VMC for BIMI: Getting a Verified Mark Certificate
A Verified Mark Certificate (VMC) proves you own the trademarked logo BIMI displays. Prerequisites, VMC vs CMC, certificate authorities, cost and timeline.
What is a VMC?
A Verified Mark Certificate (VMC) is a digital certificate that attests your organization is authorized to use a specific logo. It is the cryptographic proof that mailbox providers require before they will display your brand logo next to your messages through BIMI (Brand Indicators for Message Identification).
Without a VMC (or its non-trademark sibling, a CMC — see below), most major mailbox providers will publish your BIMI record but will not render your logo. The certificate is what turns "BIMI configured" into "logo shown."
Why BIMI needs a VMC
BIMI lets you publish a logo via DNS, but on its own it provides no guarantee that the logo belongs to you. To prevent impersonation, mailbox providers such as Gmail, Apple Mail, and Yahoo require evidence of authorization. A VMC supplies that evidence by binding your logo to a registered trademark, validated by an authorized Certificate Authority.
Prerequisites — check these before you apply
VMC issuance is gated on getting your email-authentication house in order first. You will need:
- DMARC at enforcement. Your domain's DMARC policy must be set to
p=quarantineorp=reject— notp=none. See none vs reject. - A registered trademark for your logo. The logo you want displayed must be a trademark registered with a recognized intellectual-property office (e.g. USPTO, EUIPO, UKIPO, IP Australia). This is the single most common blocker.
- An SVG Tiny Portable/Secure (SVG P/S) logo. The logo must be a square, profile-style image in the restricted SVG Tiny P/S format — not a standard SVG, PNG, or JPG.
- A published, valid BIMI record at
default._bimi.yourdomain.comreferencing both the logo and the certificate.
VMC vs CMC
If your logo is not a registered trademark, you may still qualify for a Common Mark Certificate (CMC). CMCs cover logos that have been in consistent prior use but are not trademarked. Support varies by mailbox provider, and the displayed treatment can differ from a full VMC. If you hold a trademark, a VMC is the stronger choice.
How to get a VMC — step by step
Step 1 — Confirm DMARC enforcement. Move your domain to p=quarantine or p=reject and confirm legitimate mail still passes. Rushing to enforcement without monitoring first risks blocking real email.
Step 2 — Register (or confirm) your trademark. If the logo is not yet trademarked, begin registration early — this is typically the longest lead-time item.
Step 3 — Prepare the SVG P/S logo. Convert your logo to the SVG Tiny P/S profile: square aspect ratio, no scripting, no external references, solid background.
Step 4 — Choose a Certificate Authority. VMCs are issued by a small number of authorized CAs — currently DigiCert, GlobalSign and SSL.com. Apply through your chosen CA's VMC process.
Step 5 — Complete validation. The CA verifies your organization's identity and your right to the trademarked logo. Be ready to provide trademark registration details and respond to organizational verification.
Step 6 — Install and publish. Host the issued certificate (PEM) alongside your SVG logo and reference both in your BIMI DNS record.
Cost and timeline
A VMC is an annual certificate; pricing is set by the issuing CA and typically runs on the order of roughly $1,000–$1,500 per year. Issuance commonly takes anywhere from a few days to several weeks, driven mostly by trademark and organizational validation. If your trademark is not yet registered, plan for considerably longer — trademark registration itself can take months.
Readiness checklist
- DMARC policy at
p=quarantineorp=reject - SPF and DKIM aligned and passing for your sending sources
- Registered trademark for the logo (or CMC-eligible prior use)
- Square logo converted to SVG Tiny P/S
- Chosen CA (DigiCert, GlobalSign or SSL.com)
- Hosting in place for the SVG logo and certificate over HTTPS
- Valid
default._bimiDNS record
How DDMARC helps
DDMARC checks your BIMI readiness as part of domain monitoring: it validates your DMARC enforcement status, flags whether SPF and DKIM are aligned, and inspects your BIMI record so you know exactly which prerequisites are met before you spend on a certificate. Get your authentication to enforcement with confidence using our policy guidance, then pursue your VMC knowing the foundations are solid.
Frequently asked questions
Do I need a registered trademark to get a VMC?
Yes. A VMC requires a logo that is a registered trademark with a recognized intellectual-property office such as USPTO, EUIPO, UKIPO, or IP Australia. If your logo is not trademarked, you may qualify for a Common Mark Certificate (CMC) instead, though support and displayed treatment vary by mailbox provider.
What DMARC policy do I need before applying for a VMC?
Your domain's DMARC policy must be at p=quarantine or p=reject, not p=none. VMC issuance is gated on having your authentication already at enforcement.
How much does a VMC cost and how long does issuance take?
A VMC is an annual certificate priced by the issuing certificate authority, typically around $1,000 to $1,500 per year. Issuance commonly takes a few days to several weeks, and longer if your trademark is not yet registered.
Sources
See what your own domain is publishing.
Everything in this article is externally observable. The free checker reads your records and tells you which of them are missing, weak, or already doing their job.