxes display your trademarked logo, and only a VMC earns Gmail’s blue checkmark. The BIMI Group lists three companies that issue them. Here’s what it proves, where it shows, and how to set one up.
A Verified Mark Certificate is a digital certificate from a Mark Verifying Authority. It proves your organization’s right to use a registered trademark or government mark as its email logo. Mailbox providers that support BIMI use it to show that logo, and Gmail adds a blue checkmark.
Table of Contents
- What Is a Verified Mark Certificate (VMC)?
- How Does a Verified Mark Certificate Work?
- BIMI and VMCs: How They Work Together
- Benefits of a Verified Mark Certificate
- VMC vs CMC: Which Do You Need?
- Requirements for Getting a VMC
- How to Get a Verified Mark Certificate: Step-by-Step
- Common Challenges and How to Avoid Them
- Who Should Get a VMC?
What Is a Verified Mark Certificate (VMC)?
Verified Mark Certificates (VMCs) are digital certificates that prove you own a trademarked logo and let mailbox providers display it through the BIMI standard, next to your sender name.
Only a Mark Verifying Authority (MVA), a certificate authority approved to issue Mark Certificates, can issue a VMC. Before it does, it verifies that:
- Your organization owns the registered trademark, or is licensed to use it.
- Your domain enforces DMARC. DigiCert, for example, requires this before it issues.
- Your logo file meets the technical rules for BIMI.
That verification keeps attackers from putting your logo on their mail. A spoofed message that fails your domain’s authentication shows no logo, so impersonation, a common route into business email compromise, is easier to spot.
Who Issues VMCs?
The BIMI Group’s issuer list names three Mark Verifying Authorities: DigiCert, GlobalSign and SSL.com. Entrust, one of the first issuers, is no longer on it. The BIMI Group doesn’t certify MVAs itself. Each mailbox provider decides which ones it trusts.
SSL Dragon resells DigiCert. If you have a registered trademark and DMARC at enforcement, you can buy a DigiCert VMC from us, and DigiCert runs the validation.
What’s Inside a VMC?
A VMC is an X.509 certificate, the same format as an SSL certificate, with one big difference: your logo is inside it. The SVG file is embedded through the logotype extension defined in RFC 3709. The certificate also records the type of mark (registered or government) and the domain names it’s issued for.
Every VMC is logged in Certificate Transparency before it’s issued. Its private key is never used, which is why the Mark Certificate Requirements let the CA generate it for you.
You can also limit which CAs may issue Mark Certificates for your domain with a CAA record that uses the issuevmc tag. A plain issue tag doesn’t restrict them.
| VMC | SSL/TLS certificate | |
|---|---|---|
| What it proves | Your right to use a logo, for your domain | Control of a domain (plus your organization, for OV and EV) |
| Who checks it | Mailbox providers | Web browsers |
| Where it lives | A PEM file you host at an HTTPS URL | Your web server |
| Maximum validity | 398 days under the standard; DigiCert issues up to 397 | 200 days since March 15, 2026 |
| Private key | Unused | Proves the server’s identity in TLS handshakes |
How Does a Verified Mark Certificate Work?
A Verified Mark Certificate is the last link in a chain of email authentication checks the receiving mailbox provider runs on your message. When your email arrives, the provider:
- Checks SPF (Sender Policy Framework) to confirm the sending server may send for your domain.
- Checks the DKIM (DomainKeys Identified Mail) signature to confirm the message wasn’t changed.
- Applies your DMARC (Domain-based Message Authentication, Reporting, and Conformance) policy, which must be at enforcement.
- Looks up your BIMI record, a DNS TXT record at default._bimi.yourdomain.com.
- Fetches your logo from the record’s l= URL and your VMC, in PEM file format, from its a= URL.
- Checks that the VMC covers your domain and comes from a certificate authority it trusts.
If every check passes, your logo appears next to your sender name, and Gmail adds the blue checkmark. If any check fails, the message shows the usual initial or blank avatar.
BIMI and VMCs: How They Work Together
BIMI (Brand Indicators for Message Identification) is the standard that tells mailbox providers where your logo and certificate live. The VMC is the evidence that you’re entitled to use that logo. That’s why VMCs and their no-trademark alternative, Common Mark Certificates (CMCs), are often called BIMI certificates.
BIMI is developed by the AuthIndicators Working Group, known as the BIMI Group, and is still an IETF Internet-Draft (version 14, May 1, 2026), not a finished standard.
The a= tag that points to your certificate is optional in the draft. A record without it is called self-asserted BIMI: you publish a logo, but no certificate backs it. Yahoo, Fastmail and La Poste can show self-asserted logos. Gmail and Apple Mail need a certificate.
Which Inboxes Show Your Logo?
| Provider | No certificate | With a CMC | With a VMC |
|---|---|---|---|
| Gmail | No logo | Logo | Logo and blue checkmark |
| Apple Mail (iOS 16, iPadOS 16, macOS Ventura 13 and later, iCloud.com) | No logo | Not documented by Apple | Logo, marked as digitally certified |
| Yahoo Mail | Logo, on bulk mail with enough reputation and engagement | Same rules | Same rules; Yahoo uses the VMC as a signal |
| Fastmail | Logo | Logo | Logo |
Gmail has shown BIMI logos since July 12, 2021, and has accepted CMCs since September 24, 2024. Zoho Mail asks its own customers for a VMC to send BIMI mail, but doesn’t publish which certificates it accepts on mail it receives.
The BIMI Group’s adoption chart (last updated May 2025) also lists Comcast, La Poste and Onet among the supporters and Seznam as considering BIMI. It lists Microsoft as not supporting it.
Benefits of a Verified Mark Certificate
A VMC puts your verified logo, and in Gmail a blue checkmark, next to every message that passes authentication. Here’s what that does, and what it doesn’t:
- Brand recognition: recipients see your logo instead of a letter or a blank circle in the inboxes above.
- Harder impersonation: an attacker can’t get a VMC for your trademark, and mail that fails your DMARC policy shows no logo. That makes phishing in your name easier to spot.
- The Gmail checkmark: only a VMC gets it. A CMC shows your logo without it.
- Open rates: the most-cited evidence is a 2021 survey by Red Sift and Entrust. It showed 1,026 people in the US and UK a test inbox. When a brand showed a logo and its competitor didn’t, its share of opens rose 21% (US) and 39% (UK), Red Sift reports. That’s a survey result, not data from real campaigns, and both companies sold BIMI products at the time.
- Deliverability: BIMI doesn’t move mail out of spam on its own. Zoho’s BIMI documentation says it doesn’t affect inbox placement, and Gmail still runs its normal anti-abuse checks. The DMARC enforcement BIMI requires is what protects your domain from spoofing.
VMC vs CMC: Which Do You Need?
Get a VMC if your logo is a registered trademark, or a government mark, and you want Gmail’s blue checkmark. Get a Common Mark Certificate (CMC) if your logo isn’t registered but has been on your website for at least 12 months.
That 12-month rule is specific. The CA checks that the logo is on a domain you control today, and that archive.org captures show it on the same domain at least 12 months earlier.
A CMC also covers a modified version of a registered trademark. Since version 1.8 of the Mark Certificate Requirements (June 11, 2026), it can also cover a “provisional mark”. That’s a logo that differs from your registered trademark, when the trademark is at least 3 years old. DigiCert’s CMC documentation doesn’t list this type yet.
| VMC | CMC | |
|---|---|---|
| Proof of your logo | Registered trademark or government mark | 12+ months of use on your domain, a modified registered mark, or a provisional mark |
| Logo in Gmail | Yes | Yes, since September 24, 2024 |
| Gmail blue checkmark | Yes | No |
| Apple Mail | Yes | Not documented by Apple |
| Government marks, such as official seals | Yes | No |
Shared or licensed logos don’t push you to a CMC. If you use a registered trademark under license, you can get a VMC with an authorization letter from the owner. Both certificates need the same DMARC enforcement and SVG logo. To see the two side by side, compare DigiCert VMC and CMC.
Requirements for Getting a VMC
Before a CA issues a VMC, you need four things: DMARC at enforcement, a registered trademark, an SVG logo in the right profile, and identity validation.
DMARC at Enforcement
Your policy must be p=quarantine or p=reject, because p=none doesn’t qualify. Google also requires pct=100, so the policy covers all your mail. The new DMARC standard, RFC 9989 (May 2026), retires pct=, but receivers ignore tags they don’t recognize, so keeping it does no harm.
The BIMI draft adds that your subdomain policy (sp=) can’t be none. Set this at your organizational domain, not only on a subdomain.
DMARC builds on SPF and DKIM. SPF lists the servers allowed to send for your domain, and DKIM signs each message so any change shows up. A message passes DMARC when at least one of them passes for a domain that matches your From address.
A Registered Trademark
Your logo must be registered at a trademark office. Common ones are the USPTO, the European Union Intellectual Property Office, the UK Intellectual Property Office, the Canadian Intellectual Property Office and the Japan Patent Office.
The requirements accept any office in WIPO’s directory, but each MVA lists the offices it accepts, so check with your CA. Government marks also qualify, and so do licensees with the owner’s authorization.
An SVG Tiny PS Logo
Your VMC logo must follow the SVG Tiny Portable/Secure profile and sit at a public HTTPS URL:
- Set version=”1.2″ and baseProfile=”tiny-ps” on the root <svg> element.
- Include a <title> element, ideally with your organization’s name.
- Leave out scripts, animation, external references, and x=/y= attributes on the root element.
- For Gmail, make it at least 96 × 96 pixels, set in absolute pixels.
- Gmail also recommends a centered logo in a square, on a solid background, at 32 KB or less.
Identity Validation
Validation works much like Extended Validation for SSL certificates. At DigiCert, the applicant either sends notarized copies of their ID or does a live webcam interview, then confirms their identity in an in-person or video meeting.
You need one certificate for each logo you want to show. If your brands use different logos, each one needs its own VMC.
How to Get a Verified Mark Certificate: Step-by-Step
Follow these six steps in this order. The order matters because your BIMI record points to the certificate file, and that file exists only after the CA issues it.
1. Get DMARC to Enforcement
Publish SPF and DKIM for every service that sends mail as your domain, then add a DMARC record. Start at p=none to collect reports, fix any legitimate senders that fail, then move to p=quarantine and p=reject. A record at full enforcement looks like this:
v=DMARC1; p=reject; pct=100; rua=mailto:[email protected]2. Confirm Your Trademark, or Choose a CMC
Check that your logo is a registered trademark in good standing at an office your CA accepts. If it isn’t registered, the process runs in four stages: search existing marks, prepare the application, file it, and answer any examiner questions. If your logo has been on your site for 12 months or more, a CMC lets you start now.
3. Prepare Your SVG Logo and Host It
Start from a vector file (.ai, .eps, .pdf or .svg) and export it as SVG Tiny 1.2. Most editors can’t save the Tiny PS profile directly, so then set baseProfile=”tiny-ps”, add the <title> element and remove anything the profile bans. The BIMI Group’s SVG conversion tools help with this. Upload the file and note its HTTPS URL.
4. Order the Certificate and Pass Validation
Order a DigiCert VMC or CMC and submit your trademark details and logo.
To qualify, DigiCert needs a DMARC-compliant domain and an SVG in the right profile. A VMC also needs a registered trademark, and a CMC needs 12 months of logo use or a modified version of your registered mark. A BIMI record isn’t on either list. DigiCert then validates your organization and the applicant’s identity, as described above.
5. Host the PEM File
When the certificate is issued, you receive a PEM file, often called the VMC certificate file, with your logo embedded in it. Gmail asks you to append your CA’s intermediate and root certificates to it, in the order issued. Host the file at a public HTTPS URL, such as https://yourdomain.com/vmc.pem.
6. Publish or Update Your BIMI Record
Add a TXT record at default._bimi.yourdomain.com that points to both files:
v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pemReplace yourdomain.com with your domain, and set the TTL to 3600 seconds, as Google suggests. You can publish the record earlier with only the l= tag, so Yahoo, Fastmail and La Poste may show your logo while you wait for the certificate. Add a= once the PEM file is live.
When Will Your Logo Appear?
Google says it can take up to 48 hours after you add the BIMI record for your logo to show in Gmail. After that, it depends on each provider: logos get cached, Yahoo shows them only on bulk mail with enough reputation and engagement, and Gmail still applies its normal anti-abuse checks. No provider guarantees display.
Common Challenges and How to Avoid Them
Watch for these five problems:
- Trademark timing: if your logo isn’t registered yet, file early. If the logo has been on your site for 12 months, a CMC can cover the wait.
- Rejected SVG files: check the file with the BIMI Group’s SVG Assistant tool, a beta, before you submit it for validation. The BIMI Inspector checks only your published BIMI record and DMARC policy, not the SVG or the certificate.
- DNS mistakes: add one record at a time (SPF, DKIM, DMARC, then BIMI) and check each before adding the next.
- Logo changes: the certificate embeds your logo, so a new logo needs a new certificate. Host the new PEM file before you update your BIMI record.
- Expiry: if your VMC expires, your logo disappears. In an October 2, 2026 check by SimpleVerifier, 22 of 256 domains with a BIMI record still pointed to an expired certificate. DigiCert issues VMCs for up to 397 days, so schedule the renewal. The shorter SSL certificate lifetimes don’t apply to Mark Certificates.
Who Should Get a VMC?
A VMC pays off when you already have a registered trademark and DMARC at enforcement. It matters most if many recipients read your mail in Gmail or Apple Mail and criminals impersonate your brand. Online stores sending order confirmations, banks, and SaaS companies sending security alerts fit that profile.
Few large companies have BIMI fully working yet. In an October 2, 2026 check of 496 S&P 500 companies, SimpleVerifier found 84 (16.9%) published a BIMI record. Only 67 (13.5%) had an unexpired certificate, DMARC at enforcement and a logo that loaded.
If your logo isn’t registered but has been on your site for 12 months, a CMC gets it into Gmail without the checkmark. If most of your mail goes to Yahoo or Fastmail users, those inboxes can show a logo from the BIMI record alone, so the certificate matters less there.
Get a DigiCert VMC or CMC Through SSL Dragon
If your logo is a registered trademark and your DMARC policy is at enforcement, a VMC gives you the logo and Gmail’s blue checkmark. If it isn’t registered, start with a CMC. SSL Dragon sells both as DigiCert certificates, validated by DigiCert.
Verified Mark Certificate FAQ
Yes. The Mark Certificate Requirements cap a VMC at 398 days, and DigiCert issues them for up to 397 days. If your VMC expires, mailbox providers stop showing your logo, so renew before the end date.
The price depends on the issuer and the term, and a CMC costs less than a VMC. See current DigiCert VMC and CMC prices, or our [full cost breakdown]([LINK: cost article, TBD]), which also covers trademark and setup costs.
Not everywhere. Yahoo, Fastmail and La Poste can show a logo without one, but Gmail and Apple Mail need a certificate.
The steps match a VMC, except that validation checks your logo’s history instead of a trademark registration. For the usual prior-use CMC, archive.org must show the logo on your domain at least 12 months before validation.
No. Both are X.509 certificates, but an SSL certificate encrypts traffic to your website, while a VMC proves your right to a logo and only mailbox providers check it.
No. The BIMI Group lists Microsoft as not supporting BIMI (chart last updated May 2025), so Outlook users won’t see your logo, even if you have a valid VMC.
Save 10% on SSL Certificates when ordering from SSL Dragon today!
Fast issuance, strong encryption, 99.99% browser trust, dedicated support, and 25-day money-back guarantee. Coupon code: SAVE10
