VMC Certificate Cost in 2026: Every Issuer Compared

What a VMC costs right now

A Verified Mark Certificate (VMC) is the file that puts your logo, and in Gmail a blue checkmark, next to your name in the inbox. Here is the direct list price for a one-year term at every authority issuing today. Each figure came off that vendor's own order page on 27 August 2026, in US dollars.

The whole spread on a one-year VMC bought direct is $302. Whatever else drives this decision, the sticker price is not where the money is won or lost. The sections below are where it is.

• DigiCert: VMC $1,752 per year, CMC $1,416 per year, on a 12-month auto-renewing subscription
• Sectigo: VMC $1,500 per year, CMC $1,100 per year, with up to 20% off on multi-year terms
• SSL.com: VMC $1,500 per year, falling to $1,350 on a 2-year term and $1,275 on a 3-year term. CMC $1,150, falling to $1,035 and $977.50
• GlobalSign: VMC $1,450 per year, CMC $1,035 per year

Four authorities are issuing, not three

The BIMI Group maintains the industry directory of mark certificate issuers. As of today it names three: DigiCert, GlobalSign and SSL.com. Sectigo is not on it. Sectigo is issuing anyway.

You can check this yourself without taking anyone's word for it. TJX publishes a BIMI record at default._bimi.tjx.com pointing to a certificate file. Fetch that file and read its chain, and the issuing authority is Sectigo Limited VMC Issuing RSA CA 1, with the certificate valid from 11 August 2026. Sectigo's own domain serves a certificate from the same issuing CA. Both are current, both are live, and neither is reflected in the directory.

There is a wrinkle worth understanding, because it explains the gap. That Sectigo issuing CA chains upward to a root named SSL.com VMC RSA Root CA 2024. Sectigo runs a subordinate mark certificate authority underneath SSL.com's root program. The directory entry for SSL.com covers the trust anchor. The company that validates you, issues to you and bills you is Sectigo, and it sells VMCs and CMCs from its own site.

Entrust is a different story. Kohl's still serves an Entrust-issued VMC dated November 2024, though it expired in November 2025, so old Entrust files stay published on the web long after they stop validating. Entrust sold its public certificate business to Sectigo, and Sectigo announced the migration complete on 25 September 2025. Entrust does not appear in the issuer directory. If you are holding an Entrust mark certificate, Sectigo is where that product line went.

The CMC is cheaper, and it does not get you the checkmark

A Common Mark Certificate (CMC) is the option for a logo you have not registered as a trademark. It carries your logo into the inbox at participating providers. Google's Workspace documentation is explicit that the Gmail checkmark goes to senders verified with a VMC, not a CMC.

Subtract one from the other at each issuer and you get the price of the checkmark: $336 at DigiCert, $350 at SSL.com, $400 at Sectigo, $415 at GlobalSign. Somewhere between $336 and $415 a year buys the visual difference between a logo and a verified logo.

The catch is that price may not be what decides it. A VMC requires a trademark that is already registered. GlobalSign's prerequisites for a CMC instead require a logo that has been in use for more than 12 months, and SSL.com states the same 12-month active-use test. If you have no registered mark, the CMC is not the thrifty choice. It is the only certificate you can buy this year.

Resellers are genuinely cheaper, and the headline price has a catch

Certificate authorities sell through resellers, and the discounts are real. SSL2BUY lists a product it calls the Prime VMC and describes as GlobalSign-powered. Its configurator prices it at $900 per year on a one-year term, $840 per year on two years, and $780 per year on three.

That $780 is the number in the page title and the marketing headline. It is the three-year rate. Choose it and the cart totals $2,340, charged up front. Against GlobalSign's own $1,450, the honest one-year comparison is $900 versus $1,450, which is still a substantial saving, just not the one advertised.

The same reseller lists a DigiCert VMC from $1,200 against DigiCert's own $1,752, and a DigiCert CMC from $950. The GlobalSign-powered Prime CMC is cheaper still at $650.

What you get is the same certificate. Validation is performed by the certificate authority, not the reseller, and the file that lands in your DNS is issued by and chains to the CA. What you give up is the direct support relationship when validation stalls. We bought the certificate for our own store, Bench Clearers, through a reseller rather than direct, and the certificate serving on that domain today is issued by GlobalSign.

A second domain costs nearly as much as the first

This is the line item that can wreck a budget, because nothing about the phrase "additional domain" prepares you for the number.

Mark certificates are tied to a domain. DigiCert's guidance is that you need one certificate per unique base domain and one per unique logo. SSL.com states that each sending domain requires its own VMC.

GlobalSign is the one issuer that publishes an additional-domain price alongside the base price. A second domain on a VMC is $1,160. On a CMC it is $828. Both are exactly 80% of the base certificate.

At the reseller level it is steeper. Adding a single SAN to the Prime VMC moved the three-year cart total from $2,340 to $4,680, and the configurator itemizes that SAN at $780.00 per year. On that product, the second domain costs precisely what the first one costs.

If you send customer mail from three domains, price three certificates and treat anything cheaper as a pleasant surprise.

Three bills that arrive before the certificate does

The certificate price is the part everyone quotes. These three are the part that decides whether you get one at all.

First, the trademark. A VMC requires a registered mark, and registering one is its own project. The USPTO base application fee has been $350 per class since the fee restructure took effect on 18 January 2025. Surcharges stack on top: $100 per class if required information is missing, $200 per class for writing your own goods and services description instead of using the ID Manual, and $200 for each additional 1,000 characters beyond the first. DigiCert accepts marks from seventeen intellectual property offices, so the USPTO is not your only route if you operate elsewhere. The fee is the small part. The calendar is the large part, and the USPTO's published targets for the current fiscal year are a first action within 5 months and total pendency of 11 months or less on average. No issuer will validate against a pending application.

Second, the logo file. BIMI requires SVG Tiny Portable/Secure, which is a restricted profile of SVG rather than the format your designer exports by default. The file must be 32 kilobytes or less, declare baseProfile as tiny-ps and version as 1.2, carry a title element, and contain no scripts, no animation, no interactivity, no external references, and no x or y attributes on the root element. BIMI Group's own guidance suggests exporting SVG Tiny 1.2 from Illustrator and then manually stripping the x and y attributes Illustrator adds. No certificate authority charges a fee for this. It costs an hour of competent hands or a small design invoice, and a malformed file stalls an application that has already been paid for.

Third, DMARC. BIMI requires your DMARC policy to be at enforcement, meaning p=quarantine or p=reject, with pct set to 100 and the subdomain policy matching. Google requires the same p and pct values. GlobalSign asks that the policy be in place 30 days before you apply. This is the work that cannot be rushed. A policy at enforcement instructs receiving servers to quarantine or reject mail that fails authentication, and if a legitimate sending service has not been authorized first, that includes your own invoices and password resets. Read your aggregate reports, authorize every sender, then move the policy. Budget weeks.

• Trademark registration: $350 per class at the USPTO, plus surcharges, plus a timeline measured in months
• SVG Tiny PS conversion: no vendor fee, but a real task with a 32 KB ceiling and a strict element list
• DMARC at enforcement: no vendor fee, and a requirement that can hold up an otherwise funded application

What a realistic first year adds up to

Three situations, three very different totals.

You already hold a registered design mark and your DMARC is already at p=quarantine or p=reject with pct=100. Your cost is the certificate and an hour on the SVG. That is $900 for one year through a reseller, or $1,450 direct from GlobalSign as the lowest direct list price. This is the cheap case, and it is cheap because the expensive work is already behind you.

You hold a registered mark but your DMARC sits at p=none. The certificate costs the same. The calendar does not. Add the DMARC project before you order anything, and treat GlobalSign's 30-day expectation as a floor rather than a target.

You have no registered trademark. Filing is $350 per class, and then you wait on the USPTO before any VMC can be issued. In the meantime a CMC at $1,035 to $1,416 will put your logo in the inbox at supporting providers, and it will not carry the Gmail checkmark. That is a legitimate interim purchase or a legitimate reason to wait, depending on how much your logo in the inbox is worth to you.

When the honest answer is not yet

A mark certificate is a recurring annual cost that buys a logo and, with a VMC, a checkmark. It does not improve authentication, because your authentication has to be correct before the certificate can exist.

So if your DMARC is not at enforcement, that is the work worth doing first, and it costs nothing but attention. If you send a low volume of mail, the visibility you are buying is proportionally smaller. If your logo is not a registered mark and you have no intention of filing, a CMC is your ceiling, and you should decide whether a logo without a checkmark justifies four figures a year.

We will tell you when we think a certificate is the wrong purchase. That conversation is cheaper for both of us than a stalled application.

Working with us

Verified Everywhere is run by JWC Apps in San Diego. We built this stack on our own business first: our hockey apparel store holds a VMC issued through GlobalSign, runs DMARC at p=reject, and shows the verified logo and checkmark in Gmail. We work only through each platform's official channels, we screen the job before quoting, and we will decline work we do not believe can succeed. If you want a second opinion on which certificate you actually need, or on whether your DMARC is ready to support one, that is a good place to start.