A BIMI certificate is optional in the BIMI Group's published steps, but highly recommended. A Verified Mark Certificate (VMC) is tied to a registered trademark. A Common Mark Certificate (CMC) is for logos without a trademark. Self-asserted BIMI, with no certificate, has limited support across mailbox providers.
The three options
Self-asserted. You publish a BIMI record pointing at your SVG logo and no certificate. The BIMI Group states that self-asserted BIMI records have limited support across the various mailbox providers.
VMC. Per the BIMI draft, a Verified Mark Certificate is a Mark Certificate issued by a Mark Verifying Authority. The BIMI Group says VMCs validate ownership of an organization's logo and are based on registered trademarks of the logo or image. Supported jurisdictions are listed on their site.
CMC. A Common Mark Certificate is also issued by a Mark Verifying Authority, but for logos that are not registered trademarks. The BIMI Group says CMCs allow some flexibility in how logos are displayed, with examples such as seasonal colour changes or stacking words rather than a single line.
What the certificate does
A mark certificate is a type of BIMI evidence document. It binds your logo to your domain through a certificate authority's validation, so a receiver does not have to take your word for who the logo belongs to. In the draft, the receiver compares the hash of the SVG it fetched against the certificate's embedded content, and the two must match.
Practically, that means the SVG you host and the one in the certificate are the same file. If you change the logo, you need a new certificate.
How to decide
- Do you hold a trademark on the logo? If yes, a VMC is the natural route.
- Is the logo unregistered, or do you want display flexibility? Look at a CMC.
- Do you just want to experiment? Self-asserted costs nothing in certificates, but check which of your recipients' mailbox providers show a logo without one. I could not confirm current provider by provider behaviour, so use the BIMI Group's adoption chart and your own testing.
The BIMI Group also warns that future BIMI programs may require certificates, so planning for one is sensible. I did not confirm any certificate prices, and they vary by issuer, so ask the Mark Verifying Authorities.
Order of work
- Get DMARC to enforcement first. No certificate helps without it.
- Finalize your logo and clean the SVG to the required profile.
- Decide on VMC or CMC with whoever owns your trademarks.
- Apply through a Mark Verifying Authority and complete their validation.
- Publish the DNS record with both l and a values, then test.
Quick check
Can a VMC fix a failing DMARC policy?
No. DMARC at enforcement is a precondition. A certificate adds logo validation, not authentication.
Sources
Last reviewed: 19 October 2026.
