Why Does a VMC Require Trademark Validation?
A VMC is a Verified Mark Certificate — the word “verified” refers specifically to verification of trademark ownership. The CA validates that the logo being certified is a registered trademark held by the applicant at the time of issuance. This requirement exists because BIMI logo display with a VMC ensures that logos shown in inbox interfaces are backed by verified brand ownership. Allowing arbitrary logos to be certified without trademark verification would make it trivial to impersonate any brand in email.
What “Verified” Actually Means
The Certificate Authority performs an independent check of the trademark record — it does not simply take the applicant’s word that the trademark exists. The CA looks up the trademark at the declared trademark office, confirms the registration is active and in good standing, verifies the legal entity named on the trademark matches the organization applying for the certificate, and confirms the logo submitted matches the trademarked image.
This verification creates an unbroken chain: the trademark office has verified the brand’s ownership of the mark; the CA has verified the VMC applicant’s ownership of that trademark; the certificate encodes that verified relationship. When a mailbox provider reads the VMC, it can cryptographically confirm the chain without independently checking the trademark registry itself.
Why Trademark Is Specifically Required (Not Just Domain Ownership)
Domain ownership verification — used for standard TLS certificates — establishes only that someone controls a domain. It does not establish that the logo they want to display is legitimately theirs or that displaying it in an inbox interface is appropriate. A spoofed domain (e.g., paypa1.com) or a brand-new domain could pass domain ownership checks and display a logo designed to impersonate an established brand.
A trademark at a recognized national or international trademark office is an independent legal record of brand ownership, examined and granted by a government body applying established criteria. The CA uses this existing legal infrastructure rather than creating its own brand legitimacy assessment process. It also means the verification is not solely at the discretion of the certificate provider.
The trademark requirement is why a VMC cannot be issued for a logo that has not been trademarked, even if the organization has used the logo for many years. Use in commerce creates common law trademark rights in some jurisdictions, but those are not verifiable by a CA in the structured way required by the BIMI specification. Registered trademark status at a recognized trademark office is the standard.
The Trust Model This Enables
When Gmail displays a blue verified checkmark on a BIMI-equipped email, the claim being made is that the sender’s logo has been independently verified by a CA against a registered trademark. The mailbox provider trusts the CA’s verification — it does not independently examine the trademark. The CA trusts the trademark office’s registration record. The trademark office has examined and granted the mark through its own process.
Removing the trademark requirement would break this chain. A logo display system without trademark verification would shift the trust burden entirely onto the CA or the mailbox provider, neither of which has the infrastructure or legal mandate to assess brand legitimacy at scale. The trademark requirement is what allows the system to be scalable and resistant to impersonation at the level where logo display carries a meaningful trust signal.
Why CMC Does Not Require a Trademark
The Common Mark Certificate (CMC) serves a different function: it provides non-trademarked logo display by verifying organizational identity and domain control without making a trademark ownership claim. A CMC does not represent that the certified logo is a registered trademark — only that the organization displaying it has been identity-verified. This is why CMC does not qualify for the Gmail verified checkmark, which requires the stronger trademark-backed claim that only a VMC provides. See Am I Eligible for a Common Mark Certificate? for the CMC requirements.