22 June 2026 · 5 min read
A Verified Mark Certificate (VMC) proves your BIMI logo is a registered trademark, or a government mark. A Common Mark Certificate (CMC) covers a logo that is not a registered trademark, typically by proving you have displayed it on your domain for at least 12 months. Gmail accepts both, but only shows its checkmark next to senders verified with a VMC. Both certificates are issued by a small set of certificate authorities, and neither works until your domain enforces DMARC.
VMC and CMC side by side
| VMC | CMC | |
|---|---|---|
| What it proves | A registered trademark, or a government mark | A mark in use without registration (prior use), or a modified version of a registered mark |
| Main requirement | Trademark registration for the logo itself | The logo shown on your domain at least 12 months before verification, checked through archive.org |
| Gmail | Logo shown, with a checkmark | Logo shown, no checkmark |
| Typical lead time | Months if you still need to register the trademark; Google suggests 6 to 12 | No trademark application needed |
The requirements come from the BIMI Group's Minimum Security Requirements for Issuance of Mark Certificates (version 1.8, June 2026).
What a mark certificate does
BIMI itself is a DNS record that points to your logo:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"l= is the location of the SVG logo and a= the location of the certificate. Without a=, the record is self-asserted: you are simply claiming the logo is yours. The BIMI Group says only a few mailbox providers display self-asserted logos, naming Yahoo, Fastmail and La Poste.
A mark certificate is a signed document from a certificate authority that ties your logo to your organisation and, for a VMC, to a registered trademark. The mailbox provider checks the certificate, confirms the logo inside it matches the one you publish, and only then may show it. Display is always at the provider's discretion.
VMC: registered or government marks
A VMC needs one of:
- a registered trademark for the logo as it appears, not just a word mark for your name; or
- a government mark, a logo officially recognised by a government authority.
The certificate authority also verifies your organisation and your control of the domain. If you already hold a trademark for the logo, a VMC is the straightforward choice. If you do not, Google's BIMI guidance notes the trademark process can take 6 to 12 months and suggests working with legal counsel.
CMC: logos without a registration
A CMC covers two kinds of mark:
- a prior use mark: the certificate authority must confirm the logo is displayed on your website now, and that it was displayed on the same domain at least 12 months earlier, using archive.org as the evidence source;
- a modified registered mark: a changed version of a registered trademark, which must stay linked to the original registration.
The CMC suits organisations with an established logo but no trademark, such as smaller firms and charities. If your logo is new, or was never on your website, a CMC is not available until the 12-month history exists.
Which inboxes accept which
Each provider sets its own policy:
- Gmail accepts a VMC or a CMC; Google calls the VMC the recommended option. A checkmark appears next to senders verified with a VMC.
- Apple Mail supports BIMI; the BIMI Group's FAQ lists Apple as requiring a VMC.
- Yahoo, Fastmail and La Poste display self-asserted logos, so a certificate is not required there.
The BIMI Group lists further supporting providers, including Zoho Mail, and tracks others still planning support. Check its support table and each provider's own documentation before you buy, because policies change.
Who issues them
The BIMI Group's list of Mark Verifying Authorities currently names DigiCert, GlobalSign and SSL.com. Certificates are usually bought directly or through a reseller. They are annual products, so budget for renewal, and the logo embedded in the certificate must match the SVG you publish: a logo redesign means a new certificate.
Prerequisites neither certificate removes
- DMARC at enforcement. Google's BIMI guidance requires
p=quarantineorp=reject;p=noneis not supported, and a policy that applies to only part of your mail does not qualify. Check yours with the DMARC checker. - Passing, aligned SPF or DKIM, so your mail actually passes DMARC.
- An SVG Tiny PS logo. Google asks for
baseProfile="tiny-ps"andversion="1.2", at least 96 by 96 pixels, no scripts, animation or external links, and ideally 32 KB or less. Most design-tool exports need converting; the BIMI SVG converter and BIMI logo validator help. - HTTPS hosting for both the SVG and the certificate PEM file.
How to choose
- Reach DMARC enforcement first. A certificate bought while you are at
p=nonedisplays nothing. - Check your trademark position. A registered trademark for the logo points to a VMC. Without one, a CMC is faster, provided the logo has been on your domain for 12 months.
- Look at where your recipients read mail. If most use Gmail, a CMC gives you the logo there. If the checkmark or Apple Mail matters to you, plan for a VMC.
Whether BIMI is worth the effort at all depends on your audience; do you need BIMI weighs that up, and getting a trademark for a VMC covers the registration route. Once your record is live, the BIMI checker validates it. Hosted BIMI publishes your BIMI record and logo once your domain is enforced.