VMCVerified Mark Certificate
A VMC (Verified Mark Certificate) is a digital certificate that proves your organisation owns the logo it wants to display beside its email through BIMI. Issued only after a certificate authority verifies a registered trademark, it is what lets supporting clients like Gmail show your logo, often with a blue verified checkmark. A VMC requires an enforced DMARC policy first.
- It cryptographically proves you own the logo, preventing logo impersonation
- BIMI plus a VMC is what shows your brand logo beside authenticated mail
-
It requires an enforced DMARC policy:
p=quarantineorp=reject - A CMC is a lower-cost alternative that needs prior use rather than a trademark
quarantine or reject
What a VMC is and why it exists
BIMI lets a brand publish its logo in DNS so supporting mailbox providers can show it beside authenticated mail. The obvious risk is that anyone could publish any logo. The VMC closes that hole: it is a certificate, issued by an approved authority only after the authority verifies that your organisation actually holds a registered trademark for the mark, cryptographically binding the logo to your domain.
With a valid VMC, providers like Gmail can show your logo with confidence, and Gmail adds a blue verified checkmark to signal the brand was authenticated. Gmail will not display a self-asserted logo, so for those providers a VMC (or its CMC cousin) is the price of entry. The certificate is delivered as a PEM file referenced from your BIMI record alongside the logo itself.
What you need to get one
A VMC sits at the top of a stack of prerequisites. You cannot get the logo to show without all of them:
- Authentication. SPF or DKIM must pass and align, and you must publish DMARC.
- Enforced DMARC. The policy has to be
p=quarantineorp=rejectatpct=100;p=nonedoes not qualify. - A registered trademark. The logo must be a registered trademark (or a government mark) in a recognised jurisdiction.
- A compliant logo file. SVG Tiny Portable/Secure (SVG Tiny PS), a square 1:1 aspect ratio, and under 32 KB.
- A published BIMI record. A DNS
TXTrecord points to both the logo and the certificate.
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"VMC vs CMC: the cost and trademark trade-off
VMCs are not cheap. List pricing from authorities such as DigiCert runs around 1,499 USD per year, and the hardest part for many brands is the trademark requirement itself, since registering a mark takes time and money.
To widen access, Google began supporting the Common Mark Certificate (CMC) in Gmail in September 2024. A CMC verifies a logo on the basis of prior use (typically a year of demonstrable use, rather than a registered trademark), so brands without a trademark can still get their logo into the inbox. The trade-off: a CMC shows the logo but does not earn the blue verified checkmark that a full VMC does. Both still require the same enforced DMARC foundation.
The path from DMARC to a verified logo
p=quarantine or p=rejectVMC vs CMC
| VMC | CMC | |
|---|---|---|
| Proof of ownership | Registered trademark | Prior use (about 1 year) |
| Verified checkmark | Yes (Gmail) | No |
| Enforced DMARC needed | Yes | Yes |
| Relative cost | Higher | Lower |
| Best for | Trademarked brands | Brands without a trademark |
Common mistakes
p=quarantine or p=reject with pct=100. Get authentication and an enforced policy working first, then pursue the VMC.