VMC-Zertifikate

BIMI (Brand Indicators for Message Identification) is an email authentication standard that displays a brand’s logo in supported email clients. For Gmail users, Google displays a blue checkmark next to the sender’s name to indicate a verified logo. A VMC (Verified Mark Certificate) is a digital certificate issued by a trusted authority that verifies logo ownership, often required for BIMI implementation. CMC (Certified Mark Certificate) shares a common goal of verifying logo ownership but does not require a registered trademark. CMCs are often a faster and more accessible path to BIMI compliance, however they do not trigger the Gmail blue checkmark.

BIMI works in conjunction with email authentication protocols like SPF, DKIM and DMARC to make the sender’s worthiness more visible in recipients’ inboxes. SPF (Sender Policy Framework) prevents email spoofing by allowing domain owners to specify which mail servers are authorized to send emails on behalf of their domain. DKIM (DomainKeys Identified Mail) adds a security layer by allowing the sender to attach a digital signature to the email to confirm the sender's identity and to verify the content has not been altered in transit. DMARC (Domain-based Message Authentication Reporting & Conformance) builds on SPF and DKIM by providing a policy framework that tells receiving mail servers how to handle emails that fail SPF or DKIM checks. It also allows domain owners to receive reports on email authentication results.

BIMI works by linking your email address to your brand’s logo using DNS records. To become BIMI compliant, companies must ensure that their emails are authenticated using SPF, DKIM and DMARC, then set up a DNS record that points to their logo image and VMC. BIMI-participating mailbox providers like Gmail, Apple Mail and Yahoo check the BIMI record when receiving emails from the company’s email domain. If DMARC passes, it will verify if there is a BIMI record in DNS for the sender domain name (and so be re-directed to the VMC and logo image to display); if DMARC fails, it won’t look for BIMI.

Typically an organization's legal team can provide details around your trademark status. Having this data, you can look on the World Intellectual Property Organization's (WIPO) website and search for your organization's logo. Once you find your logo in the database, verify registration status (trademark must not expire within 397 days of verification), jurisdiction and a match between the logo you use in email and the trademarked version. As of September 2025, VMC guidelines officially recognize 17 intellectual property offices:

• United States Patent and Trademark Office
• Canadian Intellectual Property Office
• European Union Intellectual Property Office
• UK Intellectual Property Office
• Deutsches Patent- und Markenamt
• Japan Trademark Office
• Spanish Patent and Trademark Office O.A.
• IP Australia
• Intellectual Property India
• Korean Intellectual Property Office
• Instituto Nacional da Propriedade Industrial
• French Institut National de la Propriete Industrielle
• Benelux Office for Intellectual Property
• Denmark Ministry of Culture
• Swedish Intellectual Property Office
• Swiss Federal Institute of Intellectual Property
• Intellectual Property Office of New Zealand

If your logo is not registered with a recognized intellectual property office, you need to go through the trademark registration process in the appropriate jurisdiction. This process can take months, so plan ahead. Alternatively, if your organization is unable to register their logo, or is looking for a more accessible path to BIMI compliance, you may want to start with a Common Mark Certificate (CMC) which allows your organization to display your logo in emails without a trademark.

Applicants can demonstrate historical usage by providing proof that the logo has been used on their website for at least 12 months. Proof of this activity can be found on the Internet Archive: https://archive.org

VMC logos are currently supported in inboxes of email clients that implement BIMI — including Gmail, Yahoo Mail, Apple Mail, Zoho Mail, Fastmail, La Poste, Onet.pl, Zoner, and au.com. Gmail also displays a blue checkmark for verified senders with VMC. An updated list of mailbox providers is maintained by the BIMI group.

VMC/CMC validation consists of:

• Organization validation (similar to EV SSL)
• Face-to-face validation (similar to eIDAS)
• Logo verification
• Domain Control Validation (same as for SSL)
• CAA checks (same as for SSL)

Mark Certificates are valid for one year. Sectigo offers its customers multi-year subscriptions on Mark Certificates, which ensure continuous coverage and cost-saving benefits.

If your organization has one domain and one logo, you may only need one VMC/CMC. If you have multiple domains and a single logo, you can use one VMC/CMC for all domains. If you have multiple logos you wish to display in recipient’s inboxes, you need one certificate per unique logo.