Mark Certificates for Email Identity and Brand Trust

BIMI (Brand Indicators for Message Identification) is an email authentication standard that displays a brand’s logo in supported email clients. For Gmail users, Google displays a blue checkmark next to the sender’s name to indicate a verified logo. A VMC (Verified Mark Certificate) is a digital certificate issued by a trusted authority that verifies logo ownership, often required for BIMI implementation. CMC (Common Mark Certificate) shares a common goal of verifying logo ownership but does not require a registered trademark. CMCs are a faster and more accessible path to BIMI compliance, however they do not trigger the Gmail blue checkmark.

BIMI works alongside email authentication tools like SPF, DKIM and DMARC to visually prove that a sender is legitimate, helping their messages stand out and be trusted in recipients’ inboxes. SPF (Sender Policy Framework) prevents email spoofing by allowing domain owners to specify which mail servers are authorized to send emails on behalf of their domain. DKIM (DomainKeys Identified Mail) adds a security layer by allowing the sender to attach a digital signature to the email to confirm the sender's identity and to verify the content has not been altered in transit. DMARC (Domain-based Message Authentication Reporting & Conformance) builds on SPF and DKIM by providing a policy framework that tells receiving mail servers how to handle emails that fail SPF or DKIM checks. It also allows domain owners to receive reports on email authentication results.

BIMI works by linking your email address to your brand’s logo using DNS records. To become BIMI compliant, companies must ensure that their emails are authenticated using SPF, DKIM and DMARC, then set up a DNS record that points to their logo image and VMC. SPF confirms who can send emails on your behalf, DKIM adds a digital signature to prove they haven’t been altered, and DMARC ties it all together to prevent spoofing and phishing.

BIMI-participating mailbox providers like Gmail, Apple Mail and Yahoo check the BIMI record when receiving emails from the company’s email domain. If DMARC passes, it will verify if there is a BIMI record in DNS for the sender domain name (and so be re-directed to the VMC and logo image to display); if DMARC fails, it won’t look for BIMI.

VMC logos are currently supported in inboxes of email clients that implement BIMI — including Gmail, Yahoo Mail, Apple Mail, Zoho Mail, Fastmail, La Poste, Onet.pl, Zoner, and au.com. Gmail also displays a blue checkmark for verified senders with VMC. An updated list of mailbox providers is maintained by the BIMI group.

To create a BIMI record, follow these steps:

1. Ensure DMARC enforcement: Your domain must have a DMARC policy set to p=quarantine or p=reject.
2. Prepare your logo: Convert your logo to SVG format using the SVG Tiny Portable/Secure (SVG P/S) profile.
3. Host your logo: Upload the SVG file to a secure HTTPS-accessible location.
4. Obtain a Verified Mark Certificate (VMC): If required by your target email providers (e.g., Gmail), get a VMC from a trusted Certificate Authority like DigiCert or Entrust.
5. Publish the BIMI record: Add a DNS TXT record for default._bimi.yourdomain.com with the following format: 

v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem;

If you're not using a VMC, leave the a= field blank for a self-asserted record.

If you are unsure how to add a TXT record to your DNS, check with your hosting provider, DNS provider or system administrator.

You can absolutely host your own logo. Your logo must be publicly accessible via HTTPS. That is, you should upload your logo to a location that is accessible on the internet. Simply upload your SVG file to your server and reference its URL in your BIMI DNS record. Make sure the file meets BIMI specifications and is not behind authentication or redirects. If you prefer, you can let Sectigo host your logo file instead.

Mark Certificates are valid for one year. Sectigo offers its customers multi-year subscriptions on Mark Certificates, up to three years, which ensure continuous coverage and cost-saving benefits.

If your organization has one domain and one logo, you may only need one VMC or CMC. If you have multiple domains for which you would like one and the same logo to be displayed in the recipient's inboxes, you can use one VMC or CMC for all domains. If you have multiple logos you wish to display in recipient’s inboxes, you need one certificate per unique logo.