Verified Mark Certificate (VMC): 2026 Guide

Verified Mark Certificate: The Practitioner's Guide to Getting Your Logo in the Inbox

Your CMO just forwarded a screenshot from a competitor's email - their logo sitting right there in the inbox, blue checkmark and all. "Why don't we have this?" The answer involves a registered trademark, a specific SVG format you've never heard of, DMARC enforcement, and a verified mark certificate that costs $780-$1,752 a year. Most of the information out there comes from the Certificate Authorities selling you the certificate. This guide doesn't. Here's what a VMC actually requires, what it costs, and whether it's worth the money.

What You Need (Quick Version)

Before you go any further, here's the checklist:

• Registered trademark with a recognized intellectual property office (USPTO, EUIPO, UK IPO, etc.)
• DMARC at enforcement - p=quarantine or p=reject, pct=100, no sp=none
• SVG Tiny P/S logo - not a standard SVG export from Illustrator
• BIMI DNS TXT record published on your domain
• VMC from a BIMI-qualified issuer - DigiCert or Entrust
• Budget: $780-$1,752/year per domain, per logo

One thing to know upfront: Microsoft doesn't support BIMI across Outlook.com, Hotmail, or Microsoft 365. If your audience lives in Outlook, stop here.

What Is a VMC?

A verified mark certificate is a digital certificate that proves your brand logo is legitimate and tied to a registered trademark. It's the final link in a chain of email authentication protocols that, when everything lines up, puts your logo next to your sender name in the inbox.

The authentication chain works like this: SPF verifies your sending servers, DKIM signs your messages cryptographically, and DMARC ties SPF and DKIM together while telling receiving servers what to do with messages that fail. BIMI (Brand Indicators for Message Identification) is the standard that says "if this sender passes DMARC, display their logo." The VMC proves the logo is real.

Here's the distinction that matters: BIMI has two modes. Self-asserted BIMI means you publish a logo in your DNS record without any third-party verification - Yahoo and AOL accept this. Certified BIMI means your logo is backed by a VMC, verified by a Certificate Authority against your registered trademark. Gmail requires certified BIMI. No VMC, no logo.

VMC vs CMC: Which Do You Need?

Google introduced [Common Mark Certificates (CMCs)](https://docs.digicert.com/en/certcentral/manage-certificates/verified-mark-certificates - vmc-/common-mark-certificate - cmc-.html) to give brands without registered trademarks a path to displaying logos in Gmail. The difference is straightforward but important.

The critical detail: Gmail displays your logo with a CMC, but you don't get the blue verified checkmark. That checkmark is VMC-only. For some brands, the checkmark is the whole point - it's a visible trust signal that says "this sender is verified." For others, just getting the logo displayed is enough.

Let's be honest: CMCs are underrated. If you don't have a registered trademark - or your trademark is pending - a CMC gets your logo into Gmail inboxes at a lower price point. The catch is that CMC prior-use proof is more involved than people expect. You need to demonstrate your mark was publicly displayed for at least 12 months on a website you control, and CAs verify this through sources like archive.org. A single CMC can also cover up to 250 sending domains for Gmail, which is a significant advantage for organizations with lots of sending domains.

Which Inboxes Support BIMI?

Not every email client displays BIMI logos. Your audience composition matters more than anything else in this decision.

The BIMI Group's official support page was last updated in mid-2025, and the Outlook gap hasn't changed heading into 2026. If your list skews heavily B2B and your recipients live in Outlook, a VMC won't display your logo where it matters most. Save your money until Microsoft gets on board - or at least do the math on what percentage of your list actually uses Gmail and Apple Mail before committing.

Verified Mark Certificate Requirements

DMARC Enforcement

Your domain's DMARC policy must be at p=quarantine or p=reject. A p=none policy - essentially monitoring mode - won't qualify. The pct value must be 100, meaning the policy applies to all messages, and you can't have sp=none on subdomains.

If you're still rolling out DMARC and have pct=50 to test, you'll need to get to full enforcement first. This is often the longest prerequisite to satisfy, especially for organizations with multiple sending sources and third-party tools sending on their behalf. We've seen teams spend six weeks just auditing all their legitimate senders before they could flip the switch to enforcement.

Trademark Registration

Your logo must be registered as a trademark with a recognized intellectual property office. CAs verify your trademark against official IP office databases and the WIPO Global Brand Database. The accepted offices include:

• Americas: USPTO (US), CIPO (CA), INPI (BR)
• Europe: EUIPO (EU), UK IPO (GB), BOIP (Benelux), DPMA (DE), DK PTO (DK), Spain PTO (ES), France PTO (FR), Sweden (SE), Switzerland (CH)
• Asia-Pacific: IP Australia (AU), India (IN), Japan (JP), KIPO (KR), IPONZ (NZ)

This list matters. If your trademark is registered with an office that isn't on it, Gmail won't display your logo - even with a valid certificate. We've seen this trip up companies with trademarks registered in smaller jurisdictions. Verify your office is included before purchasing.

SVG Tiny P/S Logo Format

Here's the thing: your logo must be in SVG Tiny P/S format, a specific, constrained version of SVG designed for secure rendering in email clients. You can't just export an SVG from Illustrator or Figma and call it done. The file needs to conform to the Tiny Portable/Secure profile, which strips out scripts, external references, and other elements that could pose security risks.

Every design team learns this the hard way. Budget 1-2 rounds of revisions. DigiCert's documentation has specifics on the format requirements.

CAA issuevmc DNS Tag

Domain owners can publish a CAA (Certificate Authority Authorization) record with the issuevmc property tag. This works like standard CAA records for TLS certificates - it specifies which CAs are authorized to issue mark certificates for your domain. It isn't strictly required yet for all issuers, but it's a best practice that prevents unauthorized certificate issuance.

How Much Does a VMC Cost?

Pricing transparency in this space is genuinely frustrating. Practitioners regularly question whether VMCs are worth the cost, and the frustration is understandable when many vendors won't show you a price without a sales process.

Here's what the market looks like based on published reseller and subscription pricing:

Resellers like SSL2BUY can undercut other published pricing significantly - their VMC starts at $780/year versus $1,550+ elsewhere. The tradeoff is support and validation speed. Once documentation is verified, same-day issuance is possible.

Total Cost of Ownership

The certificate price is just the starting point. Here's what to actually budget:

• Certificate: $780-$1,752/year
• Renewal: Similar cost annually - VMCs must be reissued roughly every 397 days, even on multi-year plans
• Multi-domain/multi-logo scaling: Each base domain and each unique logo requires its own certificate. Three domains, two logos? That's up to six certificates.
• Integration fees: If you use a managed service, expect $999 one-time per certificate for setup, DNS configuration, and logo formatting support

Budget $1,550-$1,752/year per domain/logo as a realistic baseline through common channels, with lower pricing available via some resellers.

How to Set Up a VMC: Step by Step

The process takes 2-8 weeks depending on your DMARC readiness and trademark status. Here's the practical walkthrough:

1. Get DMARC to enforcement. Set your policy to p=quarantine or p=reject with pct=100. If you're starting from p=none, this alone can take weeks as you identify and authorize all legitimate sending sources.

2. Confirm your trademark registration. Verify it's registered with an accepted IP office from the list above. If it's pending, wait - or pursue a CMC instead.

3. Convert your logo to SVG Tiny P/S. Work with your design team or use a conversion tool. Test the output against the BIMI Group Inspector before submitting.

4. Choose an issuer. DigiCert or Entrust are your options.

5. Submit your VMC application. The issuer validates your trademark against official databases and the WIPO Global Brand Database, then confirms domain ownership.

6. Publish your BIMI DNS TXT record. Add a TXT record at default._bimi.yourdomain.com with this format:

   v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem
   

   The l= tag points to your SVG logo URL and the a= tag points to your VMC's PEM file URL.

7. Wait for mailbox providers to pick up the record. Expect anywhere from a few days to a couple of weeks for changes to show up consistently.

8. Verify with BIMI Group Inspector or MxToolbox. Confirm your logo renders correctly and the certificate chain validates.

Does a VMC Improve Email Performance?

The engagement data is directional but compelling. Yahoo's BIMI pilot showed a 10% increase in engagement for senders displaying brand logos. Other published benchmarks attribute open-rate lifts of 21% in the US and 39% in the UK, along with 34% higher purchase likelihood and 120% improvement in brand recognition.

These are benchmarks, not guarantees. But the directional signal is clear: a recognizable logo in the inbox drives more opens and more trust.

When a VMC Makes Sense

Get one if more than 40% of your list uses Gmail or Apple Mail, you have a registered trademark, and brand recognition in the inbox matters to your business. The ROI math works best for high-volume senders where even a small lift in open rates moves real revenue.

Consider a CMC instead if you don't have a registered trademark, your trademark is pending, or the blue checkmark isn't worth the price premium. You still get the logo in Gmail.

Skip it entirely if your audience is Outlook-dominant, your sending volume is low, or you haven't achieved DMARC enforcement yet. Fix the fundamentals first.

Those engagement numbers also assume you're sending to real, active inboxes. If 10-30% of your list is outdated or invalid, bounces will damage the sender reputation your VMC is designed to protect. Verify your list before you send - Prospeo's real-time email verification catches bad addresses with 98% accuracy across 143M+ verified emails, so the authentication infrastructure you've built actually pays off.

Common Gotchas

• Trademark office not on the accepted list. Your VMC will validate, but Gmail won't display your logo. Check the list before you buy.
• Microsoft doesn't support BIMI. No workaround, no public timeline as of 2026.
• CMC prior-use proof is harder than it sounds. Twelve months of public display, verified through archive.org - not just "we've been using this logo for years."
• SVG Tiny P/S isn't a standard SVG. Every design team learns this the hard way. Budget time for format conversion and validation.
• Pricing opacity is the norm. Many vendors push you into a sales process; published pricing is more common through resellers.
• Multi-domain costs add up fast. Each domain and each unique logo needs its own certificate. A company with five sending domains and two logo variants is looking at 10 certificates.

FAQ

How long does it take to get a verified mark certificate?

Two to eight weeks from start to inbox logo display. The biggest bottleneck is getting DMARC to enforcement if you're starting from p=none. Same-day issuance is possible once all prerequisites are met and documentation is verified by the CA.

Can I display my logo in Gmail without a trademark?

Yes - use a Common Mark Certificate. You'll need proof of prior use for 12+ months verified through archive.org. Gmail displays your logo, but you won't get the blue verified checkmark that a VMC provides.

Does Outlook support BIMI or VMC logos?

No. Microsoft doesn't support BIMI across Outlook.com, Hotmail, or Microsoft 365 as of 2026. No public timeline for adding support exists. If your audience is primarily Outlook users, a VMC won't deliver visible ROI.

Do I need a separate VMC for each sending domain?

Yes. Each base domain and each unique logo requires its own certificate. A CMC is more flexible - a single CMC can cover up to 250 sending domains for Gmail, making it far more cost-effective for multi-domain senders.

Should I verify my email list before investing in a VMC?

Bounces from invalid addresses destroy sender reputation, undermining the very deliverability that DMARC and BIMI protect. Clean your list first. Tools like Prospeo verify emails in real time with 98% accuracy, so your authentication investment actually delivers results instead of landing in spam folders.