VMC requires a registered trademark; CMC accepts a logo in prior use for 12+ months without a trademark. Both are accepted by Gmail, but only VMC shows the blue verified checkmark.
What Verified Mark Certificates (VMC) is#
A VMC is an X.509 certificate issued by an approved authority (DigiCert or Entrust) that binds a registered trademark logo to a domain. Gmail and Apple Mail require a VMC or CMC to render a BIMI logo.
Why it matters#
The VMC is the trust anchor: it proves the logo belongs to the trademark holder, preventing brand impersonation in the inbox.
How Common Mark Certificates (CMC) differs#
Common Mark Certificates (CMC) solves an adjacent problem. VMC requires a registered trademark; CMC accepts a logo in prior use for 12+ months without a trademark. Both are accepted by Gmail, but only VMC shows the blue verified checkmark. In practice the two are deployed together and monitored with the same reporting.
Which to implement first#
Start with whichever your sending platform makes easiest, then add the other. Deployment order matters less than reaching a state where both pass and align with your From domain.
Frequently asked questions#
How much does a VMC cost?
Roughly $1,000 to $1,500 per year per logo, depending on the CA.
How long does issuance take?
Typically 2 to 6 weeks, mostly spent on organization and trademark validation.
Do I need one VMC per domain?
One VMC can cover multiple domains using SANs, if they share the same trademark.