VMC vs CMC certificates: BIMI cost and requirements (2026)
A practical buyer's guide to VMC and CMC certificates for BIMI in 2026. Covers trademark vs prior-use paths, current prices, authorized issuers, and the Gmail checkmark distinction.
You’ve set DMARC to p=reject, aligned SPF, and DKIM-signed your mail. The last step to show your logo in Gmail, Yahoo, and Apple Mail is a mark certificate. Two types exist: a VMC (Verified Mark Certificate) and a CMC (Common Mark Certificate). The difference that matters most is what they actually do in Gmail’s inbox, and what they cost to get there.
BIMI in 30 seconds: why does a certificate exist?
BIMI (Brand Indicators for Message Identification) lets email clients display a sender’s logo next to the message. Without independent verification, inbox logo display would be trivially abused for phishing: any domain operator could host an SVG and claim it represents their brand.
A mark certificate solves this. It is an X.509 certificate containing your company’s legal identity, a cryptographic fingerprint of your SVG logo, and (for VMCs) a verified trademark reference. It is issued by an accredited authority. Mail clients that support BIMI check for a valid certificate before showing the logo.
Without a certificate, Gmail ignores your BIMI DNS record. For a technical breakdown of the record structure and certificate format, see Understanding BIMI.
VMC vs CMC at a glance
| VMC | CMC | |
|---|---|---|
| Full name | Verified Mark Certificate | Common Mark Certificate |
| Registered trademark required | Yes (USPTO, EUIPO, WIPO, etc.) | No |
| Logo eligibility | Registered trademark | In public use on your domain for 12+ months |
| Gmail blue verified checkmark | Yes | No |
| Logo display in Gmail / Yahoo / Apple Mail | Yes | Yes (Gmail and select providers) |
| Typical list price/year | ~$1,752 list; resellers from ~$749 | ~$1,416 list; resellers from ~$649 |
| Authorized issuers (as of June 2026) | DigiCert, GlobalSign, SSL.com | DigiCert, GlobalSign, SSL.com |
| Validation time | 2 to 6 weeks | Typically faster (no trademark check) |
The BIMI Group maintains the official issuer list. Each mailbox provider independently decides which issuers it accepts, so verify issuer acceptance with your target inbox providers before buying.
The Gmail checkmark: VMC and CMC are not equivalent
Both certificate types make your logo appear in Gmail’s sender column. Only a VMC adds Gmail’s blue verified checkmark next to the sender name. That checkmark tells recipients the sender’s identity was validated against a registered trademark. A CMC does not produce the checkmark, regardless of how long your logo has been in use.
For B2B, financial services, and consumer SaaS, the checkmark usually matters. A VMC is the only way to get it. For everyone else, a CMC is cheaper and faster.
What a VMC certificate contains
A VMC is a specialized X.509 certificate with a BIMI extension. It contains:
- Your company’s legal identity (as registered with the business registry)
- A cryptographic fingerprint of your BIMI SVG logo file
- Your trademark reference (registration number with USPTO, EUIPO, WIPO, or a recognized national office)
- The public key used to verify the certificate signature
- The issuing CA’s signature
See VMC and CMC certificates explained for the full certificate format.
Eligibility checklist
Prerequisites for both VMC and CMC
- DMARC at
p=quarantineorp=reject(monitoring modep=nonedoes not qualify; if your record still carries the legacypcttag, removed by RFC 9989, it must be 100) - SVG logo in SVG Tiny PS format (no JavaScript, no external references, no forbidden tags)
- Your company must legally exist and pass CA identity validation
VMC: the trademark path
- A registered trademark on your logo with a recognized office (USPTO, EUIPO, WIPO, INPI, etc.)
- The SVG logo must match the registered trademark image
- Documents proving trademark ownership and company incorporation
CMC: the prior-use path
- Your logo must have been in public use on your domain for at least 12 months
- Proof via archive.org is the standard evidence
- A notarized identity document or video interview with the CA’s validation team
- Note: DigiCert’s CMC also accepts a modified registered trademark as an alternative to the 12-month use requirement
Cost breakdown
Certificate fees
List prices as of June 2026. Reseller and multi-year pricing is typically lower.
| Certificate | DigiCert (list) | GlobalSign | SSL.com |
|---|---|---|---|
| VMC | ~$1,752/yr | Contact for pricing | Contact for pricing |
| CMC | ~$1,416/yr | Contact for pricing | Contact for pricing |
Sectigo also sells mark certificates (VMC around $1,350/yr, CMC around $990/yr on its product pages, with resellers such as vmccerts.com listing them from $749 and $649) and took over Entrust’s certificate business in 2025. As of June 2026, however, Sectigo does not appear on the BIMI Group issuer list. Mailbox providers decide which issuers they accept, so confirm with your target providers that a Sectigo-issued certificate will display before buying one.
Trademark registration (VMC only, if you don’t have one yet)
| Office | Base cost | Classes |
|---|---|---|
| USPTO (USA) | $350 per class | One class covers one category |
| EUIPO (EU) | €850 for first class | Covers all 27 EU member states |
| WIPO Madrid | Variable | Covers multiple countries in one filing |
Timeline: 6 to 12 months from application to registration, sometimes longer. If you already hold a registered trademark, this cost is zero.
SVG conversion
The logo must be SVG Tiny PS. PNG files do not work. Our free BIMI SVG Tiny PS Converter converts a clean SVG to the required format and validates compliance before you submit to a CA. You can also generate your BIMI DNS record once your certificate is issued.
Is there a free VMC?
No. No CA issues a free VMC or CMC. Promotional pricing, resellers, and multi-year terms bring the cost down, but it does not reach zero.
The one genuinely free logo option is Apple Branded Mail through Apple Business Connect. After Apple verifies your business, your logo and company name appear in Apple Mail and iCloud Mail without any certificate. You do need DMARC at p=quarantine or p=reject, DKIM signing, and domain verification via Apple’s portal. The catch is that it works only in Apple Mail. Gmail and Yahoo are unaffected, and Apple Branded Mail is not part of the BIMI standard.
Does Gmail require a VMC?
Gmail shows your logo with either a VMC or a CMC, provided DMARC enforcement is in place. The difference: a CMC gets you logo display; a VMC gets you logo display and the blue verified checkmark next to the sender name. Yahoo Mail supports both. Apple Mail supports BIMI with VMC.
FAQ
VMC vs CMC: which should I get?
If you have a registered trademark, get the VMC. The price premium over a CMC is small relative to the trademark itself, and you get the Gmail blue checkmark. If you don’t have a trademark and don’t plan to register one, a CMC is the practical choice. It costs less, validates faster, and still gets your logo into Gmail and Yahoo.
Can I get a BIMI logo without a trademark?
Yes, with a CMC. Your logo must have been in continuous public use on your domain for at least 12 months, verifiable via archive.org. DigiCert also accepts a modified registered trademark under its CMC program.
How much does a VMC cost?
List prices from authorized CAs range from approximately $1,350 to $1,752 per year as of June 2026. Resellers may offer lower prices, and multi-year subscriptions reduce the annual rate. Trademark registration adds $350 or more if you don’t already hold one.
Does a CMC get the Gmail blue checkmark?
No. The Gmail blue verified checkmark appears only when a VMC is present. A CMC displays your logo in Gmail but not the checkmark.
How long does validation take?
VMC validation typically takes 2 to 6 weeks. The CA has to verify your company’s legal existence, trademark ownership, and SVG logo compliance. CMC validation skips the trademark check, so it runs faster, but a live video interview with the CA is still part of the process.
My current logo is a PNG. Does that work?
No. BIMI requires an SVG Tiny PS file. Use our BIMI Tiny PS Converter to prepare a compliant file before applying.
What happened to Entrust certificates?
Entrust sold its public certificate business to Sectigo in January 2025. VMC issuance from Entrust Certificate Services ended on May 12, 2025. Existing Entrust customers were migrated to Sectigo Certificate Manager by September 2025. If you held an Entrust VMC, your certificate remains valid until expiry; renewals now go through Sectigo.
Order your VMC or CMC from DMARCTrust
From your DMARCTrust dashboard, select your domain and upload your SVG logo. We validate BIMI compliance before submitting to the CA and handle CA communication on your behalf, so you never need an account with them. Once issued, the certificate is hosted automatically. We generate the final BIMI DNS record for you to copy into your DNS.
Before ordering, confirm your DMARC policy is at enforcement with our free DMARC checker.
