The VMC Validation Process: What to Expect Step-by-Step

Obtaining a Verified Mark Certificate (VMC) requires rigorous manual identity and legal verification by a licensed Certificate Authority (CA) before issuance.

Unlike standard domain-validated (DV) SSL certificates that issue automatically within minutes, VMCs use Extended Validation (EV) level verification standards to protect email ecosystems against identity fraud.

Overview of the 5 validation phases

The entire issuance process typically takes between 5 to 10 business days, provided all documentation and trademark filings are in order.

Phase 1: Trademark & Domain Ownership Audit

The CA queries government intellectual property databases (such as USPTO, EUIPO, or BOIP) to verify that:

• The trademark registration is active and fully granted.
• The applicant organization matches the registered trademark owner named in the official IP record.
• The applicant controls the DNS for all domains listed on the certificate application.

Phase 2: Organization & Legal Entity Verification

The CA checks official corporate registry databases (such as the KvK in the Netherlands, Companies House in the UK, or Secretary of State records in the US) to confirm:

• The organization is legally active and in good standing.
• The physical address and operational phone numbers match official records.

Phase 3: Identity Verification (In-Person or Video Call)

To prevent unauthorized employees or bad actors from claiming certificates:

• A designated representative (Applicant) must complete identity verification.
• Depending on jurisdiction, this is completed via a live video verification session with a CA specialist or through a notarized identity declaration form signed by an authorized corporate officer.

Phase 4: Technical Logo Inspection

The CA inspects the submitted SVG file to confirm:

• The visual elements match the registered trademark file identically.
• The vector code complies fully with SVG Tiny PS security rules.

Phase 5: Issuance & Hosted Chain Delivery

Once approved, the CA issues the VMC as a Privacy-Enhanced Mail (.pem) certificate file, which is hosted on a public HTTPS web server and referenced in your BIMI DNS record.

Common roadblocks that delay validation

• Discrepancies in Legal Business Names: If your corporate registry lists "Company B.V." but your trademark filing lists "Company Inc.", the CA will require legal proof of transfer or name change before proceeding.
• Unreachable Listed Contacts: CAs use independent third-party telephone directories to call the corporate main line. If reception cannot route the verification call to the authorized contact, validation stalls.
• Vector Formatting Errors: Submitting standard web SVGs instead of validated SVG Tiny PS files causes automated validation failures.

How Signume pre-validates your application

Signume reviews your corporate registration details, IP filings, and vector graphics prior to submitting your application to the CA, resolving discrepancies early to ensure fast certificate issuance.

Frequently asked questions

Who can act as the authorized representative for our VMC application? An authorized officer of the company (such as a Director, VP, or C-level executive) or a designated IT/security lead who has explicit written authorization from an officer.

How long does the VMC validation process take? When documents, DMARC alignment, and trademarks are verified in advance, certificate issuance typically takes 3 to 7 business days.

What happens when our VMC needs annual renewal? Because organization identity and trademark validity must be re-confirmed every 397 days, renewals undergo an expedited re-verification check to issue an updated certificate file.