The Path to a Verified Mark Certificate

A Verified Mark Certificate (VMC) is a digital certificate issued by an approved Certificate Authority (CA) that cryptographically binds your registered trademark logo to your email-sending domain. When deployed correctly alongside a BIMI DNS record, it instructs participating mailbox providers—including Gmail, Yahoo Mail, Apple Mail, and Fastmail—to display your brand logo in the inbox next to authenticated messages.

This guide covers every prerequisite and action required to obtain and deploy a VMC, in the correct sequence.

Prerequisites at a Glance

Before you begin, confirm you can satisfy all of the following:

• DMARC policy at p=reject or p=quarantine (enforcement required)
• A registered trademark for your logo in at least one qualifying jurisdiction
• An SVG logo file that conforms to the W3C SVG Tiny 1.2 Portable/Secure (P/S) profile
• Access to your domain’s DNS to publish the BIMI record
• A budget for the VMC — certificates are issued annually and priced per domain

Step 1: Enforce DMARC at Policy Level

DMARC (Domain-based Message Authentication, Reporting & Conformance) is a non-negotiable foundation. A VMC has no effect unless your domain passes DMARC alignment, and mailbox providers will not render BIMI logos for domains operating below enforcement level.

Requirements

• SPF and DKIM must both be configured and aligned for your sending domain.
• Your DMARC record must specify p=reject or p=quarantine. A policy of p=none does not qualify.
• The DMARC record must be published at the organizational domain (e.g., _dmarc.example.com), not a subdomain.

Recommended path to enforcement

1. Publish an initial DMARC record at p=none with rua and ruf reporting addresses.
2. Collect aggregate reports for a minimum of two to four weeks.
3. Identify all legitimate mail streams and ensure each passes SPF or DKIM alignment.
4. Advance the policy incrementally: p=none → p=quarantine → p=reject.
5. Confirm the final record reads similarly to:

_dmarc.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]"

Important: Do not proceed to subsequent steps until DMARC enforcement is stable. A misconfigured mail stream discovered after VMC issuance can cause legitimate email to be rejected.

Step 2: Register Your Trademark

A VMC can only be issued for a logo that is a registered trademark in a jurisdiction recognised by the issuing CA. This is the step most organisations underestimate in terms of lead time.

Qualifying jurisdictions (as of 2024)

Approved CAs currently accept trademark registrations from the following offices:

This list expands periodically. Verify the current list with your chosen CA before filing.

Key considerations

1. The trademark must cover the exact logo you intend to use in BIMI. A word mark (text only) does not qualify; the registration must be for a figurative or device mark (a logo).
2. Registration status must be active at the time of VMC issuance and throughout the certificate’s validity period.
3. Trademark registration timelines vary by jurisdiction. USPTO examination alone typically takes 8–12 months. Plan accordingly.
4. If your logo is already registered, confirm the registration number and the exact image on file — the SVG you submit must match the registered mark.

Step 3: Convert Your Logo to SVG Tiny 1.2 Portable/Secure

This is the most technically demanding step for most brand and design teams. The VMC specification requires your logo to be encoded as an SVG Tiny 1.2 Portable/Secure (P/S) file. Standard SVG files exported from Adobe Illustrator, Figma, or Inkscape will not pass CA validation without modification.

What is SVG Tiny 1.2 P/S?

SVG Tiny 1.2 is a subset of the SVG specification designed for constrained environments. The Portable/Secure profile adds further restrictions to prevent executable content, external resource loading, and scripting — all of which are security risks in an email rendering context.

Common SVG elements that must be removed or replaced

Conversion requirements

1. The file must declare the correct SVG Tiny 1.2 namespace and profile:
   xml

   <svg version="1.2" baseProfile="tiny-ps"
        xmlns="http://www.w3.org/2000/svg" ...>
   

2. A <title> element must be present as the first child of the root <svg> element.
3. The file must be self-contained — no external fonts, images, or stylesheets.
4. The canvas should be square (equal width and height). Most mailbox providers crop or mask logos to a circular or square format.
5. File size should be kept under 32 KB after conversion.

Validation

After conversion, validate the file against the [SVG Tiny P/S](/knowledge/bimi-svg-tiny-ps-guide) schema before submitting to a CA. Submitting a non-compliant file will result in rejection and delay issuance.

Free SVG conversion tool: makeBIMI.com converts your logo to a BIMI-compliant SVG Tiny 1.2 P/S file at no cost. Upload your existing logo file and download a CA-ready SVG.

Step 4: Apply to an Approved Certificate Authority

Once your DMARC policy is enforced, your trademark is registered, and your SVG is compliant, you can apply for a VMC from an approved CA.

Approved Certificate Authorities

As of 2024, two CAs are authorised to issue VMCs:

• DigiCert — digicert.com
• Entrust — entrust.com

Additional CAs may be approved over time. Check the BIMI Group’s CA list for the current authorised issuers.

What the CA validates

The CA performs the following checks before issuing a VMC:

1. Domain control validation (DCV): You must prove ownership of the domain for which the VMC is being issued.
2. Trademark verification: The CA verifies the trademark registration against the relevant IP office database. You will need to provide your registration number and jurisdiction.
3. Logo-to-trademark match: The SVG you submit is compared against the registered mark. They must be substantively identical.
4. DMARC enforcement check: Some CAs verify that a DMARC

See also: BIMI record