The automation gap.

Let's Encrypt is one of the most successful certificate authorities in internet history. It has issued billions of TLS certificates, driven HTTPS adoption across the web, and done so entirely for free. So when organisations begin implementing BIMI and discover that Mark Certificates cost upward of $1,000 per year, the natural question appears in forums and support threads almost immediately:

"Why can't Let's Encrypt just issue VMCs?"

The short answer: the ACME protocol automates domain control validation. BIMI certificates require something fundamentally different — human judgment about trademark ownership and brand identity. Those two things are not reconcilable with the same toolchain.

This article explains the structural reasons why, what the verification process for VMCs and CMCs actually involves, and why the cost gap between a free TLS certificate and a $1,000+ Mark Certificate is not arbitrary pricing — it reflects genuine manual labour performed by accredited examiners.

---

Background: What Let's Encrypt actually does

Let's Encrypt operates on the ACME protocol (Automated Certificate Management Environment, RFC 8555). The entire model is built around one question:

Does the entity requesting this certificate control the domain name in question?

To answer that question automatically, Let's Encrypt uses one of three challenge types:

1. HTTP-01 — Place a specific token at a known URL on the domain.
2. DNS-01 — Publish a specific TXT record in the domain's DNS zone.
3. TLS-ALPN-01 — Respond to a TLS handshake on port 443 with a specific certificate.

If the challenge succeeds, domain control is proven. The certificate is issued in seconds. No human reviews the request. No human could review the request — Let's Encrypt issues millions of certificates per day.

This model works precisely because domain control is a binary, machine-verifiable fact. Either the token is present or it is not.

---

What a BIMI Mark Certificate actually certifies

A Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) does not certify domain control. It certifies something categorically different:

That a specific SVG logo is legitimately associated with a specific organisation, and that the organisation has the right to display that logo in email clients.

To make that assertion, a certificate authority must answer questions that have no machine-verifiable answer:

1. Does this organisation own or license the trademark depicted in the logo?
2. Is the SVG file a faithful representation of that registered trademark?
3. Has the logo been in continuous, public use long enough to qualify under CMC historical-use rules?
4. Is the organisation the same legal entity named on the trademark registration?

None of these questions can be resolved by placing a file on a web server.

---

The VMC verification process: what examiners actually do

Accredited Mark Verifiers (AMVs) — the small number of CAs authorised to issue VMCs, currently including DigiCert and Entrust — follow a defined examination workflow for each application. The steps below reflect the published requirements from the BIMI Working Group and CA/Browser Forum Mark Certificate guidelines.

1. Trademark registration verification

The examiner retrieves the trademark registration record from the relevant national or international registry (USPTO, EUIPO, WIPO, IPO, etc.) and confirms:

• The mark is registered (not merely applied for).
• The registration is active and not expired, cancelled, or abandoned.
• The goods and services classes are consistent with the applicant's business.
• The owner of record matches the legal entity submitting the certificate request.

This step requires access to multiple trademark databases, knowledge of international IP law, and judgment about edge cases — for example, whether a pending renewal constitutes a lapsed registration.

2. Logo-to-trademark correspondence review

The examiner compares the submitted SVG file against the trademark specimen on record and determines whether they are substantially the same mark. This is not a pixel-diff operation. It requires human assessment of:

• Stylistic equivalence across different file formats.
• Whether colour variations are within acceptable tolerance.
• Whether simplified or adapted versions still represent the registered mark.

3. SVG technical compliance check

The SVG must conform to the BIMI SVG Tiny P/S profile — a restricted subset of SVG 1.2 Tiny. Examiners verify that the file:

• Contains no raster image embeds.
• Uses no JavaScript or external references.
• Includes the correct