Getting a Verified Mark Certificate from GlobalSign

What you are actually buying

A Verified Mark Certificate, or VMC, is a file a Certificate Authority issues after checking that you legally own your logo. BIMI, which stands for Brand Indicators for Message Identification, is the DNS standard that tells inboxes where to find that logo and that certificate. Put both in place and Gmail shows your logo in the sender slot with a blue checkmark beside it.

GlobalSign is one of a small number of Certificate Authorities allowed to issue VMCs. We used them for our own hockey apparel store, Bench Clearers, bought through a reseller, and that certificate is live in Gmail today. This is the issuer we know first-hand, so this guide covers their process specifically. Requirements and prices move, so everything below was checked against globalsign.com rather than written from memory.

Four gates before you can apply

GlobalSign publishes its prerequisites, and they are gates rather than suggestions. Miss one and you pay the fee and then wait while the vetting team tells you no.

• DMARC at enforcement. Your DMARC record must be set to p=quarantine at 100 percent, or p=reject. DMARC is the policy that tells receiving mail servers what to do with mail that fails authentication. GlobalSign asks that you "apply the DMARC policy 30 days in advance" of your application. Do not apply on day one of enforcement.
• SPF and DKIM configured correctly. These are the two underlying checks DMARC evaluates. SPF lists which servers may send for your domain. DKIM signs each message so the receiver can confirm it was not altered.
• A registered trademark. GlobalSign accepts marks from 17 intellectual property offices, a list last updated March 19, 2025. It includes the USPTO, EUIPO, the UK IPO, the Canadian Intellectual Property Office, IP Australia, IP India, the Japan Trademark Office, KIPO, IPONZ, Benelux, and the national offices of Germany, France, Spain, Denmark, Sweden, Switzerland and Brazil. If your own country's office is not on the list but your logo is registered with one that is, you are still eligible.
• A BIMI-compliant SVG of that exact mark. More on this below, because it is where most applications stall.

The trademark rule that decides your certificate's length

This is the part almost nobody plans for, and it is specific to how GlobalSign handles mark certificates.

Maximum VMC validity is 397 days. If your trademark registration has more than 397 days left on the day you apply, you get the full 397 days. If it has less than that, GlobalSign shortens the certificate so it ends just before your trademark does. And if your registration has under six months left, GlobalSign asks you to renew the trademark first, before applying at all.

The practical effect is blunt. Apply in the wrong month and you pay a full year's price for a certificate that dies in four months. Check your registration's renewal date before you check anything else. If you are inside a year of renewal, renew the mark, let the office update its public record, then apply.

One useful detail from the order form. There is a field for your trademark's license expiry date, and you are allowed to leave it blank. GlobalSign's vetting team looks it up. Leaving it blank is safer than guessing, because a wrong date is a round trip with vetting and days added to issuance.

What it costs, and the per-domain trap

GlobalSign's list prices on their own shop, in US dollars, at the time of writing:

• Verified Mark Certificate, one year: $1,450
• Each additional domain on that VMC: $1,160
• Common Mark Certificate, one year: $1,035
• Each additional domain on a CMC: $828

Why the second domain costs almost as much as the first

A VMC covers one email domain. GlobalSign lets you add up to 100 domains as SANs, short for Subject Alternative Names, but each one is priced close to a whole new certificate. Two domains is not $1,450 plus a small increment. At list it is $2,610.

There is a trap here worth naming. GlobalSign's own published VMC Application Process Guide, the PDF still linked from their shop, states $499 per additional domain. The live shop charges $1,160. That guide is Version 1 and the figure is stale. Budget off the shop's Calculate button, not the PDF, or you will be short by roughly $660 per domain.

On the CMC: a Common Mark Certificate needs no trademark, only a logo you have used for 12 months or more. It puts your logo in the inbox, but it does not get you the blue checkmark. If the checkmark is why you are buying, a CMC is not a cheaper VMC. It is a different product.

Why street price is well below list

GlobalSign sells direct and through a reseller channel, and the two prices are not the same. Their reseller program lets partners set their own retail price on every certificate they sell. Partner cost falls as they deposit funds or buy in bulk. One published tier moves a partner to a 12 percent discount over standard pay-as-you-go pricing after adding $785 to their account, and larger partners sit well below that.

So $1,450 is a ceiling, not a market rate. We bought our own GlobalSign VMC through a reseller and paid about $780 for the year, roughly 45 percent under list. Same Certificate Authority, same vetting team, same certificate.

Two cautions. Reseller catalogues change, and the issuer a given reseller carried last quarter may not be the one they carry now. Many listings say only "VMC" without naming the CA, so confirm which Certificate Authority is behind the SKU before you pay. Second, a reseller does not shorten or soften the vetting. You still deal with GlobalSign's team. The reseller is a billing layer, not an advocate.

The application, step by step

New customers start on the GlobalSign shop page, pick a currency and region, and create a GlobalSign Certificate Center account, GCC for short. Existing customers go to SSL Certificates and then Verified Mark Certificates inside GCC. From there the flow runs like this.

• Choose whether to add SANs. Say yes only if you need extra domains, then enter how many. The Calculate button shows your total before tax.
• Enter organization details, including a VAT or GST number and a business directory ID.
• Nominate Point of Contact #1. Every official communication from GlobalSign goes to this person, so do not use an address nobody watches.
• Submit a CSR. A Certificate Signing Request is a text block you generate with a tool like OpenSSL, carrying your domain plus organization, country, state and locality. GlobalSign shows you a parsed version to confirm before you continue.
• Upload the SVG logo and the trademark data. Mark Type is Registered Mark. You supply the trademark identifier, which is the registration number, plus the country and the office it is registered with.
• Enter your additional SAN domains, if you chose that option.
• Confirm the summary of domains requested.
• Pick a business category: Private Organization, Business Entity, Non-Commercial Entity or Government Entity. Most incorporated companies are Private Organization. Sole proprietorships, general partnerships and unincorporated associations are Business Entity.
• Give your incorporation agency or corporate registration number. This field can also be left blank for the vetting team to locate.
• Pay, review the summary page, and accept the subscriber agreement.
• Complete domain verification with the code GlobalSign emails you and shows on screen.
• Wait on vetting. GlobalSign verifies the domain, the organization, and the logo against the trademark record. The certificate then arrives by email as a PEM file.

The logo file is where applications actually stall

The SVG is the most common failure point, and it fails in ways that look like nothing is wrong. GlobalSign requires SVG Tiny Portable/Secure, a deliberately restricted profile of SVG. Ordinary SVG exported from a design tool will not pass.

• Base profile set to tiny-ps, not tiny
• 32 KB hard maximum, with GlobalSign recommending you stay under 16 KB
• Square dimensions, 258 by 258
• A title element carrying your company name
• No scripts, no external references, no extensions
• Line endings must be LF only. A single CRLF pair fails the check.

The logo rule that is not technical

The image you upload has to be the mark as registered. Not a refreshed version, not the one with the tagline removed, not this year's colours. Vetting compares your file against the trademark office record.

If your live brand has drifted from the registered mark, and plenty have, you do not have a certificate problem. You have a trademark problem, and it has to be solved first. That usually means registering the current mark and waiting out the office's timeline, which runs in months.

After issuance

The PEM file goes on a public web server, served over HTTPS. Then you publish or update your BIMI DNS record so the l= tag points at your SVG and the a= tag points at your certificate.

Gmail does not pick this up instantly. Expect it to appear over days rather than minutes, and test with a fresh message rather than one already sitting in a thread, because existing threads cache the old sender presentation.

When we tell people not to buy

Some honest disqualifiers. Any one of these means a VMC is the wrong purchase right now.

• No registered trademark with an accepted office. Either pursue a CMC for the logo without the checkmark, or file the trademark and accept that it takes many months.
• DMARC not at enforcement, or only just moved there. Wait out the 30 days. Applying early burns the fee.
• Trademark renewal inside six months. Renew first.
• Low email volume. If you send a few hundred messages a month and none of it is marketing, $1,450 a year buys very little visibility.
• Several sending domains. At $1,160 per extra domain, consolidate onto one sending domain before you buy. That is cheaper and better for deliverability regardless.

Working with us

We ran this entire stack on our own business first. A GlobalSign VMC bought through a reseller, BIMI live in Gmail with the checkmark, then Apple Branded Mail, and Meta Verified on a 52,000-follower Instagram account. We know the specific failure points because we hit them. We work only through official channels, we never take passwords, government ID documents, or card numbers, and if we look at your setup and do not believe a certificate will be issued, we say so and decline the work rather than take the fee. Platforms make the final call on every application, and nobody can promise otherwise.