A Verified Mark Certificate (VMC) is the trademark-attestation document that Gmail and Yahoo require before they will display a BIMI logo in their users' inboxes. This article explains what a VMC is, the issuance process, costs, trademark requirements, and how UK businesses obtain and maintain them.
A VMC is a specialised X.509 certificate that attests:
VMCs extend the PKI trust model. A receiver validating a BIMI logo walks the VMC chain to a trusted root, confirms the trademark ownership claim, and displays the logo with confidence.
Without VMC, any domain publishing a BIMI record could claim any SVG as their "brand logo" — including logos of unrelated businesses. An attacker spoofing a lookalike domain could publish the victim's actual logo and display it to recipients.
VMC closes this loophole. Gmail and Yahoo display logos only when a VMC confirms trademark ownership. Attackers without the trademark cannot obtain a VMC, and therefore cannot display misleading logos.
Fastmail and Proton take a different approach — accepting BIMI without VMC because their user base is smaller and attack volume lower. Gmail's and Yahoo's scale makes VMC essential.
Two primary issuers accredited by the BIMI Group:
Both are well-established certificate authorities with EV (Extended Validation) experience. The VMC process reuses much of the EV infrastructure but adds trademark verification.
To obtain a VMC, you must hold a registered trademark for the logo. Accepted trademark authorities include:
Unregistered trademarks (common law marks) do not qualify. The logo must be an exact match to the registered mark; minor variations may be acceptable but usually require clarification with the VMC issuer.
Trademark registration in the UK typically costs £170+ for one class at the UK IPO, takes 4-6 months, and is separate from the VMC cost. For UK SMEs without existing trademarks, registration is the first step.
Typical timeline: 2-6 weeks from application to delivered certificate. Renewals are faster (1-2 weeks) as the verification infrastructure is reusable.
| Item | Cost |
|---|---|
| DigiCert VMC (1 year) | ~USD 1,500 |
| Entrust VMC (1 year) | ~USD 1,500 |
| UK IPO trademark registration (1 class) | £170+ |
| EUIPO trademark (1 class) | ~€850 |
| Trademark agent/solicitor | £500-£2,000 if used |
| Logo design/SVG conversion | £200-£1,000 if outsourced |
Total first-year cost for a UK SME without existing trademark: £2,000-£4,000. Subsequent years: VMC renewal only (~£1,200-£1,500 equivalent).
For UK businesses with existing trademarks, first-year cost drops to just the VMC.
VMCs expire annually. Renewal involves:
Failing to renew means the VMC expires, Gmail and Yahoo stop displaying the logo, though the BIMI record itself continues to work on non-VMC receivers (Fastmail, Proton).
Set renewal reminders 30-60 days ahead of expiry. VMC issuers also send reminder emails.
CMC is a lighter-weight alternative introduced in 2022-2023 by some issuers for certain "common mark" cases — where a logo is sufficiently well-known and used that trademark-style registration is not needed. CMC criteria vary by issuer but generally require:
CMC is cheaper than VMC (~USD 500-1,000 per year) but adoption is limited. Not all receivers accept CMC. For UK businesses with unregistered but well-known logos, it is an emerging option worth evaluating.
Once the VMC PEM file is in hand:
https://firm.co.uk/assets/bimi/vmc.pem.a=:default._bimi.firm.co.uk. IN TXT "v=BIMI1; l=https://firm.co.uk/assets/bimi/logo.svg; a=https://firm.co.uk/assets/bimi/vmc.pem"Gmail and Yahoo will now fetch both the logo and the VMC when processing your authenticated mail, validate the VMC against their trusted roots, and display the logo if everything verifies.
VMCs among UK organisations, as of 2026:
.gov.uk.Justifying VMC investment to management:
For a UK retailer sending 10M messages per year, a 15% open-rate improvement on the BIMI-enabled portion translates to meaningful revenue; VMC cost is trivial by comparison. For lower-volume senders, the calculation is tighter.
VMC issuer rejects because the logo submitted differs from the registered trademark design. Fix: register the exact logo as used, or modify the logo to match the registration.
Companies House records do not match the applicant. Fix: provide current Companies House records and ensure applicant name matches.
SVG fails the BIMI Tiny 1.2 profile check. Fix: use a BIMI-specific converter or designer familiar with the profile.
TXT record not propagated, email verification not received, file upload misplaced. Fix: carefully follow the issuer's verification steps.
Trademark is registered in a country not on the issuer's accepted list. Fix: register in UK IPO or EUIPO (both universally accepted).
Q: Can I get a VMC without a registered trademark?
A: Not a standard VMC. Consider CMC if your logo meets the "common mark" criteria. Otherwise, register a trademark first.
Q: How long does trademark registration take in the UK?
A: UK IPO registration: 4-6 months straightforward, longer if there are opposition periods. Factor this into your BIMI deployment timeline.
Q: Does an EU trademark (EUIPO) work for VMC?
A: Yes. EUIPO-registered marks are accepted by DigiCert and Entrust. Post-Brexit, UK businesses often hold both UK IPO and EUIPO trademarks — either works.
Q: Is a trademarked logo the same as a registered company name?
A: No. Companies House registration of your company name does not grant trademark rights. Separate trademark registration is needed for VMC purposes.
Q: Can I use a VMC for multiple domains?
A: A VMC is specific to the organisation and the logo; it can apply to multiple domains owned by the same entity. Check with the issuer for multi-domain packages.
Q: What happens if my trademark lapses?
A: The VMC becomes invalid at next renewal. Keep trademark renewals current to avoid disruption.
Q: Can charities get discounted VMCs?
A: Some issuers offer reduced-price charity pricing. Inquire specifically with DigiCert or Entrust.
Q: Is the VMC publicly accessible in my DNS?
A: The a= tag in BIMI points to a public HTTPS URL. The VMC PEM itself is public — anyone can download it and inspect. This is intended; receivers fetch it to validate.
Q: Does the VMC contain any private information?
A: No — public information only: organisation name, trademark registration details, validity dates. Comparable to a public TLS certificate.
Q: Can I change my logo without getting a new VMC?
A: Only for minor variations. Substantially different logos require a new VMC (because the trademark the VMC attests has changed in appearance). Plan re-issuance for rebrand events.
Q: How is the VMC process different from Extended Validation (EV) TLS?
A: Similar in verification rigour. Both require company identity verification and domain ownership. VMC additionally verifies trademark ownership. The issuers have largely adapted their EV processes for VMC.
Q: Is there a UK-based VMC issuer?
A: No. DigiCert and Entrust are multinational; they operate in the UK but are not UK-native. No UK-only VMC issuer exists in 2026.
Q: What happens if DigiCert or Entrust's VMC root CA is revoked?
A: All VMCs issued under that root become invalid simultaneously. Similar to a TLS CA compromise. Receivers maintain trust stores; a compromised root would trigger broad revocation. Extremely rare event.
Q: Are VMCs available for UK government domains?
A: Yes. HMRC, DVLA and other central government bodies have deployed. Trademark rights for public sector entities may involve different procedures (e.g. Crown copyright); work with legal counsel if relevant.
Q: Is the VMC format the same across issuers?
A: Yes. Standard X.509 format per BIMI Group specifications. Mutually compatible; receivers accept VMCs from either DigiCert or Entrust.
Q: What alternatives exist to VMC for UK small businesses?
A: Non-VMC BIMI (displays on Fastmail, Proton, some European receivers) costs nothing beyond DMARC and logo hosting. CMC (where available) is cheaper than VMC. Or simply skip BIMI until trademark and VMC budget are available.
Q: Does the VMC renewal process require re-verifying the trademark?
A: Yes — the issuer confirms the trademark is still registered and active at renewal. Lapsed trademarks invalidate renewal.
Q: Can I transfer a VMC to a new domain?
A: No, generally. VMCs are tied to the organisation and domain at issuance. For a new domain, a new VMC or a re-issuance is needed.
Q: How does the VMC process compare with other certificate types I have obtained?
A: Closest equivalent is EV TLS. Organisation verification is similar. Domain verification is similar. The trademark verification is the new element specific to VMCs. Timelines are longer than DV TLS (minutes) and similar to EV TLS (days to weeks).
Q: Is there a way to pre-check whether my trademark would qualify for VMC?
A: DigiCert and Entrust both offer pre-application consultations. For UK businesses, the trademark either meets the requirements (valid registration, logo matches) or does not. Pre-checks reduce wasted effort for borderline cases.
Q: Can a parent company's VMC apply to a subsidiary's domain?
A: Only if the subsidiary is part of the same legal entity or appropriately authorised. Corporate structure matters for VMC. Consult the issuer for multi-entity group scenarios.
Q: What is the typical VMC rejection rate on first application?
A: Around 20-30% of first applications require follow-up for missing documentation or logo compliance. Rare outright rejections. Most applications succeed after iteration.
Q: How often does the trademark verification need to be updated for a VMC?
A: Each annual renewal involves re-verification. If your trademark status changes (lapsed, transferred, opposed), the renewal may fail. Keep trademark records current.
Q: Does a VMC certify the authenticity of every message using BIMI?
A: No — VMC certifies the trademark. DMARC certifies each message. BIMI ties them together. Three separate mechanisms; VMC is one part.
Q: Are there UK law firms specialising in VMC and trademark registration?
A: Yes — many UK trademark attorneys now offer combined trademark + VMC packages. Firms listed with the Chartered Institute of Trade Mark Attorneys (CITMA) are a good starting point for UK businesses.
Q: Can I obtain a VMC for a domain that is not my primary business domain?
A: Yes, if you own the trademark for the logo used on that domain. Multiple domains from the same brand can each have their own VMCs.
Q: Does VMC work for .uk and .co.uk domains equally?
A: Yes. VMC does not distinguish between TLDs. Both are verified as domain ownership just like any other.
Q: What happens if my UK IPO trademark is opposed but eventually granted?
A: You need the trademark granted (not just applied for) before VMC can issue. If opposition delays, VMC is delayed equivalently. Plan for UK IPO timelines accordingly.
Q: Is the VMC renewal process fully automated like Let's Encrypt?
A: No. VMC renewals require human verification — trademark check, organisation confirmation. No automated ACME-equivalent. Annual renewals with 1-2 weeks lead time.
Q: Are VMCs worth the effort for B2B UK businesses?
A: Depends on volume of mail to consumer inboxes (BIMI's main value) vs other UK businesses (where mail clients typically do not display BIMI). B2B-heavy senders may not justify the cost; consumer-heavy senders usually do.
Q: Can a VMC be revoked?
A: Yes — issuers can revoke VMCs for fraud, trademark disputes, or expiry. Revoked VMCs immediately stop logo display. Rare event but possible.
Q: What is the future outlook for VMC costs?
A: Likely to decrease as more issuers enter the market and processes automate. Early-adopter pricing is high; expect it to fall closer to EV TLS pricing over time.
Q: Is VMC required for FCA-regulated UK financial services to send BIMI-enabled email?
A: Not required by FCA regulation. VMC is required by Gmail and Yahoo to display logos — a practical requirement for consumer-facing financial mail. FCA itself does not mandate BIMI.
Q: Can a UK charity with public benefit status get a discounted VMC?
A: Some issuers offer charity pricing. Check with DigiCert and Entrust. UK registered charities (with Charity Commission number) are typically eligible.
Q: Does my logo SVG need to be perfectly square for VMC?
A: Yes — BIMI logos must be square. Non-square logos are rejected during compliance check. Design accordingly.
Q: How does VMC renewal interact with DMARC policy changes?
A: Independently. The VMC attests trademark; DMARC policy attests authentication strength. VMC remains valid even if DMARC policy changes — but if DMARC drops below p=quarantine, Gmail and Yahoo stop displaying the logo regardless of VMC.
Q: Can I share the VMC PEM file with third parties?
A: The file is public (referenced by DNS). No restriction on who downloads it. The VMC cryptographic validity is what matters, not secrecy of the file.
Q: What happens if my domain changes ownership?
A: The VMC becomes invalid. The new owner either obtains a new VMC (if they have their own trademark) or publishes non-VMC BIMI. VMCs do not transfer with domains.
Q: Is there any way to have multiple logos per VMC?
A: No. Each VMC attests one logo (one trademark). Different logos require different VMCs. Some brands obtain multiple VMCs for different sender classes.
Q: Can I get both a VMC and a CMC for the same domain?
A: In principle yes, but duplicative. Pick one based on your trademark situation — VMC if you have a registered mark, CMC if you qualify under the common-mark criteria.
Q: What are the typical lead times for VMC vs trademark vs overall BIMI deployment?
A: Trademark (if not held): 4-6 months. VMC (with trademark): 2-6 weeks. Overall BIMI deployment (if DMARC already at quarantine+): 1-2 months including logo design. Plan accordingly — start trademark early if needed.
Q: How do I find out whether my existing trademark is VMC-eligible?
A: Check with DigiCert or Entrust before committing. Most UK IPO and EUIPO trademarks are eligible. Some niche jurisdictions may not be.