# What Is VMC (Verified Mark Certificate)? Definition and Examples

> VMC is an X.509 certificate in which a CA verifies that an organization owns a trademarked logo, so mail clients can display it via BIMI.

Source: https://ssl.sh/glossary/vmc/
Last updated: 2026-11-10

A Verified Mark Certificate (VMC) is a special-purpose certificate used with [BIMI](https://ssl.sh/glossary/bimi/). It embeds the organization's logo as an SVG image in the SVG Tiny Portable/Secure profile inside a logotype extension, together with the verified organization identity and trademark registration details. It is signed by a CA that has checked that the logo is a registered trademark owned by the applicant. A VMC cannot be used for TLS or for signing email.

## Why it matters
Mailbox providers that support BIMI, Gmail among them, only show a sender's logo when they can trust that the logo belongs to the sender. The VMC provides that proof: the domain's BIMI DNS record points to the VMC file, and the provider checks the certificate chain and compares the embedded logo. The domain must also enforce DMARC with a quarantine or reject policy for the logo to appear. Only a small number of CAs issue VMCs, and the vetting resembles [EV](https://ssl.sh/glossary/ev-certificate/) identity checks plus trademark verification.

## Example
```text
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"
```

The `a=` tag points to the VMC, published as a [PEM](https://ssl.sh/glossary/pem/) file containing the certificate and its chain.

## Common misconceptions
- **A VMC secures my website.** It has no role in HTTPS; it only supports logo display in email.
- **Any logo can be used.** The logo must match a trademark registered with an office the CA accepts.
- **A VMC guarantees the logo will show.** Each mailbox provider decides whether to display it, based on authentication results and its own policies.

## Related terms

- [BIMI](https://ssl.sh/zh/glossary/bimi/): BIMI 是一种邮件规范，允许域名在 DNS 中发布品牌 Logo，让支持它的邮箱服务在通过认证的邮件旁显示该 Logo。
- [X.509](https://ssl.sh/zh/glossary/x509/): X.509 是 ITU-T 制定的公钥证书标准格式，其互联网配置规范 RFC 5280 规定了 TLS 所用证书的结构和验证方法。
- [PEM](https://ssl.sh/zh/glossary/pem/): PEM 是一种把 DER 二进制数据做 Base64 编码、再用 BEGIN 和 END 行包起来的文本格式，是存放证书和私钥最常见的方式。
- [证书颁发机构](https://ssl.sh/zh/glossary/certificate-authority/): 证书颁发机构（CA）是负责审核申请者、签发数字证书，并把公钥与域名或身份绑定在一起的机构。
- [S/MIME](https://ssl.sh/zh/glossary/smime/): S/MIME 是一种使用 X.509 证书和 CMS 格式对电子邮件进行端到端签名和加密的标准。
- [EV 证书](https://ssl.sh/zh/glossary/ev-certificate/): EV 证书是按照 CA/浏览器论坛《EV 指南》完成最严格身份审核后签发的 TLS 证书。