What is a Verified Mark Certificate? (VMC)
BIMI puts your logo next to your mail in supporting inboxes. The VMC is the part where someone checks the logo is actually yours before inboxes agree to show it.
Definition
A Verified Mark Certificate is a digital certificate, issued by one of the certificate authorities on the BIMI Group's issuer list (DigiCert and Entrust among them), that attests you have the right to use the logo referenced by your BIMI DNS record. The classic evidence is a registered trademark on the logo; issuance also involves identity verification of the organization. The certificate, published alongside your logo via the record's a= tag, is how a mailbox provider distinguishes “this brand's verified mark” from “an SVG somebody uploaded.”
When you need one
It depends on the receiver. Gmail and Apple Mail require a certificate before they display a BIMI logo. Yahoo accepts a self-asserted record, so it can show a logo without one. So a BIMI record without a VMC is valid DNS and may show your logo in some inboxes, but the one most people care about (Gmail) stays blank. For brands without a registered trademark, the newer Common Mark Certificate (CMC) accepts proof that the logo has been in public use instead. Gmail accepts either, but shows its checkmark next to the sender only for a VMC.
What it costs, practically
VMCs are a yearly subscription from the issuing CA, priced by the issuer, plus the one-time cost of a trademark registration if you do not have one. That price tag is why sensible advice runs: get DMARC to enforcement first (a hard prerequisite anyway: BIMI only activates at quarantine or reject, with no pct below 100), publish the record and the compliant SVG, and buy the certificate only when the brand value justifies it.
The pipeline in one line
Enforced DMARC → BIMI TXT record at default._bimi → SVG Tiny P/S logo → VMC (or CMC) → logo in supporting inboxes. Every stage is checkable; the BIMI guide walks the details.
See what a stricter policy would have done to last month's mail.
Enforcement Preview replays your last 30 days of reports under quarantine or reject before you change DNS, and shows which mail would have failed. Included on every plan.
Was this page helpful?