KoltrixVMC vs CMC: which BIMI certificate do you need?
Verified Mark Certificates need a registered trademark; Common Mark Certificates do not. Compare requirements, mailbox support and cost factors.
On this page(10 sections)
If you want your logo to appear in Gmail through BIMI, you need a mark certificate, and there are now two kinds to choose from. The right one depends mostly on a legal fact about your logo, not on anything technical.
Why certificates exist in BIMI at all
A BIMI record lets any domain point at any logo. Without a check, a phishing domain could publish a BIMI record pointing at a bank's logo, pass DMARC for its own domain, and look convincingly official in the inbox.
Mark certificates close that gap. A certificate authority verifies that the organization controlling the domain has a legitimate claim to the logo, then issues a certificate that binds the logo, the organization and the domain together. Mailbox providers that require certificates only display logos backed by one.
Verified Mark Certificates (VMC)
The VMC was the original BIMI certificate type.
The key requirement is a registered trademark. The logo in the certificate must match a mark registered with a recognized trademark office. The certificate authority checks the registration, verifies the organization's identity and its right to use the mark, and confirms control of the domain.
What a VMC typically involves:
- An active trademark registration for the exact logo you will display, in a jurisdiction the certificate authority accepts.
- Organization identity validation, similar in rigor to extended validation for web certificates.
- A verification step involving people at your organization.
- An SVG Tiny PS version of the logo that matches the registered mark.
At Gmail, a logo backed by a VMC can be accompanied by a verified checkmark indicator, according to Google's published documentation at the time of writing.
Common Mark Certificates (CMC)
The CMC was introduced to open BIMI to organizations whose logos are not registered trademarks, which is a large share of smaller companies.
The key requirement is evidence of prior use. Instead of a trademark registration, the certificate authority looks for proof that the logo has been publicly used by your organization for a period of time. The BIMI Group's guidance sets that period at twelve months, typically shown through archived copies of your website.
What a CMC typically involves:
- Evidence that the exact logo has been in public use for the required period.
- Organization identity validation and domain control checks.
- An SVG Tiny PS version of the logo matching what was in use.
Gmail supports CMC-backed logos, but, per Google's documentation, without the verified checkmark that VMCs can carry.
Side by side
| Factor | VMC | CMC |
|---|---|---|
| Trademark registration | Required | Not required |
| Evidence of use | Covered by trademark | Required (prior public use) |
| Identity validation | Yes | Yes |
| Gmail logo display | Yes | Yes |
| Gmail checkmark | Possible | No |
| Lead time | Longer if you must first register a mark | Shorter if your logo has a usage history |
Policies at other mailbox providers vary. Some display BIMI logos only with a VMC, some accept either, and some show logos without any certificate for senders that meet their own reputation criteria. Provider support has changed more than once since BIMI launched, so check current documentation for the inboxes most of your recipients use before deciding.
How to choose
Choose a VMC if
- Your logo is already a registered trademark in a jurisdiction the certificate authorities accept.
- The checkmark indicator matters to your brand, for example in sectors heavily targeted by phishing.
- You need logos in mailbox providers that accept only VMCs.
Choose a CMC if
- Your logo is not registered, and registering it is not planned soon. Trademark registration can take many months.
- Your logo has been publicly and consistently used for long enough, with archived evidence.
- Your main goal is logo display in Gmail, without the checkmark.
Consider waiting if
- You are about to redesign your logo. Both certificates bind a specific mark; a redesign means a new certificate, and for a CMC, a new usage history.
- Your DMARC policy is not yet at enforcement. No certificate helps until that is done.
Costs and timelines
Mark certificates are sold by a small number of certificate authorities, with annual pricing that is substantially higher than ordinary web TLS certificates. Prices vary by issuer and change over time, so get current quotes rather than relying on figures from articles. Budget for:
- The certificate itself, renewed annually or per the issuer's term.
- Trademark registration fees and legal time, if you go the VMC route and do not have a registration yet.
- Internal time for identity verification and producing the compliant SVG.
The longest lead time is usually trademark registration for a VMC. If you start from nothing, a CMC is typically the faster path to a logo in Gmail.
What you receive and how to publish it
The certificate authority gives you a PEM file containing the certificate chain, with the logo embedded in the certificate. Host it over HTTPS and reference it in the a= tag of your BIMI record:
default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/brand/logo.svg; a=https://example.com/brand/mark.pem"The logo at l= must match the logo embedded in the certificate. If they differ, providers that check certificates will not display it. Many teams host both files on the same stable path and never touch them between renewals.
Renewal and maintenance
- Track expiry. An expired certificate means the logo stops appearing at providers that require one. Put the renewal date on a shared calendar with an owner.
- Keep the trademark active if you rely on a VMC; a lapsed registration can affect renewal.
- Re-issue after logo changes. Any change to the mark, even a color tweak, may require a new certificate.
- Keep the PEM URL stable through website migrations.
Checklist
- DMARC at
p=quarantineorp=rejectbefore buying anything. - Determine whether your logo is a registered trademark.
- If yes and the checkmark matters, pursue a VMC; if no, check whether you have enough documented prior use for a CMC.
- Prepare an SVG Tiny PS logo matching the mark exactly.
- Complete identity validation with the certificate authority.
- Host the PEM and SVG over HTTPS and publish
a=andl=. - Set a renewal reminder with an owner.
Key takeaways
- Certificates stop impostors from showing logos they have no right to.
- A VMC requires a registered trademark; a CMC requires evidence of prior public use.
- Gmail shows logos with either, but the checkmark is associated with VMCs, according to Google's documentation.
- Other providers set their own rules, so verify current support for your audience.
- Fix DMARC first, keep the logo stable, and track renewal dates.
Start with Koltrix
Your domain, one inbox, and an API that sends.
A team inbox where AI sorts and drafts (nothing is sent without your click), plus the transactional API and SMTP relay your product sends with. 7 days free, no card.
