SignumeWhat Is a VMC (Verified Mark Certificate) and How Do You Get One?
A Verified Mark Certificate puts your trademarked logo, and Gmail's blue checkmark, in the inbox. Here's what a VMC is, what it requires, and how to get one.
If you've noticed a small logo, and sometimes a blue checkmark, sitting next to certain senders in Gmail, you've seen a Verified Mark Certificate at work. A VMC (Verified Mark Certificate) is the credential that lets a brand display its registered logo beside the emails it sends, and in Gmail it unlocks the verified blue checkmark next to the sender name.
This guide explains what a VMC actually is, the requirements to qualify, and the steps to get one, without the jargon.
What a VMC is (and isn't)
A VMC is a digital certificate, similar in spirit to the SSL/TLS certificate that secures a website, but instead of proving you control a domain, it proves you own the logo you want to display in email. It's issued by a small set of Certificate Authorities that have been authorized to act as Mark Verifying Authorities, and it works together with an email standard called BIMI (Brand Indicators for Message Identification).
The mental model worth keeping: BIMI is the mechanism that tells inboxes where to find your logo, and the VMC is the proof that you're allowed to use it. Neither is an email itself; they're the trust layer that sits on top of the mail you already send.
Why brands want one
Three reasons come up again and again:
- Recognition. Your logo appears next to every message, so recipients spot you instantly instead of a grey circle with an initial.
- Trust and anti-spoofing. A verified logo is hard to fake, which makes it a visible signal that the email is genuinely from you, not a phishing attempt wearing your name.
- Engagement. Independent studies have reported meaningfully higher open rates and stronger brand recall when a verified logo is present.
In Gmail specifically, a VMC also earns the blue checkmark, currently the most recognizable "this brand is verified" indicator in the inbox. (Curious which other providers show your logo? See our guide on which email providers support BIMI.)
The requirements to qualify
Getting a VMC isn't just buying a certificate. You have to meet a few prerequisites first. Here are the four that matter most.
1. A registered trademark for your logo
This is the defining requirement. Your logo must be a registered trademark with an accepted intellectual-property office. The list of accepted offices is specific. It includes the EUIPO (European Union), the UK IPO, Germany's DPMA, the USPTO, and a handful of others, and it's what separates a VMC from the cheaper alternative below.
The logo you submit has to match the registered trademark exactly. This trips people up more than jurisdiction does: if you've refreshed your logo since you registered it, that mismatch, not your geography, is usually the thing to fix. (If you email internationally, don't worry that a regional trademark limits you: see does an EU or UK trademark work globally.)
2. DMARC at enforcement
Your sending domain needs DMARC configured at an enforcement policy, either p=quarantine or p=reject. DMARC is an email-authentication protocol that tells receiving servers what to do with mail that fails verification, and no VMC will display your logo until it's at enforcement. This is the single most common place BIMI projects stall, so it's worth getting right early. As a bonus, moving DMARC to enforcement typically improves deliverability and cuts spoofing on your domain.
3. A compliant SVG logo
Your logo has to be supplied as a square SVG conforming to a specific profile (SVG Tiny P/S). Most brands don't have this ready, so converting and validating the file is part of the work.
4. Identity verification
Because the whole point is trust, the Certificate Authority verifies who you are, including confirmation of the applicant, along the lines of the strict validation used for Extended Validation certificates. Expect a notarized or video identity step.
Don't have a trademark? The CMC route
If you don't hold a registered trademark, there's a newer alternative: a CMC (Common Mark Certificate). Instead of a trademark, a CMC requires proof that your logo has been in continuous public use for at least 12 months. The trade-off is important: a CMC will display your logo in Gmail, but it won't earn Gmail's blue checkmark, which remains exclusive to the VMC path. It also isn't accepted everywhere a VMC is.
How to get a VMC, step by step
- Confirm your trademark. Check that your logo is registered (or start registration) with an accepted office such as the EUIPO or UK IPO, and that the mark matches the logo you'll display.
- Get DMARC to enforcement. Align SPF and DKIM, then move your DMARC policy to
p=quarantineorp=reject. - Prepare the SVG. Produce a square, spec-compliant SVG Tiny P/S version of your logo.
- Apply to a Certificate Authority (a Mark Verifying Authority) and complete identity verification.
- Publish your BIMI record in DNS, pointing to your SVG logo and the issued certificate.
- Maintain it. A VMC is valid for roughly a year (about 397 days) and must be renewed. If it lapses, the logo, and the Gmail checkmark, disappear immediately.
What it costs and how long it takes
Pricing varies by Certificate Authority and reseller, typically landing in the several-hundred to ~€1,750 per-year range for the certificate itself, plus any trademark costs if you don't already have one. Timelines run from a couple of weeks (if your trademark and DMARC are already in place) to many months (if you're registering a trademark from scratch, which is usually the long pole).
Let someone handle it
Each of these steps is individually straightforward and collectively fiddly: trademark matching, DMARC enforcement across every sending system, SVG conversion, CA validation, DNS, and ongoing renewals. That's exactly the bundle Signume manages for you, end to end, for the EU and UK market.
Frequently asked questions
Do I need a trademark to get a VMC? Yes. A registered trademark from an accepted office is required for a VMC. Without one, you can use a CMC to show your logo, but not the Gmail blue checkmark.
Is a VMC the same as the blue checkmark? Not quite. The VMC is the certificate; in Gmail it unlocks the blue checkmark. Other inboxes may show your logo from the same VMC without displaying any checkmark.
How long does a VMC last? About 397 days. It must be renewed annually, and if it expires the logo stops displaying immediately.
Which Certificate Authorities issue VMCs? A small set of authorized Mark Verifying Authorities, including DigiCert, GlobalSign, Sectigo, and SSL.com.
Related guides
BIMI vs VMC: What Is the Difference?
BIMI is the standard that tells inboxes where to find your logo. A VMC is the certificate that proves the logo is yours. Here is how the two fit together.
Can One VMC Cover Multiple Domains and Subdomains?
One VMC covers one logo, but it can protect several domains and subdomains. Here is how coverage works, and when you genuinely need a second certificate.
BIMI, VMC & CMC: Which Email Providers Show Your Logo (and the Checkmark)?
Not every inbox treats BIMI the same. Here's which providers show your brand logo, which add Gmail's blue checkmark, and which show nothing at all in 2026.