Getting a trademark for a BIMI VMC

9 April 2026 · 14 min read

A Verified Mark Certificate is the document that lets Gmail, Apple Mail, Yahoo and others render your brand logo beside your messages through BIMI. Most teams discover, usually halfway through a BIMI rollout, that the certificate has a hard prerequisite that has nothing to do with email at all: a registered trademark for the exact logo you want to display. No registration, no standard VMC. That single fact turns BIMI from a "publish a DNS record this afternoon" job into a project that can take months and a few thousand pounds, because trademark registration runs on the timeline of intellectual property offices, not DNS propagation.

This article is about that prerequisite specifically. Not how to publish a BIMI record, not how to validate an SVG, but the trademark itself: why a VMC demands one, what kind of mark qualifies, how long registration realistically takes, what it costs, and the Common Mark Certificate (CMC) route that exists for organisations that have no registered trademark and never will. If you are weighing up whether BIMI is worth it for your domain, the trademark question is the part that decides the budget and the calendar, so it is worth understanding properly before you commit.

Why a VMC needs a registered trademark in the first place

BIMI lets a domain owner tell a mailbox provider "this logo is ours, please show it next to our mail". The obvious problem is that nothing about DNS proves you own a logo. Anyone who controls a domain can publish a BIMI record pointing at any image. Without some external check, BIMI would be a gift to phishers: register a lookalike domain, publish a record pointing at a well-known brand's logo, and the inbox would helpfully display it.

The Verified Mark Certificate is the trust anchor that closes that hole. A VMC is an X.509 certificate, structurally similar to a TLS certificate, issued by a small number of certification authorities (currently DigiCert and Entrust) after they verify two things:

• That your organisation is who it claims to be (an organisation-validation check, like the one behind an OV TLS certificate).
• That your organisation has the legal right to the logo, evidenced by a registered trademark for that exact mark.

The trademark requirement is doing the heavy lifting. A registered trademark is a public, government-examined assertion that a specific mark belongs to a specific entity for specific classes of goods or services. The CA does not have to make a subjective judgement about whether your logo is "really yours"; it leans on the trademark office that already made that determination. The logo embedded inside the issued certificate is the trademarked mark, and the BIMI ecosystem requires the SVG you publish to match the logo inside the certificate, so the whole chain ties back to the registration.

This is also why a VMC is not a quick technical purchase. You are not buying a certificate so much as buying the CA's verification work, and that work cannot complete until a trademark office has done its own much slower work first.

What kind of trademark actually qualifies

Not every trademark is usable for a VMC, and the gap trips people up. The rules, set out in the BIMI working group's certificate requirements and applied by the issuing CAs, are stricter than "we have a trademark somewhere".

It must be the logo, registered as a figurative/design mark. Trademark offices distinguish between a word mark (the text of your name, in any font) and a figurative mark, also called a design mark or device mark (a specific stylised logo or graphic). A VMC displays a logo, so you need the figurative/design mark registered, not just the word mark. Plenty of companies own a word mark for their name but have never registered the logo itself, and that word mark alone will not support a VMC. If your "logo" is genuinely just your company name set in a standard typeface with no distinctive graphical element, some jurisdictions and CAs can work with a registered text/word mark, but a distinctive graphic device must be registered as such.

It must be registered, not merely applied for. A pending application does not qualify. The mark has to be fully registered and in force. This is the single biggest scheduling reality: you cannot start the VMC process in earnest until the registration certificate is in your hand.

It must be registered in a recognised jurisdiction. The BIMI requirements list the trademark offices whose registrations are accepted. These include the United States (USPTO), the European Union (EUIPO), the United Kingdom (UKIPO), Canada (CIPO), Japan, Australia, India, Brazil, Korea, Spain and several others, with the accepted list maintained by the BIMI group and applied by the CAs. A registration in an office that is not on the accepted list will not be honoured, so if you operate somewhere outside the recognised set you may need to register in one of the accepted jurisdictions.

The logo you publish must match the registered mark. The artwork in your SVG, the artwork in the certificate, and the registered trademark all need to be the same mark. You cannot register one logo and publish a redesigned version. Colour is part of this: if your trademark is registered in black and white, some CAs will allow you to assert a single colour, but a multi-colour logo generally needs to correspond to how the mark is registered. Get this wrong and the CA rejects the application, or worse, you pass validation and then quietly break the logo-to-certificate match later when a designer "tidies up" the SVG.

The mark holder must match the certificate subject. The organisation that owns the trademark registration should be the organisation named in the VMC, which should align with the domain you are authenticating. Mismatches between a holding company that owns the IP and an operating company that owns the domain are common and need sorting out before the CA will issue.

If you want to sanity-check what BIMI will require around the certificate once you have the trademark, the VMC glossary entry and the BIMI glossary entry lay out the certificate and DNS sides, and the BIMI VMC checker validates a live certificate's chain, expiry and logo match once one is issued.

The registration timeline, realistically

This is where expectations and reality diverge most. Teams plan BIMI as a sprint and then discover the trademark is a marathon already in progress somewhere else. Here is what the timeline actually looks like, with the important caveat that exact durations vary by office and by how clean your application is.

A trademark registration moves through roughly these stages:

1. Filing. You (or, sensibly, a trademark attorney) file the application with the relevant office, specifying the mark, the owner, and the classes of goods and services it covers. Filing itself is quick.
2. Formal examination. The office checks the application is complete and correctly classified. Weeks.
3. Substantive examination. An examiner assesses whether the mark is registrable: is it distinctive, is it descriptive, does it conflict with earlier marks? This is where delays and objections appear. If the examiner raises an objection (an "office action" in the US, an "examination report" elsewhere), you respond, and the clock effectively resets while that plays out.
4. Publication and opposition. Once accepted, the mark is published for a period (commonly two to three months) during which third parties can oppose it. If nobody opposes, it proceeds.
5. Registration. The certificate of registration issues. Only now can your VMC application properly complete.

Put end to end, a smooth, unopposed application typically takes somewhere in the region of six to twelve months, and frequently longer. The UKIPO often registers a clean, unopposed UK trademark in around four months, which is at the fast end. The USPTO has run considerably slower in recent years, with total pendency frequently stretching past a year once examination backlogs and any office action are included. The EUIPO is somewhere in between for a smooth application. Any objection or opposition can add many months on top.

The practical consequence: if you do not already hold a registered figurative trademark, BIMI with a Gmail-visible logo is not a this-quarter project. It is something you start now so it is ready next year. The DNS and SVG work is a single afternoon at the end; the trademark is the long pole in the tent. This is the most common cause of BIMI projects stalling, and it has nothing to do with email configuration at all.

There is one important nuance for the impatient. The trademark must be registered before the standard VMC issues, but you do not have to wait for the trademark before doing everything else. You can and should get DMARC to enforcement, prepare the SVG, and have the whole BIMI setup standing by, so that the day the registration certificate lands you can complete the VMC and go live within days. Getting to p=quarantine or p=reject safely is itself a multi-week exercise, so running it in parallel with the trademark application is the efficient sequencing.

What it costs

Two separate bills, and people often forget the second.

The trademark registration. Official fees depend on the office and the number of classes you file in.

• UK (UKIPO): the online fee starts at £170 for the first class and £50 for each additional class. Add a professional's fees if you use an attorney, which most do for anything non-trivial.
• EU (EUIPO): an EU trade mark is €850 for one class, €50 for the second class, and €150 each for further classes, covering all member states in a single filing.
• US (USPTO): filing fees are several hundred US dollars per class under the current fee structure, plus the near-universal cost of US trademark counsel, since the process is materially more involved.

Add attorney fees on top in every jurisdiction if you instruct one (and for a logo mark with any complexity, you usually should). A straightforward single-class registration handled with professional help commonly lands somewhere in the low four figures all-in; a multi-class or multi-jurisdiction filing scales up from there. These are also not annual costs at this stage: a registration lasts ten years before renewal in most offices.

The VMC itself. Once the trademark is registered, the certificate is a separate annual purchase from a CA. VMCs typically cost on the order of roughly USD 1,000 to USD 1,500 per year, varying by CA and any reseller. Unlike a TLS certificate you will not find a free option: the organisation-validation and trademark-verification work has a real cost behind it.

So the honest all-in picture for a brand starting from zero is: a few hundred to a few thousand for the trademark depending on jurisdictions and counsel, mostly a one-off, plus roughly a thousand-and-a-bit a year for the VMC ongoing. None of that buys a logo in the inbox on its own, because the logo only renders once DMARC is at enforcement, which is the genuinely valuable prerequisite and the part most worth getting right.

The CMC alternative when you have no trademark

For a long time, no registered trademark meant no logo in Gmail, full stop. That excluded a large and entirely legitimate set of organisations: charities, schools, government bodies, public-sector agencies, and plenty of small businesses whose logo was never registered and arguably could not be (a coat of arms, a crest, a generic device). The Common Mark Certificate (CMC) was introduced to serve exactly this group.

A CMC is, mechanically, very similar to a VMC. It is an X.509 certificate issued by the same CAs, it embeds your logo, it chains to a trusted root, and it is referenced from the same a= tag in your BIMI record. The DNS and SVG requirements are identical. The difference is what the CA verifies to issue it:

• A VMC is backed by a registered trademark.
• A CMC is backed by other evidence that the mark is legitimately yours, without requiring a registration. Accepted evidence includes a mark that has been in prior, documented public use for a sustained period (for example, a logo demonstrably in use for at least a year, with verifiable historical evidence such as archived web pages), or a government-issued mark, seal or insignia.

This opens BIMI to organisations that have a real, established logo but no trademark certificate. A council, a university, a long-standing charity, or a business that has used the same mark for years can pursue a CMC and skip the entire trademark registration timeline and cost.

There are two important caveats, and they matter for planning:

1. Mailbox-provider support is narrower and newer than for VMCs. CMC recognition was added later than VMC support and has been rolled out more gradually across providers. Apple Mail was an early adopter of the CMC route; Gmail's handling of CMCs has been more cautious and rolled out later than its long-standing VMC support. So a CMC may light up your logo in some inboxes while a VMC remains the more universally reliable path, particularly if Gmail visibility is your priority. Treat the CMC as the route that broadens access, not as a guaranteed drop-in equivalent to a VMC everywhere.
2. A CMC is still a paid annual certificate with real validation. It removes the trademark requirement, not the cost or the verification effort. The CA still has to validate your organisation and your evidence, and CMC pricing is broadly in the same ballpark as VMC pricing.

The decision tree is therefore fairly clean. If you already hold a registered figurative trademark, get a VMC: it is the most widely supported and the registration is already behind you. If you do not hold one and your logo is genuinely registrable and your brand is valuable enough to justify it, registering the trademark and getting a VMC is the strongest long-term position, and you can start the registration now while building everything else. If you do not hold a trademark and either cannot register one or do not want to wait six-to-twelve months and pay for it, a CMC is the pragmatic route, with the honest expectation that provider support is improving but not yet as universal as for VMCs. The CMC glossary entry covers the certificate side in more detail.

How this slots into the rest of a BIMI rollout

It is worth being blunt about where the trademark sits in the overall effort, because it is easy to over-focus on it and under-focus on the part that actually controls success.

A logo appears in the inbox only when all of these are true, in this rough order of importance:

1. DMARC is at enforcement (p=quarantine or p=reject) and the specific message passed DMARC with alignment. No enforcement, no logo, certificate or not. This is the prerequisite that does the real work and the one most likely to be missing.
2. The BIMI DNS record exists at default._bimi.<domain> and is well formed.
3. The SVG meets the SVG Tiny PS profile, is square, and matches the logo in the certificate. See the SVG Tiny PS glossary entry.
4. A valid, unexpired VMC or CMC is referenced in the a= tag and chains to a trusted root.

The trademark only governs step 4, and only the type of certificate within it. You can hold the perfect trademark and a flawless VMC and still see no logo because the domain is sitting at p=none. That is why the trademark, important as it is, should run in parallel with, and not ahead of, the DMARC work.

The sequencing that wastes the least time is:

1. Start the trademark registration today if you need one (six-to-twelve months), or gather your CMC evidence if you are taking that route.
2. In parallel, take the domain safely from p=none to p=reject without dropping legitimate mail. This is the hard, valuable bit, and it has its own multi-week timeline because you must fix every legitimate sending source before you tighten the policy.
3. Prepare the SVG to the Tiny PS profile and have the BIMI record drafted and ready.
4. When the trademark registers (or the CMC evidence is accepted), complete the certificate, publish the record, and go live within days.

If a logo is failing to appear after all of this, the cause is almost never the trademark and almost always something in steps 1 to 3; our companion guide on why a BIMI logo does not show in Gmail walks the failure chain in order.

The practical takeaway

A VMC needs a registered figurative trademark because the certificate's whole purpose is to anchor your logo to a government-examined claim of ownership, which is what makes it safe for an inbox to trust. That trademark is the long pole: budget roughly six-to-twelve months and a few hundred to a few thousand pounds for registration, plus around USD 1,000 to USD 1,500 a year for the certificate itself. If you have no trademark and either cannot register one or will not wait, the CMC route accepts prior public use or a government-issued mark instead, at the cost of narrower and newer mailbox-provider support, with Gmail in particular favouring VMCs.

Above all, do not let the trademark question stall the work that actually unlocks the logo. The logo renders because of DMARC enforcement, not because of the certificate, so start the trademark or CMC evidence now and run the DMARC work alongside it. Check where your domain stands today with the BIMI checker and the BIMI VMC checker, model your record with the BIMI generator, and if reaching p=reject safely is the part you would rather not own, our done-for-you DMARC service, BIMI product and monitoring with change alerts exist to take a domain from p=none to a logo in the inbox without a single legitimate message going missing.