21 June 2026 · 3 min read
A Verified Mark Certificate (VMC) is a digital certificate that proves you own a registered trademark for the logo you want to display in inboxes. It is the credential that powers BIMI (Brand Indicators for Message Identification), the standard that shows your brand logo next to your messages in supporting email clients. A VMC is issued by an approved Certificate Authority (currently DigiCert or Entrust), and it cryptographically binds your logo (an SVG file) to your registered mark and your domain. When a mailbox provider receives your email, it can fetch the certificate referenced in your BIMI record and confirm that the logo has been verified rather than simply asserted by whoever published the DNS record.
You need a VMC because the two largest consumer providers, Gmail and Apple Mail (on iOS 16 and macOS Ventura or later), will not show your logo without one. Some providers, notably Yahoo and Fastmail, will display a self-asserted BIMI logo with no certificate at all, but Gmail and Apple treat the VMC as a mandatory trust signal. So the practical answer to "do I need one?" depends on where your recipients read their mail: if you want your logo to appear in Gmail and Apple inboxes, a VMC is not optional. There is also a hard technical prerequisite that sits underneath all of this: BIMI only works once your domain is enforcing DMARC at p=quarantine or p=reject with full coverage. No mailbox provider will render any logo, certificate or not, for a domain still on p=none. Getting to enforcement safely is exactly what our hosted DMARC product is built for, and you can confirm your current policy with the free DMARC checker.
The trademark requirement is the part that catches most people out. To obtain a VMC you must own a registered trademark for the mark, granted by an accepted intellectual-property office such as the USPTO, the EUIPO, the UK IPO or another recognised registry. A pending application is not enough; the mark must be registered, and the logo in your SVG must match the registered mark closely. The certificate itself is a paid annual product from the CA, typically several hundred to roughly a thousand US dollars per year, and verification can take days to weeks because the CA checks your trademark and confirms domain control.
If you do not hold a registered trademark, there is now an alternative called a Common Mark Certificate (CMC). A CMC follows the same issuance and validation process as a VMC but accepts marks that are not registered trademarks, such as a logo backed by sustained prior use or a government-issued mark. The trade-off is reach: at the time of writing Gmail recognises CMCs, but Apple Mail does not, so a CMC will not light up your logo across every inbox a VMC would.
Before you spend anything on a certificate, get the foundations right and test what you have:
- Confirm DMARC enforcement first; see our requirements guide for what Gmail and Yahoo expect.
- Prepare a compliant logo, a square SVG Tiny Portable/Secure (SVG P/S) file, and validate it and your record with the BIMI checker.
- Read the full walkthrough in our BIMI product overview before buying a VMC or CMC.