The BIMI Certification Journey: Preflight Review and Eligibility Paths

TL;DR

VMCcerts guides organizations through BIMI certification in eight coordinated steps — from eligibility review through Certificate Authority validation to confirmed deployment — rather than a single purchase.

  • About 70% of first-time applicants VMCcerts reviews have at least one finding — often involving the trademark, logo, domain, or DMARC setup — that a preflight review catches before submission.
  • VMC and CMC are separate eligibility paths: a matching registered trademark may support VMC, while CMC depends on meeting its own documented prior-use requirements, not simply on VMC being unavailable.
  • A BIMI rollout typically involves four internal roles — marketing/brand, trademark/legal, DNS/IT, and design — and VMCcerts coordinates among them and the Certificate Authority.
  • The Certificate Authority independently controls validation and the final approval decision; VMCcerts prepares and coordinates the application.
  • For standard eligible applications, payment is normally requested after certificate issuance and deployment confirmation.

Buying a BIMI certificate can look like a single transaction. Working with VMCcerts, it’s an eight-step process, and payment is typically one of the last steps rather than the first — because a confirmed, working deployment is the actual goal, not just an issued certificate.

What is the BIMI certification?

The sequence an organization moves through with VMCcerts to get a verified brand logo displaying in supported inboxes: an eligibility review, a certificate-path decision between VMC and CMC, a quotation, application submission, independent Certificate Authority validation, DNS deployment, confirmation of live display, and — for standard applications — payment after that confirmation. A confirmed, working logo is the goal; certificate issuance by itself is not.

Free BIMI Checker

Our 8-Step Certification Process

This is the process VMCcerts uses to guide applicants from initial review through confirmed deployment. It isn’t a universal industry standard — other providers and direct Certificate Authority channels may structure the work differently. Most findings that need attention surface early, in Steps 1 and 2.

Review → Path selection → Quotation → Application → Validation → Deployment → Confirmation → Payment

1Initial eligibility review

We collect the required information and run a full eligibility assessment covering the logo, trademark registration and status, trademark ownership and age (see our note on whose name the trademark needs to be in), DMARC configuration, and other technical and branding details relevant to the application.

2Certificate path assessment

We assess which certificate path fits. A registered trademark that matches the proposed logo may support a Verified Mark Certificate (VMC) application. Where that match isn’t available, a Common Mark Certificate (CMC) may be considered instead — provided the organization can meet CMC’s own prior-use, rights, and identity requirements. CMC is a separate eligibility path, not an automatic fallback.

3Quotation and consultation

Once a path is confirmed, we provide a quotation for the eligible product and walk through the available options. No payment is requested at this stage.

4Application submission

If you decide to proceed, we prepare the application package and guide submission of the certificate request to the Certificate Authority.

One organization managing several brands and domains found that Certificate Authority identity, requestor/approver, and phone-verification requirements applied differently to each brand and domain during Step 4 — coordination that had to happen before any application could move forward (see our guidance on prioritizing domains). Read the multi-domain planning scenario

5Certificate Authority validation

We coordinate with you and the Certificate Authority throughout this step. The Certificate Authority independently carries out all required verification — business identity, domain ownership, trademark or prior-use evidence, and any other compliance checks — and independently decides whether to approve the application. This step is entirely the Certificate Authority’s to control.

Two related delays for one applicant: a CA-mailed passphrase letter the team couldn’t locate, and a Personal Statement form that sat unreturned — both simply a matter of a document reaching the right person during Step 5. Read the CA document verification scenario

6BIMI deployment

Once approved, we provide the required BIMI DNS record and help configure it so the logo can be published.

7Confirmation

We verify the logo is displaying correctly across the supported mailbox environments relevant to your organization and confirm the deployment together with you. Exactly how and where a logo appears is ultimately controlled by each mailbox provider, not by VMCcerts or the Certificate Authority.

8Payment

For standard eligible applications, we invoice after the certificate is issued and deployment is confirmed. Any different arrangement — for example, for agency, bulk, or specially structured orders — is disclosed before the application begins.

One issued VMC produced no visible logo because the BIMI selector pointed to the wrong host, the SVG had format issues, and hosted files later became unreachable — three separate causes behind one symptom at Step 6. Read the DNS and hosting deployment scenario

Why BIMI Certification Isn’t a One-Person Project

Certificate Authorities validate one applicant; they don’t manage the internal handoffs that happen before an application reaches them. A typical BIMI rollout touches four roles that don’t always work from a shared timeline unless someone actively connects them. VMCcerts acts as that coordination layer — between these internal stakeholders and the issuing Certificate Authority — through Steps 1 to 4:

Marketing or brand leadership

Sets branding priorities and decides what the logo should look like in the inbox.

Trademark or legal manager

Confirms registered mark ownership, jurisdiction, and mark type — or, for CMC, the prior-use history.

DNS or IT administrator

Enforces DMARC at p=quarantine or p=reject and configures the BIMI selector record.

Design team

Converts brand artwork into the SVG Tiny PS format the certificate requires.

What Preflight Review Most Often Finds

Steps 1 and 2 are where most first-time applications need a second look. Our team sees the same handful of patterns repeatedly, and each one has a practical next step:

What the preflight review identifiesWhy it requires attention before submissionHow VMCcerts helps resolve it
Trademark is a word mark, but the logo the applicant wants certified is figurativeThe certificate generally needs to match the type of mark actually registeredWe advise on registering the visual mark, or evaluate whether a CMC prior-use path may apply instead (more on what happens after a logo doesn’t clear validation)
Registered mark combines a figure and text; the applicant wants the figure alone certifiedAn extracted icon may not be treated as the same mark as the one on fileWe help confirm which element of the mark is actually registered before proceeding
Registered figurative mark uses one color; current branding uses anotherColor differences can raise questions about whether current branding still matches the registered markWe help align brand assets with the registered filing, or clarify what a given CA is likely to accept
Trademark application is pending, not yet grantedVMC generally requires an active, granted registration rather than a pending filingWe help time the application to registration, or evaluate CMC as an interim path (see our note on pending trademarks and BIMI)
Logo has been redesigned since the mark was registeredA rebrand can leave the registered mark out of step with current use, which a CA may flagWe help identify which version of the logo is most supportable today
(CMC) A single piece of historical evidence, such as one archived webpage, doesn’t match current brandingCMC eligibility typically depends on a documented body of prior-use evidence, not one archived snapshotWe help identify and organize a fuller evidence record — archives, marketing materials, prior filings — before submission
Applicant is unfamiliar with what counts as usable prior-use evidenceEvidence can be submitted incorrectly or incompletely, not because it doesn’t existWe explain what a CA is likely to accept as evidence and how to gather it
Assumption that years of use alone establishes ownershipLength of use alone is usually not sufficient — it generally needs to be documentedWe clarify what documentation a CA is likely to expect
Common preflight findings, why they need attention, and how VMCcerts typically helps.

None of these are dead ends. They’re findings we walk through before the Step 3 quotation, so you know what, if anything, needs attention. Many applicants return once that’s resolved.

One applicant’s initial logo evidence didn’t clear validation. Rather than a dead end, the organization pursued a registered trademark and returned to complete a VMC application on stronger footing. Read the rejected logo evidence scenario
~70%of first-time applicants VMCcerts reviews receive at least one finding that should be addressed before submission

This figure reflects VMCcerts’ own first-time, pre-application eligibility reviews — not a Certificate Authority rejection rate, an industry-wide average, or a figure from any other provider. A “finding” is anything our review identifies as needing attention before the application moves forward: most often something involving the registered trademark, the proposed logo, the legal entity on record, the domain, DMARC configuration, or supporting evidence. Certificate Authorities don’t publish comparable data, so this figure can’t be benchmarked against theirs — it describes what VMCcerts observes in its own process.

When Payment Is Normally Requested

For standard eligible applications, VMCcerts normally invoices after the certificate has been issued and deployment is confirmed — not at the start of the process. Steps 1 through 7, eligibility review through deployment confirmation, are typically completed first. Any different arrangement, such as for agency, bulk, or specially structured orders, is disclosed before the application begins. The intent is to reduce your upfront financial commitment and align payment with completion of the standard managed process — not to suggest that all risk associated with a Certificate Authority’s decision transfers to VMCcerts.

How VMC and CMC Eligibility Differ

The 8 steps are the same for both paths; what differs is the outcome of Step 2. A registered trademark that matches the proposed logo may support a VMC application. Where that match isn’t available, CMC may be considered instead — but only if the organization can meet CMC’s own prior-use, rights, identity, and domain requirements. CMC is an independent eligibility path, not an automatic fallback for every applicant who doesn’t qualify for VMC. Step 5’s Certificate Authority validation then reviews whichever evidence path applies.

Renewal and Ongoing Continuity

The 8 steps above cover initial certification. VMC and CMC both renew annually — the trademark or prior-use evidence needs to still hold, DMARC enforcement needs to not have drifted, and larger organizations also coordinate procurement and multi-year terms alongside the technical renewal.

One enterprise renewing an existing VMC had to coordinate internal procurement and multi-year coverage questions, plus CA postal and callback verification, before BIMI file references could even be updated. Read the VMC renewal scenario
A note on our data: The 8-step process described here reflects VMCcerts’ own operating process, not an industry standard. The approximately 70% figure is a measured result from VMCcerts’ own first-time eligibility reviews; it is not a Certificate Authority statistic and isn’t intended to describe any other provider’s process. Specific examples are drawn from anonymized, real implementation scenarios published at vmccerts.com/implementation-scenarios.

Frequently Asked Questions

Do I have to pay before applying for a BIMI certificate through VMCcerts?

For standard eligible applications, no — VMCcerts normally invoices after the certificate is issued and deployment is confirmed. Different arrangements, where applicable, are disclosed before the application begins.

How does VMCcerts decide between VMC and CMC?

Based on the Step 2 certificate path assessment: a registered trademark that matches your logo may support VMC. If that match isn't available, we evaluate whether CMC's prior-use, rights, and identity requirements can be met instead.

Who needs to be involved internally for a BIMI rollout?

Typically someone who owns the brand or logo decision, someone who can speak to trademark or prior-use status, and someone who can enforce DMARC and publish DNS records. Larger organizations often also involve a design team for logo file conversion.

What kinds of issues does a preflight eligibility review typically find?

Most often something involving the registered trademark, the proposed logo, the legal entity on record, the domain, DMARC configuration, or supporting evidence — see the table above for common examples.

Does VMCcerts control whether the Certificate Authority approves my application?

No. Certificate Authority validation is managed entirely by the Certificate Authority, which independently decides whether to approve an application. VMCcerts prepares and coordinates the application but doesn't make or influence that decision.

Where to Go Next

Your situationBest next step
Not sure if you’re ready, or which certificate path fitsFree eligibility review
Ready to see the practical setup stepsBIMI setup guide
Want a broader comparison before choosing a providerHow to evaluate a VMC provider
Need the full CMC prior-use evidence breakdownCMC prior-use evidence guide
DMARC isn’t enforced yetDMARC services
Ready to see certificate pricingPricing
Quick links based on where you are in the certification process.
Ready to assess your BIMI certification path?
A free eligibility review looks at your trademark and logo alignment, VMC or CMC eligibility, domain setup, and DMARC readiness, so you know what’s needed before you apply.