The one-sentence version#
A VMC is an X.509 certificate issued by an approved authority (DigiCert or Entrust) that binds a registered trademark logo to a domain. Gmail and Apple Mail require a VMC or CMC to render a BIMI logo.
Why you should care#
The VMC is the trust anchor: it proves the logo belongs to the trademark holder, preventing brand impersonation in the inbox.
The mental model#
Think of Verified Mark Certificates (VMC) as a contract between you and the mailbox providers receiving your mail. You publish or configure something they can check; they check it on every message; the result feeds their decision about where your message lands. Everything below is about making that check pass consistently.
Your first setup, step by step#
- Confirm your logo is a registered trademark in an accepted jurisdiction (USPTO, EUIPO, UKIPO, JPO, and others).
- Prepare the exact trademarked artwork as SVG Tiny PS.
- Complete organization validation with the CA, including notarized identity verification.
- Receive the PEM certificate, host it over HTTPS, and reference it in the a= tag of your BIMI record.
- Calendar the renewal; VMCs are valid for one year.
Words you will see#
- Mailbox provider: Gmail, Microsoft, Yahoo, Apple, and the corporate gateways that decide where mail lands.
- Authentication: proof that a message is from who it says it is (SPF, DKIM, DMARC).
- Reputation: the provider's running score of your domain and IP.
- Placement: whether a message reaches the inbox, spam, or is rejected.
Common mistakes#
- Submitting a logo that differs from the registered mark, even slightly.
- Letting the certificate expire, which silently removes the logo.
- Assuming a pending trademark application qualifies; it must be registered.
Frequently asked questions#
How much does a VMC cost?
Roughly $1,000 to $1,500 per year per logo, depending on the CA.
How long does issuance take?
Typically 2 to 6 weeks, mostly spent on organization and trademark validation.
Do I need one VMC per domain?
One VMC can cover multiple domains using SANs, if they share the same trademark.