---

title: "What is a VMC? Verified Mark Certificates Explained"
description: "A complete guide to Verified Mark Certificates (VMC) for BIMI email authentication. Learn what a VMC is, why Gmail requires it, and how to get one."
date: "2026-07-01"

What is a VMC? Verified Mark Certificates Explained

Brand Indicators for Message Identification (BIMI) lets email senders display a logo next to their messages in supported inboxes. The mechanism is elegant. The requirement that unlocks it for major clients is specific: a Verified Mark Certificate.

The Core Definition

A Verified Mark Certificate (VMC) is a digital certificate that cryptographically binds a trademarked logo to a domain. It proves two things simultaneously. First, the organization controls the domain sending the email. Second, the organization holds a registered trademark on the logo being displayed.

Certificate Authorities (CAs) issue VMCs after completing that verification. The current authorized issuers are DigiCert and Entrust. Without a VMC, Gmail will not render a BIMI logo. Full stop.

Why the Certificate Exists

BIMI without a VMC is technically valid. Some clients, including Apple Mail, support a lighter variant called a Common Mark Certificate (CMC), which requires no trademark. But Gmail — the largest email client by market share — mandates a VMC.

The reasoning is straightforward. A VMC creates legal accountability. A trademark is a public, government-issued record. A CA verifies that record before issuing the certificate. This chain prevents brand impersonation at scale. Any actor displaying a logo in Gmail has been vetted.

The Full BIMI Stack

A VMC does not operate in isolation. It sits at the top of an authentication stack. Every layer is required.

SPF

Sender Policy Framework publishes authorized sending IP addresses in DNS. A typical record:

v=spf1 include:_spf.google.com ~all

DKIM

DomainKeys Identified Mail adds a cryptographic signature to outbound messages. The public key lives in DNS. The receiving server verifies the signature against it.

DMARC

Domain-based Message Authentication, Reporting and Conformance ties SPF and DKIM together and specifies what to do with failures. For BIMI eligibility, the DMARC policy must be p=quarantine or p=reject. A p=none policy disqualifies the domain.

v=DMARC1; p=reject; rua=mailto:[email protected]; ruo=mailto:[email protected]

BIMI Record

The BIMI DNS record is a TXT entry at default._bimi.yourdomain.com. It references both the logo URL and the VMC URL.

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem

The l= parameter points to the logo. The a= parameter points to the VMC in PEM format. Both URLs must be HTTPS.

The Logo Requirement

VMC issuance requires a logo in a specific format: SVG Tiny P/S. This is not standard SVG. It is a restricted profile defined by the W3C, engineered for security and rendering consistency. Arbitrary SVG features — scripts, external references, animations — are stripped or disallowed.

Most designers export standard SVG from tools like Illustrator or Figma. That file will not pass VMC validation. It must be converted and profiled correctly before submission to a CA.

This is where makeBIMI.com fits. The tool converts an uploaded SVG into a compliant SVG Tiny P/S file at no cost. The output is ready for CA submission. No design software required. No manual XML editing.

What the CA Verifies

Before issuing a VMC, the Certificate Authority performs several checks.

Domain control validation. The applicant must prove ownership of the sending domain. Methods include DNS record placement, file upload, or email confirmation. This mirrors standard TLS certificate issuance.

Trademark verification. The applicant submits trademark registration details: jurisdiction, registration number, and the specific class covering the logo. The CA cross-references the trademark registry. The logo in the SVG file must match the registered trademark. Partial matches or unregistered marks are rejected.

Organizational identity. The CA confirms the legal entity applying for the certificate matches the trademark holder on record.

This process typically takes between five and fifteen business days depending on the jurisdiction and the CA.

VMC Technical Structure

A VMC is an X.509 certificate with extensions specific to BIMI. The SVG logo is embedded directly in the certificate as base64-encoded data. When an inbox provider receives a BIMI-authenticated message, it extracts the logo from the VMC rather than fetching it from the URL. The l= URL in the DNS record serves as a fallback and consistency check.

The certificate has a validity period, typically one year. Renewal requires re-validation of the trademark. CAs do not carry over trust automatically.

The PEM file referenced in the BIMI record must contain the full certificate chain: the VMC itself, the issuing intermediate certificate, and the root CA certificate. An incomplete chain causes verification failures.

Client Support Matrix

Inbox rendering varies by provider.

Gmail. Requires a VMC. Displays the logo as a circular avatar in inbox and thread views. Both mobile and desktop. Approximately 1.8 billion active users.

Yahoo Mail / AOL. Supports BIMI with a VMC. Yahoo was an early adopter of the standard. Logo display is consistent across web and mobile interfaces.

Apple Mail. Introduced BIMI support with iOS 16 and macOS Ventura. Accepts both VMC and CMC. For senders already invested in trademark verification, a VMC covers Apple Mail automatically.

Outlook. Microsoft has not implemented BIMI as of mid-2026. Outlook uses its own sender verification system independent of BIMI.

Fastmail, Proton Mail, others. Support varies and is expanding. The BIMI Group maintains the current official support list.

Getting a VMC

The procurement path has three stages.

Stage one: prepare authentication. Confirm SPF, DKIM, and DMARC are correctly configured. DMARC must be at enforcement. Use a DMARC reporting tool to verify alignment before proceeding.

Stage two: prepare the logo. Convert the brand SVG to SVG Tiny P/S using makeBIMI.com. Verify the output passes structural validation. The logo should be a clean, square-cropped mark. Complex illustrations and thin text can render poorly at small sizes.

Stage three: purchase and submit. veriBIMI.com brokers VMC issuance through authorized CAs. The process covers trademark submission, domain validation, and certificate delivery. VMC pricing typically ranges from $1,000 to $1,500 USD annually depending on the issuer and validation tier.

Once the certificate is issued, upload the PEM file to an HTTPS-accessible URL, update the BIMI DNS record, and allow propagation. Inbox rendering follows within 24 to 72 hours for most providers.

The Business Case

BIMI is a trust signal. A logo visible before the email is opened communicates verified sender identity at a glance. Studies from various inbox providers indicate measurable lifts in open rates for BIMI-enabled senders. The effect is strongest in mobile contexts where subject lines are truncated.

For enterprise senders — financial services, healthcare, retail, SaaS — the VMC investment is marginal relative to email program scale. The trademark likely exists already. The authentication infrastructure likely exists already. The delta is logo preparation and certificate procurement.

For smaller senders, the calculus depends on send volume and brand recognition goals. The trademark requirement is the genuine barrier. Without a registered mark, a VMC is not available.

Summary

A VMC is a CA-issued digital certificate that validates a trademark and embeds it in a logo for BIMI-based email display. Gmail requires it. Yahoo requires it. The process involves trademark verification, domain validation, and SVG compliance. The tools exist to simplify each step. The result is a brand mark that appears in billions of inboxes, backed by cryptographic proof of ownership.

See also: VMC vs CMC comparison

Frequently Asked Questions

What is a VMC?

A Verified Mark Certificate (VMC) is an X.509 digital certificate issued by an authorised Certificate Authority that cryptographically binds a brand logo to a domain. It is required for BIMI logo display in Gmail and Apple Mail.

Do I need a trademark to get a VMC?

Yes. A VMC requires a registered trademark for the logo. If you do not have a registered trademark, a Common Mark Certificate (CMC) is available as an alternative that requires 12 months of consistent logo use instead.

How long does it take to get a VMC?

An unassisted VMC application typically takes 6–12 weeks. A managed process through a broker like veriBIMI targets 3–4 weeks.