VMC Vs CMC: Which BIMI Certificate Do You Actually Need?

Introduction

Your DMARC policy is finally at reject, the logo passes every SVG check, and the last step on the list says "get a VMC". The first certificate authority you ask wants a trademark registration number. You do not have one, or your application is still pending, or the registered version of your logo looks nothing like the one on your website. Then someone mentions a CMC, and it is not clear what you would be giving up.

Here is the short answer to VMC vs. CMC. A Verified Mark Certificate (VMC) proves your logo is a registered trademark or a government mark. A Common Mark Certificate (CMC) proves the right to use a logo without that registration, most often by showing it appeared on your own website at least 12 months ago. Gmail accepts both for BIMI and adds a checkmark only with a VMC. If you have a registered trademark that matches your logo, a VMC gives you more; if you do not, a CMC is the way to get your logo into Gmail.

What A Mark Certificate Does In BIMI

Anyone can publish a BIMI record pointing at any logo. The certificate is how a mailbox provider knows the logo belongs to the organisation that owns the domain. A certification authority checks your identity, your control of the domain and your right to the mark, then issues a certificate that embeds the logo itself. You host the certificate as a PEM file and reference it with the a= tag of your record.

Whichever side of VMC vs. CMC you land on, both types follow one rulebook, the BIMI Group's Minimum Security Requirements for Issuance of Mark Certificates, version 1.8 at the time of writing. The section numbers below refer to it.

VMC Vs CMC Side By Side

The Gmail rows come from Google's Set up BIMI page, the Apple row from BIMI support in Apple Mail, and the Yahoo row from the Yahoo Sender Hub FAQ, which lists its BIMI conditions without any certificate. Apple's page does not say CMCs are refused; it simply does not mention them, so treat Apple Mail support for a CMC as unconfirmed.

The Verified Mark Certificate In Detail

A VMC has two forms: one for a Registered Mark and one for a Government Mark. A Registered Mark is one registered by at least one trademark office recognised by WIPO, and it must be in good standing (§3.2.17.1.1). You give the CA the registration number, the office, and your logo as an SVG. The CA then confirms three things:

1. The registration is real and current, in the trademark office's database or WIPO's Global Brand Database.
2. You own it, or hold a licence. If the owner is a different company, the CA needs an authorisation letter from the owner of record (§3.2.17.1.2). A licensee's certificate cannot outlive the licence (§6.3.2).
3. The SVG matches the registered mark. Only small changes are allowed, such as stacking or splitting the words of a word mark (§3.2.17.1.3).

That last check is where many applications stall. If you registered a black and white version years ago and now use a coloured logo with a different arrangement, the CA compares against the registration, not your website.

The Common Mark Certificate In Detail

Version 1.8 of the requirements lists three kinds of CMC. Most people asking about them mean the first.

Prior Use Mark

For a logo with no registration at all. The CA verifies that the logo is on a website at a domain you control today, and that the same logo appeared on that same domain at least 12 months before verification, using archive.org as the approved archive source (§3.2.16.1). In practice, check the Wayback Machine for your homepage a year ago before you apply. A logo you redesigned eight months ago will not qualify yet, and a logo that only lived on a different domain will not either.

Modified Registered Mark

For a registered mark you display differently. The CA verifies the registration as it would for a VMC, then accepts a representation with limited changes: words moved relative to the design, up to 49% of the design element removed without altering the rest, and any font or colour against a coloured or patterned background (§3.2.16.2). This is the route when your registration is the old black and white version.

Provisional Mark

For a mark registered at least three years before the request, where the logo you submit may differ from the registered representation (§3.2.16.3). It is newer and less discussed than the other two, so ask the CA whether it offers it.

How To Choose Between A VMC And A CMC

Most VMC vs. CMC decisions come down to one question: do you hold a trademark registration that matches the logo you want to show?

• You hold a registered trademark that matches your current logo: get a VMC. It covers Gmail with the checkmark and is the evidence Apple names.
• You hold a registration, but the logo has changed: ask about a Modified Registered Mark CMC, or file the new design and use a CMC in the meantime.
• You have no registration and the logo has been on your site for a year: a Prior Use Mark CMC gets your logo into Gmail.
• Your trademark application is pending: it is not yet a Registered Mark under the requirements' definition, so it cannot support a VMC. A CMC may bridge the gap.
• You only care about Yahoo: its guidance mentions no certificate, but Gmail will show nothing without one.

After The Certificate Is Issued

Host the PEM file over HTTPS, then add its address to your record as a=. Host the exact SVG that went into the certificate at l=, and leave it alone: if a designer later replaces the hosted file with a tweaked version, the two no longer match. Put the renewal in your calendar, because a mark certificate lasts at most 398 days (§6.3.2), and an expired one stops the logo in Gmail.

Mark Certificate Questions

Do I Need A VMC For BIMI?

Not always. Gmail needs a mark certificate, but it accepts a CMC as well as a VMC. Yahoo's BIMI guidance does not mention a certificate at all. Apple's documentation names a VMC as its example of the evidence required. Outlook does not support BIMI, so no certificate helps there.

Does A CMC Get The Blue Checkmark In Gmail?

No. Google's documentation says Gmail shows a checkmark next to senders verified with a VMC. A CMC still shows your logo in the avatar slot, without the checkmark. If the checkmark matters to you, you need a trademark registration that matches your logo, or one the requirements allow you to modify.

Can I Get A VMC With A Pending Trademark?

No. The requirements define a Registered Mark as one registered by at least one trademark office, and a VMC needs a registration in good standing. While the application is pending, a Prior Use Mark CMC is the usual option, provided your logo has been on your own domain for at least 12 months.

How Long Is A VMC Or CMC Valid?

At most 398 days from issue, for both types, under §6.3.2 of the mark certificate requirements. A licensee's certificate cannot run past the end of its licence. Renew before it lapses: an expired certificate fails validation, and Gmail stops showing the logo until a valid one is published.

How Eklow Handles This

The free BIMI record generator builds the record with your certificate's address and, when you run the check, fetches the PEM file and reads it. It reports whether it is a VMC or a CMC, the organisation, the issuer, the mark type, any trademark registration it carries, the expiry date and the domains it covers. It fails a certificate that does not validate, and warns when expiry is 30 days or less away, when your domain is not on it, or when the logo embedded in it differs from the file at your l= address. Run it before you publish, and again after anyone touches the logo.

A certificate only matters for mail that passes DMARC, and that part Eklow watches for you: it checks SPF, DKIM and DMARC on every sending domain before campaigns use it and re-checks verified domains every six hours. If you are still at p=none, why cold email lands in spam is a good place to see where authentication fits among everything else a provider weighs.