VMC (Verified Mark Certificate)

A Verified Mark Certificate (VMC) is a special-purpose certificate used with BIMI. It embeds the organization's logo as an SVG image in the SVG Tiny Portable/Secure profile inside a logotype extension, together with the verified organization identity and trademark registration details. It is signed by a CA that has checked that the logo is a registered trademark owned by the applicant. A VMC cannot be used for TLS or for signing email.

Why it matters

Mailbox providers that support BIMI, Gmail among them, only show a sender's logo when they can trust that the logo belongs to the sender. The VMC provides that proof: the domain's BIMI DNS record points to the VMC file, and the provider checks the certificate chain and compares the embedded logo. The domain must also enforce DMARC with a quarantine or reject policy for the logo to appear. Only a small number of CAs issue VMCs, and the vetting resembles EV identity checks plus trademark verification.

Example

default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

The a= tag points to the VMC, published as a PEM file containing the certificate and its chain.

Common misconceptions

• A VMC secures my website. It has no role in HTTPS; it only supports logo display in email.
• Any logo can be used. The logo must match a trademark registered with an office the CA accepts.
• A VMC guarantees the logo will show. Each mailbox provider decides whether to display it, based on authentication results and its own policies.