BIMI, VMC & CMC: Frequently Asked Questions

A Verified Mark Certificate (VMC) is a digital certificate issued by a trusted Certificate Authority (CA) that lets organizations display their registered trademark logo next to emails in supported inboxes, using the BIMI standard. It serves as proof that a brand's email identity has been independently verified.

A VMC ties your verified organization identity and trademarked logo to your sending domain. After the CA completes validation, the certificate works alongside DMARC and BIMI to confirm email legitimacy. When a recipient's inbox — Gmail or Yahoo Mail, for example — receives your email, it checks authentication and pulls the verified logo from your BIMI record to display next to the message.

A Common Mark Certificate (CMC) is an extension of the BIMI standard designed for organizations that do not hold a registered trademark. It allows verified entities to display their brand logo in supported email clients by proving active, long-term use of the logo.

A BIMI Certificate puts your verified logo in the inbox before a recipient even opens your email. This builds immediate trust, increases open rates, and reduces the risk of your domain being impersonated. For any organization sending authenticated email, it's the most visible signal that the message is genuinely from you. See BIMI Certificate options — VMC and CMC

Check with your legal or brand team first — they'll confirm whether your logo is registered with an approved authority such as the USPTO or EUIPO. If you don't have internal support, search the WIPO Global Brand Database directly. An active registration with a recognized trademark office is what qualifies your logo for VMC issuance.

Yes. You can get a BIMI Certificate without a registered trademark by choosing a Common Mark Certificate (CMC). Instead of trademark registration, a CMC requires proof that your logo has been actively used for at least 12 consecutive months. Your domain must also have DMARC set to p=quarantine or p=reject before a CMC can be issued.

VMC eligibility requires trademark registration with one of 17 recognized intellectual property offices. These include the USPTO (United States), EUIPO (European Union), UKIPO (United Kingdom), CIPO (Canada), IP Australia, IP India, JPO (Japan), and others. See the full list of accepted trademark offices

Yes. Each VMC is issued for one specific trademarked logo. If your organization uses more than one logo, each requires its own certificate. The same applies if you rebrand — a new or modified logo would need a new VMC.

Once your logo is officially trademarked, you can upgrade from a CMC to a VMC. You’ll need to go through the logo verification and certificate reissuance process.

Three things must be in place before a VMC can be issued:

1. A registered trademark logo in SVG Tiny PS (SVG Tiny 1.2) format
2. A DMARC policy set to p=quarantine or p=reject
3. A published BIMI DNS record pointing to your logo and certificate

If all these requirements are in place, you can buy Verified Mark Certificate and complete the CA’s validation process.

Your logo must be in SVG Tiny PS format (SVG Tiny 1.2 with Tiny PS constraints). Standard SVG files are not accepted. The format is required by the BIMI specification to ensure consistent rendering across all supported email clients.

It normally requires 5 to 7 business days to issue a VMC certificate. The faster the following steps are done, the quicker it can be issued:

1. Domain and organization validation
2. Trademark checking (because a registered trademark is necessary)
3. BIMI Alignment of email logo
4. Faster response to any CA (Certificate Authority) documentation requests

Delays can arise when extra documentation or corrections are required in the process of validation.

No. You only need to include the domain actively used for sending authenticated email — the one where your BIMI and DMARC records are configured. You don't need to list every domain or subdomain your organization owns.

It depends on your setup. If you send email from one domain with one logo, a single VMC is sufficient. Multiple email domains using the same logo may require separate certificates depending on how each domain's BIMI record is configured. Subdomains don't automatically inherit BIMI settings from a parent domain.

Once your certificate is issued, you'll receive a PEM file. You must host both the SVG logo and the PEM file are located on a publicly accessible server. Also, change your BIMI record accordingly. Successful implementation requires that the hosted files match the BIMI record.

BIMI (Brand Indicators for Message Identification) is an email standard that lets organizations display a verified brand logo in recipients' inboxes alongside authenticated messages. It sits on top of DMARC, SPF, and DKIM, and requires a VMC or CMC to activate logo display in most major mailbox providers. BIMI turns email authentication into something recipients can actually.

Both VMC and CMC require BIMI to function. BIMI provides the DNS-based mechanism for logo display, while the certificate validates logo ownership. Without BIMI, email providers will not display your logo.

BIMI isn't mandatory, but it is required if you want your brand logo to appear in Gmail. Google also requires DMARC enforcement and a valid VMC or CMC certificate. Meeting all three conditions is what triggers logo display in Gmail inboxes.

SPF (Sender Policy Framework) lets you define which mail servers are authorized to send email on behalf of your domain. When a receiving server checks an incoming email, it looks up your SPF record in DNS and verifies whether the sending IP is on the approved list. Unauthorized senders fail the check, which helps prevent domain spoofing.

DKIM (DomainKeys Identified Mail) adds a cryptographic signature to outgoing emails. When a recipient's server receives the message, it retrieves your public key from DNS and uses it to verify the signature — confirming the email came from an authorized source and wasn't modified in transit. DKIM works alongside SPF and DMARC as part of a complete authentication setup.

DMARC (Domain-based Message Authentication, Reporting & Conformance) is an email authentication protocol that tells receiving servers what to do when an email fails SPF or DKIM checks. It prevents unauthorized senders from using your domain, protects against phishing and spoofing, and is a prerequisite for both VMC and CMC certificates.

DMARC is strictly required for VMCs and CMCs because it serves as a foundational security and authentication layer that enables trusted logo. To get a certificate, your domain should have a properly configured DMARC (Domain-based Message Authentication, Reporting, and Conformance) record and a policy of either “p=quarantine” or “p=reject”. It is essential for conforming domain ownership and showcasing brand logo in your supported inboxes.

For organizations with a single sending domain and existing SPF and DKIM setup, moving to p=quarantine or p=reject can take a few days to a few weeks. Larger organizations with multiple domains, subdomains, and third-party senders may take several months — every legitimate email source needs to be identified and authenticated before enforcement is safe to apply. Working with a DMARC specialist can significantly shorten that timeline.

Your VMC certificate remains valid, but your logo will stop appearing in supported inboxes until DMARC alignment is restored. The certificate itself isn't revoked — it's a live authentication failure causing the display to drop. Fix the DMARC issue and logo display resumes.

VMC and CMC certificates enable BIMI logo display in Gmail, Yahoo Mail, Apple Mail, Fastmail, Zoho Mail, La Poste, and other BIMI-supporting providers. Microsoft 365 (Outlook) does not currently support BIMI for inbound display.

No. A TLS/SSL certificate secures your website by encrypting data in transit between a browser and server. A BIMI Certificate (VMC or CMC) is an email identity certificate — it verifies your brand and enables logo display in recipients' inboxes via BIMI. They serve entirely different purposes.

No. VMC and BIMI operate on public-facing email infrastructure. Internal mail systems — corporate intranets, private mail servers — are not supported environments for BIMI logo display.

A VMC itself doesn't influence whether a mail server accepts or rejects your messages — deliverability is driven by your SPF, DKIM, and DMARC configuration. What a VMC does is increase recipient trust and open rates by displaying a verified logo in the inbox, which reduces the likelihood of your emails being ignored or reported.

Host them on a publicly-accessible, secure server using HTTPS. Ensure URLs are permanent, well accessible and match to the locations indicated in your BIMI record.

VMC and CMC certificates are valid for 1 year from the date of issuance. Annual renewal is required to maintain uninterrupted logo display and stay compliant with CA validation requirements. Multi-year subscription plans are available at discounted rates.

If you purchased your VMC or CMC through us, you can request a revocation at any time by reaching out to our support team. Revocations can also occur automatically if the underlying trademark (for VMC) becomes invalid or if persistent email authentication failures are detected. In case you want to reissue, we’ll guide you through the process and help you maintain the compliance requirements.

VMCcerts is a direct channel partner of DigiCert, GlobalSign, and Sectigo — the CAs authorized to issue VMC and CMC certificates. Ordering through VMCcerts gives you direct CA-tier pricing with end-to-end support from DMARC setup through final BIMI deployment, without navigating CA processes on your own.

VMC and CMC renewals require validation checks before a new certificate can be issued. Requirements vary depending on certificate type, trademark status, and certificate authority policies. Starting the renewal process before expiry avoids any gap in logo display.