CMC Certificates

BIMI (Brand Indicators for Message Identification) is an email authentication standard that displays a brand’s logo in supported email clients. For Gmail users, Google displays a blue checkmark next to the sender’s name to indicate a verified logo. A VMC (Verified Mark Certificate) is a digital certificate issued by a trusted authority that verifies logo ownership, often required for BIMI implementation. CMC (Certified Mark Certificate) shares a common goal of verifying logo ownership but does not require a registered trademark. CMCs are often a faster and more accessible path to BIMI compliance, however they do not trigger the Gmail blue checkmark.

BIMI works in conjunction with email authentication protocols like SPF, DKIM and DMARC to make the sender’s worthiness more visible in recipients’ inboxes. SPF (Sender Policy Framework) prevents email spoofing by allowing domain owners to specify which mail servers are authorized to send emails on behalf of their domain. DKIM (DomainKeys Identified Mail) adds a security layer by allowing the sender to attach a digital signature to the email to confirm the sender's identity and to verify the content has not been altered in transit. DMARC (Domain-based Message Authentication Reporting & Conformance) builds on SPF and DKIM by providing a policy framework that tells receiving mail servers how to handle emails that fail SPF or DKIM checks. It also allows domain owners to receive reports on email authentication results.

BIMI works by linking your email address to your brand’s logo using DNS records. To become BIMI compliant, companies must ensure that their emails are authenticated using SPF, DKIM and DMARC, then set up a DNS record that points to their logo image and VMC. BIMI-participating mailbox providers like Gmail, Apple Mail and Yahoo check the BIMI record when receiving emails from the company’s email domain. If DMARC passes, it will verify if there is a BIMI record in DNS for the sender domain name (and so be re-directed to the VMC and logo image to display); if DMARC fails, it won’t look for BIMI.

VMC logos are currently supported in inboxes of email clients that implement BIMI — including Gmail, Yahoo Mail, Apple Mail, Zoho Mail, Fastmail, La Poste, Onet.pl, Zoner, and au.com. Gmail also displays a blue checkmark for verified senders with VMC. An updated list of mailbox providers is maintained by the BIMI group.

To create a BIMI record, follow these steps:

1. Ensure DMARC enforcement: Your domain must have a DMARC policy set to p=quarantine or p=reject.
2. Prepare your logo: Convert your logo to SVG format using the SVG Tiny Portable/Secure (SVG P/S) profile.
3. Host your logo: Upload the SVG file to a secure HTTPS-accessible location.
4. Obtain a Verified Mark Certificate (VMC): If required by your target email providers (e.g., Gmail), get a VMC from a trusted Certificate Authority like DigiCert or Entrust.
5. Publish the BIMI record: Add a DNS TXT record for default._bimi.yourdomain.com with the following format:
   v=BIMI1; l=https://yourdomain.com/logo.svg; a=https://yourdomain.com/vmc.pem;

If you're not using a VMC, leave the a= field blank for a self-asserted record.

If you are unsure how to add a TXT record to your DNS, check with your hosting provider, DNS provider or system administrator.

Typically an organization's legal team can provide details around your trademark status. Having this data, you can look on the World Intellectual Property Organization's (WIPO) website and search for your organization's logo. Once you find your logo in the database, verify registration status (trademark must not expire within 397 days of verification), jurisdiction and a match between the logo you use in email and the trademarked version. As of September 2025, VMC guidelines officially recognize 17 intellectual property offices:

• United States Patent and Trademark Office
• Canadian Intellectual Property Office
• European Union Intellectual Property Office
• UK Intellectual Property Office
• Deutsches Patent- und Markenamt
• Japan Trademark Office
• Spanish Patent and Trademark Office O.A.
• IP Australia
• Intellectual Property India
• Korean Intellectual Property Office
• Instituto Nacional da Propriedade Industrial
• French Institut National de la Propriete Industrielle
• Benelux Office for Intellectual Property
• Denmark Ministry of Culture
• Swedish Intellectual Property Office
• Swiss Federal Institute of Intellectual Property
• Intellectual Property Office of New Zealand

If your logo is not registered with a recognized intellectual property office, you need to go through the trademark registration process in the appropriate jurisdiction. This process can take months, so plan ahead. Alternatively, if your organization is unable to register their logo, or is looking for a more accessible path to BIMI compliance, you may want to start with a Common Mark Certificate (CMC) which allows your organization to display your logo in emails without a trademark.

Applicants can demonstrate historical usage by providing proof that the logo has been used on their website for at least 12 months. Proof of this activity can be found on the Internet Archive: https://archive.org

VMC/CMC validation consists of:

• Organization validation (similar to EV SSL)
• Face-to-face validation (similar to eIDAS)
• Logo verification
• Domain Control Validation (same as for SSL)
• CAA checks (same as for SSL)

Mark Certificates are valid for one year. Sectigo offers its customers multi-year subscriptions on Mark Certificates, which ensure continuous coverage and cost-saving benefits.

If your organization has one domain and one logo, you may only need one VMC/CMC. If you have multiple domains and a single logo, you can use one VMC/CMC for all domains. If you have multiple logos you wish to display in recipient’s inboxes, you need one certificate per unique logo.

Before starting the setup process, we recommend having the following information ready. This will help you move through the setup smoothly without losing progress.

• Domain names you want to associate with your CMC/ VMC
• Certificate Signing Request (CSR)
  • Must include all domains you’re associating now
  • Cannot include more domains than purchased
  • You can start with one domain and add more later
• Domain validation method for each domain (Email, DNS, or HTTP)
• Organization details: legal name, registration number, and address
• Validation contact information
• Trademark details: registration number, jurisdiction, and DUNS number
  • View list of verified trademark offices for VMC (Not needed for CMC)
• Logo in SVG format
  • Max size: 24 KB
  • Must meet CMC/ VMC logo requirements (square aspect ratio, no transparency)

You can absolutely host your own logo. Your logo must be publicly accessible via HTTPS. That is, you should upload your logo to a location that is accessible on the internet. Simply upload your SVG file to your server and reference its URL in your BIMI DNS record. Make sure the file meets BIMI specifications and is not behind authentication or redirects. If you prefer, you can let Sectigo host your logo file instead.

Your logo must be:

• In SVG Tiny Portable/Secure (SVG Tiny 1.2) format.
• Square aspect ratio (e.g., 600x600 pixels).
• Under 24 KB in file size.
• Free of scripts, external links, embedded fonts, or raster images.
• Include a <title> tag with your company name.
• Hosted on a secure HTTPS server.

You can use tools provided by the BIMI Group or manually edit the SVG file using a text editor to ensure compliance.