The 2026 Guide to Verified Mark Certificates (VMC) and BIMI

Key Takeaways:

• VMC requires DMARC enforcement at p=quarantine or p=reject for at least 30 consecutive days before logo display.

• BIMI acts as the DNS-based framework that tells mailbox providers where to retrieve and verify your logo.

• VMC requires a registered trademark and Extended Validation by an approved Certificate Authority.

• Logos must use SVG Tiny PS format, remain under 32 KB, and follow a 1:1 square ratio.

• Verified logos increase brand visibility, improve engagement rates by up to 10%, and block domain spoofing attacks through DMARC enforcement.

Your logo in the inbox now determines whether your email gets opened or ignored. Mailbox providers now reward authenticated brands with premium, verified logo placement through the combination of VMC and BIMI.

By implementing these standards, you transform a generic initials-based avatar into a powerful trust signal. A Verified Mark Certificate displays your trademarked logo with a verified indicator in Gmail, Yahoo, and Apple Mail. This visual confirmation increases open rates by 4% to 10% and requires the enforcement of DMARC protection, a security layer that successfully blocks domain spoofing attacks.

VMC, CMC, and BIMI: What They Are

Even though people commonly confuse these three, they are all different from each other.

BIMI: The Framework

BIMI is an open technical standard. It acts as the instruction set in your DNS. It tells a mailbox provider like Gmail or Apple Mail where to find your logo and how to verify it.

VMC: The Proof

The Verified Mark Certificate is a high-assurance digital certificate. It proves that your logo is a registered trademark. In 2026, a VMC is a requirement for the most visible trust signals, such as the Gmail Blue Checkmark.

CMC: The Accessible Alternative

The Common Mark Certificate (CMC) is an alternative for a brand without a registered trademark.

• Requirement: 12 or more months of proven public logo use.

• Trade-off: You get a logo display in the inbox, but you typically do not receive the “verified” blue checkmark badge.

Technical Prerequisites

A VMC requires a perfectly configured email security stack to function.

DMARC Enforcement

A domain must reach DMARC enforcement level first.

• Required Policy: You must set your policy to p=quarantine or p=reject.

• The 30-Day Rule: Most mailbox providers require your domain to remain at enforcement for at least 30 consecutive days before they pull and display your BIMI logo.

• Alignment: Both SPF and DKIM must correctly align with your sending domain.

SVG Tiny PS: The Logo Standard

BIMI does not support standard JPEG, PNG, or standard SVG files. You must use the SVG Tiny Portable/Secure format.

• Security: This format removes scripts and external references to prevent malware.

• Size: The file must stay under 32 KB.

• Aspect Ratio: The image must use a 1:1 square ratio.

Legal Prerequisites: Trademark Verification

A VMC is a legal document. A Certificate Authority verifies your logo against official government records.

Authorized Trademark Offices

Your logo must have a registration with an approved Intellectual Property office. The current list includes:

• USPTO and CIPO for North America

• EUIPO, UKIPO, DPMA, INPI, BOIP, OEPM, PRV for Europe

• IP India, JPO, KIPO, IP Australia, IPONZ for Asia-Pacific

• NPI Brazil for South America

Verification Steps

1. Identity Validation: The CA performs an “Extended Validation” check to confirm the legal existence of your business.

2. Identity Check: An authorized representative must often complete a video-call identity verification.

3. Trademark Match: The SVG logo you submit must be an exact match to the image on file at the trademark office. Any minor variation, like a color shade or extra text, can lead to a rejection.

How to Implement 

Setup for VMC and BIMI follows a linear process. If you skip a step, DNS errors and validation failures often occur.

Phase 1: Authentication Cleanup

• Audit Senders: Identify all third-party services that send on your behalf.

• Achieve Compliance: Move your DMARC policy from p=none to p=quarantine and wait 30 days.

Phase 2: Asset Preparation

• Trademark Check: Ensure your registration is active and the logo is identical to the one you plan to use.

• SVG Conversion: Create the SVG Tiny PS file and host it on a secure HTTPS URL.

Phase 3: Certification

• Apply for VMC: Purchase the certificate from a CA like DigiCert, Sectigo, GlobalSign, or SSL.com.

• Verify Identity: Complete the organization and personal validation steps.

• Receive PEM File: You will receive a .pem file that contains your certificate and the logo reference. Host this file as securely as possible on your server.

Phase 4: DNS Publication

Add your BIMI TXT record to your DNS. Congratulations, you’re done!

Benefits: The ROI of Verification

Why invest the time and cost into a VMC?

For the Marketing Team

• Visual Appeal: Who likes too much text? Your brand colors and shapes act as a great visual anchor.

• Engagement Lift: Verified senders report 4% to 10% higher open rates.

• Brand Recall: A view of the logo before the email is opened strengthens brand recognition.

For the Security Team

• Phishing Protection: DMARC enforcement stops spoofing attacks before they reach a user.

• Visual Defense: This system trains customers to look for the logo. If an email that claims to be from your bank has no logo, the user is instantly alerted to potential fraud.

Simplify Your Journey with PowerDMARC

Navigating the strict technical requirements for BIMI and VMC can be daunting. PowerDMARC provides an all-in-one automated platform that simplifies the path to enforcement and logo visibility, so that your domain meets every prerequisite without the manual headache.

• Hosted BIMI Services: Easily upload, maintain, and host your SVG Tiny PS files directly through the platform.

• DMARC Compliance Tracking: Real-time monitoring to help you reach the p=quarantine/reject threshold required for BIMI.

• VMC & CMC installation: End-to-end VMC and CMC issuance via a trusted CA, without the hassle or headache of doing it on your own.

Ready to see your logo in the inbox? Contact PowerDMARC today to start your journey toward a verified sender status.

Wrap Up: Is VMC Worth the Effort?

Getting a VMC involves quite a lot of bureaucratic and technical challenges. Between the strict trademark rules and the need for a month-long DMARC quarantine, it is not a project you finish in an afternoon.

However, the payoff is clear. In a world where your customers are bombarded by spam and scams, that verified logo can help signal safety. It turns your email from a suspicious block of text into a recognized and reliable communication.

If you want your brand to stand out in a crowded inbox while simultaneously locking down your domain security, VMC is the right answer. It protects your reputation, makes your marketing team look like pros, and, most importantly, gives your users some viable peace of mind.

Frequently Asked Questions

Does Microsoft Outlook support VMC?

In early 2026, Microsoft has limited support for the BIMI standard. While they acknowledge the protocol, a full VMC-verified logo display remains a feature primarily for Gmail, Yahoo, and Apple Mail.

Can I use one VMC for multiple domains?

Yes. Most CAs allow you to add Subject Alternative Names (SANs) to your VMC. This allows you to protect multiple subdomains under a single certificate if they use the same logo.

What if a trademark expires?

If your trademark registration becomes inactive, the Certificate Authority must revoke the VMC. This will immediately stop the logo display in inboxes.

Is the certificate a one-time purchase? 

Unfortunately, no. Much like a standard SSL certificate or a website domain, a VMC is a subscription-based asset. You typically need to renew it every year.

What happens if I change my logo? 

Since the VMC cryptographically binds to your specific logo, a new design requires a new certificate. You will need to reach out to your CA to update the record. 

Pro tip: Ensure your new logo is also fully trademarked before you make the switch, or you might find yourself stuck without a verified status during the transition.