VMC or CMC: Which Certificate Does Your Business Actually Need?

Start with the short answer

Two certificates can put your logo next to your name in the inbox. A Verified Mark Certificate (VMC) and a Common Mark Certificate (CMC). They are not interchangeable.

A VMC requires a registered trademark on your logo. It is the only thing that earns the blue checkmark in Gmail, and it is the only certificate Apple Mail honors.

A CMC requires no trademark at all. Instead the certificate authority checks that your logo has been publicly displayed on a domain you control for at least 12 months. Gmail will show your logo. Gmail will not show the blue checkmark. Apple Mail will show nothing.

If you already hold a registered logo trademark, the decision is made. Buy the VMC. The price gap between the two is smaller than most people expect, and the VMC does strictly more.

What neither certificate replaces

Both certificates are the last step in BIMI, not the first. BIMI stands for Brand Indicators for Message Identification. It is the standard that tells a mailbox provider where to find your logo and your certificate.

Before either certificate does anything at all, you need four things in place.

The DNS record itself is a single TXT record and looks like this:

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/mark.pem"

The l= tag points at your logo. The a= tag points at your certificate, VMC or CMC, in PEM format. Leave a= empty and you have a self-asserted BIMI record. Yahoo will still display your logo. Gmail will not.

• A DMARC policy of p=quarantine or p=reject on your organizational domain. p=none does not qualify.
• SPF and DKIM that both pass and both align with the From domain.
• A logo file in SVG Tiny P/S format: version="1.2", baseProfile="tiny-ps", a square viewBox, a solid background, a <title> element, and under 32KB.
• A BIMI DNS record published at default._bimi.yourdomain.com.

VMC: the trademark requirement, precisely

A VMC requires a registered trademark. Three details trip people up here, and all three are worth checking before you spend anything.

It must be registered, not pending. A serial number from a filed application does not qualify. You need a registration number.

It must be a design mark, not a word mark. This is the single most common disqualifier. Plenty of businesses hold a registration on their company name in plain text and assume they are covered. They are not. The VMC certifies a logo, so the registration has to cover the logo as a figurative or design mark.

It must come from an accepted intellectual property office. The BIMI Group's VMC guidelines recognize roughly 17 jurisdictions, including the USPTO, the EUIPO, the UK IPO, IP Australia, CIPO in Canada, the JPO in Japan and KIPO in Korea. A valid registration from an office outside that list will not be accepted, no matter how legitimate it is locally.

One more trap that only shows up at the end. The SVG you publish has to match the registered mark. Not approximately. The certificate authority compares your logo file against the image on the registration, and a recolored, cropped or modernized version of the mark gets rejected. We hit this on our own store. The logo, the registration and the certificate all have to describe the same image.

CMC: the 12-month prior use test

A CMC swaps the trademark requirement for a prior-use requirement. Your logo must have been in active, continuous public use on a domain you own for at least 12 months. The certificate authority verifies this through website history, most often the Internet Archive at archive.org, supported by marketing materials you supply.

The clock runs on the logo, not on the company. A business that has traded for ten years but rebranded four months ago fails this test. So does a business that launched last spring.

Four things quietly break a CMC application, and all four are fixable if you catch them early:

Validation is faster than a VMC. SSL.com quotes three to five business days for a CMC. A VMC typically takes longer because a human has to check the trademark registration and, in most cases, confirm you are the registered owner.

• Your robots.txt blocked the Wayback Machine, so there is no archive to check.
• You redesigned the site inside the 12-month window and the old logo is what the archive captured.
• Your logo is delivered by JavaScript, or as a CSS background image, or inside a sprite sheet, so the crawler never captured it as a visible asset.
• The logo lives on a domain you do not own, such as a marketplace storefront or a social profile.

What each one actually gets you, inbox by inbox

This is where the decision usually gets made, because the answer depends less on your budget than on where your recipients read email.

One caveat on Gmail. A valid certificate makes you eligible for logo display. It does not compel it. Google also weighs sending reputation and volume, and a domain with thin history or spam complaints can hold a perfectly valid VMC and still show nothing for a while. No one can promise you the checkmark. Google decides.

• Gmail with a VMC: your logo in the avatar slot, plus the blue verified checkmark next to the sender name.
• Gmail with a CMC: your logo in the avatar slot. No checkmark. Google added CMC support in 2025 specifically as the no-trademark path, and the checkmark was deliberately kept exclusive to VMC.
• Apple Mail: VMC only. Apple does not accept CMC for BIMI display. Separately, Apple Branded Mail through Apple Business Connect is free, needs no certificate at all, and is worth setting up regardless of which certificate you buy.
• Yahoo and AOL: will display a self-asserted BIMI logo with no certificate whatsoever, as long as DMARC is enforced and your reputation is sound.
• Outlook, Outlook.com, Exchange Online and Microsoft 365: nothing. Microsoft does not honor BIMI records. It runs its own separate sender-logo system that ignores your BIMI DNS record and your certificate entirely. As of August 2026 there is still no announced implementation date.

What they cost

Direct list pricing from the certificate authorities runs roughly $1,400 to $1,800 per year for a VMC. SSL.com publishes CMC pricing openly at $1,150 for a single year, dropping to $977.50 per year on a three-year term. DigiCert prices both in the same broad band and quotes CMC on request.

Resellers cut this meaningfully. We paid around $780 per year for our GlobalSign VMC through a reseller. Same certificate, same certificate authority, same validation process, noticeably less money.

Notice what that pricing implies. The gap between a VMC and a CMC is often a few hundred dollars a year. If you qualify for a VMC, saving that on a CMC costs you the checkmark and costs you Apple Mail. That is a bad trade.

Two cost details people miss. Certificates are issued against specific domains, so if you send from more than one sending domain you are budgeting per domain. And every renewal re-runs validation, so keep the trademark registration current and the logo file unchanged.

The decision tree

Work down this list and stop at the first line that matches you.

• Most of your recipients use Outlook or Microsoft 365. Buy nothing. Neither certificate will display anything to them. Spend the money on DMARC enforcement instead, which improves deliverability everywhere.
• You hold a registered design trademark on your logo, in an accepted jurisdiction, and the logo file matches the registered image. Buy the VMC.
• You have a trademark application pending. Wait for registration, or buy a CMC now if you qualify and upgrade later. Do not buy a VMC against a pending application.
• No trademark, but your current logo has been visible on your own domain continuously for 12 months or more and archive.org can prove it. Buy the CMC. Accept that you get the Gmail logo without the checkmark, and nothing in Apple Mail.
• No trademark, and your logo is newer than 12 months or you rebranded recently. Buy neither, yet. Get DMARC to enforcement, publish a self-asserted BIMI record for Yahoo, set up Apple Branded Mail through Apple Business Connect. All free. Revisit when the 12-month clock is up.
• You send fewer than a few thousand emails a month. Run the math before you spend. A four-figure annual cost against a small list is hard to justify on brand recognition alone.

If you have no trademark, here is what registering one actually involves

Since January 2025 the USPTO charges a single base application fee of $350 per class of goods or services. Surcharges apply if the application is not clean: $100 if required information is missing, $200 for a custom identification of goods or services, and $200 for every additional 1,000 characters of free-form description. Most businesses filing themselves land at $350 to $650 per class. Attorney fees, if you use one, typically add $500 to $1,500.

Time is the harder cost. Current USPTO processing puts assignment to an examining attorney at roughly 8 to 12 months after filing. A clean application with no office action generally reaches registration around 12 to 18 months from filing. An office action, an opposition, or a conflicting mark extends that considerably.

File the design mark, meaning the logo as it appears. If you file only the word mark, you will have spent the money and still not qualify for a VMC. If you are planning a rebrand, do the rebrand first and file the mark you intend to keep.

This is a real decision, not a formality. Eighteen months and a four-figure spend to make a blue checkmark possible is worth it for some businesses and not for others. A CMC now, with a VMC later once the registration issues, is often the sensible sequence.

When the right answer is to buy nothing

We would rather tell you this up front than take a fee for a certificate that sits idle.

If your list is predominantly business recipients on Microsoft 365, the certificate buys you nothing today, and there is no announced date when it will. If you are mid-rebrand, anything you certify now becomes wrong in a few months, and both the logo file and the certificate would have to be reissued. If your DMARC record is still at p=none and your mail streams are not yet fully authenticated, the certificate is premature by several months of work.

And if you are a small sender, be honest about the return. The certificate is a trust signal, not a deliverability fix. It will not rescue a domain with a reputation problem, and it will not lift open rates on its own.

Working with us

We ran this entire stack on our own business first. Bench Clearers, our hockey apparel store, has a GlobalSign VMC, BIMI live in Gmail with the verified checkmark. We know where this process breaks because we hit each of those walls ourselves. We work only through the official certificate authorities and the official trademark offices, we never take your passwords, ID documents or card numbers, and if we do not believe your application can succeed we will tell you that instead of taking the fee.