VMC

How it works

A VMC (Verified Mark Certificate) is an X.509 certificate that binds a logo image to a registered trademark and to the organization that owns it. A certificate authority validates three things before issuing: that the organization exists, that it holds a live trademark registration for the mark in a recognized IP office, and that the SVG in the certificate matches that registered mark. The issued PEM is hosted on the sender's own domain and referenced from the a= tag of a BIMI record. In Gmail, a VMC is what produces the blue verified checkmark; the cheaper Common Mark Certificate (CMC) shows the logo without it.

When it matters

A VMC matters when the checkmark itself is the goal, which in practice means Gmail-weighted consumer or prosumer audiences. It requires a registered trademark, so it is out of reach for any brand that has not filed, and a US filing runs 10 to 18 months. Three CAs issue VMCs in 2026: DigiCert, Sectigo, and GlobalSign. Entrust exited the market in 2025. Expect $750 to $1,400 a year depending on channel, renewed every 397 days. See Gmail Blue Checkmark: What BIMI Actually Costs.

Common misconceptions

• "There is a free VMC." There is not. Issuance requires human validation of an organization and a trademark. Any instant certificate is not a VMC.
• "A VMC guarantees the checkmark." It is necessary, not sufficient. DMARC at enforcement, a compliant SVG, a full certificate chain, and sender reputation all still gate display.
• "A CMC is a cheaper VMC." A CMC is a different product with a different outcome. It needs 12 months of documented public logo use instead of a trademark, and it never produces a checkmark.