What is the cost of VMC certificates and are there cheaper alternatives?
Published 29 Jul 2025
Updated 25 Oct 2026
13 min read
Summarize with
Updated on 25 Oct 2026: We corrected VMC and CMC pricing and clarified multi-year renewal costs and logo display requirements.
A Verified Mark Certificate (VMC) costs $1,350 per year on Sectigo's advertised multi-year plan or $1,752 for DigiCert's 12-month subscription. These are public price examples, not a market-wide minimum and maximum. A cheaper certificate alternative is a Common Mark Certificate (CMC), which Sectigo advertises as low as $990 per year. Reseller offers start around $749 for a VMC and $649 for a CMC, so compare the issuer, term, certificate scope, validation help, file hosting, and renewal support before treating a quote as equivalent.
The issuers compared charge for both VMCs and CMCs, and no generally available free option was found. Both certificate types require identity and logo validation. Cheaper paths include a CMC, a reseller purchase, BIMI without a certificate where supported, or delaying the certificate until DMARC enforcement is stable. A reseller VMC retains the same certificate category; a CMC or certificate-free BIMI has different display limitations.
- Direct VMC price examples: $1,350 per year on a multi-year plan or $1,752 for a 12-month subscription, before extra costs.
- Cheaper certificate: A CMC starts around $990 direct or $649 through some resellers when a trademark is not ready.
- Lower VMC quotes: Some reseller prices start near $749, but certificate terms and included setup work vary.
- Cheapest path: BIMI without a certificate costs less, but Gmail does not support that path and other provider support is limited.
- Additional setup cost: Allow for DMARC enforcement work, trademark registration where needed, and logo preparation.
VMC and CMC prices compared
Treat VMC pricing as an annual operating cost, not a one-off setup fee. The quote covers a certificate subscription and its validation and renewal terms. You also need the technical setup around it: DMARC at enforcement, authenticated email, a compliant BIMI SVG, and a BIMI DNS record that points to the logo and certificate.
Current public pricing depends on the certificate type, term, and sales channel. DigiCert's certificate comparison lists a VMC at $1,752 and a CMC at $1,416 for a 12-month auto-renewing subscription. Sectigo's VMC pricing starts at $1,350 per year on a multi-year subscription, while its CMC pricing starts at $990 per year. Reseller headline prices start around $749 and $649 respectively; request a written quote to confirm the qualifying term and scope. Figures are in USD before applicable taxes. Compare the total payable and renewal price, because a monthly display or annualized multi-year rate does not establish the one-year checkout cost.
|
|
|
|
|---|---|---|---|
DigiCert VMC direct | $1,752 | Logo and Gmail checkmark eligibility | 12-month subscription; registered or government mark |
Sectigo VMC direct | $1,350+ | Logo and Gmail checkmark eligibility | Advertised multi-year rate |
VMC reseller | $749+ | Same certificate category | Confirm term, issuer, and scope |
DigiCert CMC direct | $1,416 | Certified logo display | 12-month subscription; no Gmail checkmark |
Sectigo CMC direct | $990+ | Certified logo display | Confirm term; no Gmail checkmark |
CMC reseller | $649+ | Lower certificate price | Compare term and service |
BIMI without a certificate | $0 certificate fee | Self-asserted logo where accepted | No Gmail BIMI display; setup costs remain |
Public price examples in USD. Subscription lengths differ, and starting rates require confirmation of term and scope. Logo display remains subject to receiver rules.
Public annual price examples
Advertised annual amounts in USD. DigiCert figures are 12-month subscriptions; Sectigo VMC is a multi-year rate. Reseller rates are starting prices with term and scope to confirm. Zero excludes setup and hosting.
DigiCert VMC (12 months)
1,752 USD/yearSectigo VMC (multi-year rate)
1,350 USD/yearDigiCert CMC (12 months)
1,416 USD/yearSectigo CMC (starting rate)
990 USD/yearReseller VMC (starting rate)
749 USD/yearReseller CMC (starting rate)
649 USD/yearBIMI without certificate
0 USD/yearWhy VMC certificates require paid validation
The price includes more than a normal domain-validated certificate. The certificate authority has to validate the organization, domain control, rights to the logo, registered or government mark status, and the person requesting the certificate. That is closer to extended validation work than to automated web TLS issuance. Both VMC and CMC issuance require logo evaluation beyond website domain-control checks.
What a VMC validates
- Trademark: The logo must match a registered mark or accepted government mark.
- Organization: The legal entity must pass business identity checks.
- Requester: The person requesting the certificate has to be validated.
- Domain: The domain must pass control and email authentication checks.
What a CMC changes
- Trademark: A registered trademark is not required.
- Logo history: A Prior Use Mark CMC requires at least 12 months of logo use on a domain you control.
- Cost: CMC pricing is generally lower at the same issuer, but organization and logo checks still apply.
- Inbox result: The logo can display, but Gmail does not add its blue verified checkmark.
The certificate is rarely the only cost
The certificate line item is visible, but the bigger work is often DMARC enforcement. If a domain has years of marketing, product, support, billing, and sales senders, budget time for sender discovery, SPF cleanup, DKIM fixes, monitoring, and a controlled move to p=quarantine or p=reject.
Count trademark and certificate scope costs
A VMC can require a separate trademark budget when the logo is not already registered. In the United States, the federal base application fee is $350 per class. An intent-to-use application adds a $150 statement-of-use fee per class, and incomplete or custom goods and services descriptions can add more. Legal searches, attorney work, and responses to objections sit outside those government fees. Other jurisdictions use different fee schedules. See the USPTO fee schedule for government charges. Trademark maintenance fees also apply after registration.
Trademark registration is also a timing cost. Filing an application does not establish VMC eligibility; the logo must have an accepted registration or qualify as a government mark. Processing time depends on the jurisdiction and application, so confirm the mark's eligibility with the issuer before paying for a certificate. A CMC can make more financial sense when the logo already has the required public-use history.
|
|
|
|
|---|---|---|---|
Base trademark filing | $350 | Per class | One-time government fee |
Statement of use | $150 | Per class | Applies to intent-to-use cases |
Attorney and search work | Variable | By filing complexity | Separate from government fees |
Extra logo or domain scope | Quote required | By certificate and SAN | Can multiply annual cost |
Illustrative US filing fees exclude attorney work and vary by application facts.
Certificate scope matters as much as the headline rate. Each unique logo can require another certificate. Some issuers can place multiple related domains on one certificate, but included domains, subject alternative name (SAN) charges, and validation rules vary. Ask for a written quote that lists every logo, base domain, subdomain, certificate term, and renewal price. Confirm whether the plan charges per base domain and whether its subdomains are included.
Cheaper VMC alternatives and their tradeoffs
The lower-cost paths are a CMC, a reseller quote, self-asserted BIMI, or waiting until the domain is ready. None produces the same result in every inbox, so choose based on whether you need Gmail's verified checkmark, whether the logo is trademarked, and whether the domain is already at DMARC enforcement. Compare the same issuer and term: a reseller VMC can cost less than a direct CMC from another issuer.
A normal HTTPS/TLS certificate or self-signed certificate does not replace a VMC or CMC: it does not provide the required validation of rights to an email logo. Certificate-free BIMI works only where the receiving mailbox provider accepts it. Yahoo accepts self-asserted BIMI subject to its sender requirements; Gmail requires a VMC or CMC. See the BIMI without VMC explainer for provider limitations.
DigiCert Mark Certificates purchase screen with VMC and CMC options.
|
|
|
|
|---|---|---|---|
CMC | Usually at the same issuer | No trademark | No Gmail checkmark |
Reseller VMC | Often | Price comparison | Scope and support vary |
BIMI only | Yes | Limited-provider display | Not supported by Gmail |
Wait and fix DMARC | For now | Unready domains | Delayed BIMI |
Use this to choose the cheapest path that still meets the inbox outcome you need.
When a CMC is the cheaper option
If you do not have a registered trademark, a Prior Use Mark CMC is a lower-cost certificate path. It still requires validation, DMARC enforcement, and a BIMI-ready logo. The logo needs at least 12 months of use on a domain you control, with evidence the issuer can verify. DigiCert's CMC requirements also cover a Modified Registered Mark route. Gmail accepts CMCs for logo display without its blue verified checkmark; confirm CMC support separately for other mailbox providers. For a side-by-side comparison, see the VMC versus CMC guide.
When auditing an existing BIMI setup, use the BIMI TXT record only to find the certificate URL in a=. The reliable VMC vs CMC signal is the certificate's subject:markType field. Registered Mark and Government Mark identify VMC. Prior Use Mark, Modified Registered Mark, and Provisional Mark identify CMC under the current Mark Certificate Requirements; issuer availability and mailbox acceptance still need checking. If a= is blank or missing, the setup is self-asserted BIMI rather than VMC or CMC.
DMARC and BIMI requirements before buying
Do not buy a VMC or CMC until the domain can hold a DMARC policy of p=quarantine or p=reject. For new records, omit the historic pct tag; RFC 9989 made it historic. Remove any existing value below 100 before relying on BIMI, because legacy receiver checks reject partial enforcement. BIMI eligibility depends on an enforced policy, consistent DMARC alignment through SPF or DKIM, and records that receivers can evaluate. If DMARC is still at p=none, spend the money on authentication cleanup first. The DMARC standard defines the current policy tags.
Suped's DMARC monitoring supports that pre-certificate workflow: collect aggregate reports, find every sender, identify SPF and DKIM failures, and move policy in controlled stages. For teams that need CNAME-based policy control, Suped's hosted DMARC workflow supports policy changes without repeated DNS edits.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Example DMARC TXT value at _dmarc.example.comDNS
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com;
That record is only an example. The right policy depends on what your reports show. Before you move to enforcement, use a DMARC checker to validate syntax, then send real email and confirm passing authentication at the mailbox level.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Once DMARC is enforced, the BIMI record points to the SVG logo and, for VMC or CMC use, the certificate file. Keep the DNS record short and clear, and host both files on reliable HTTPS endpoints. Paying for a certificate does not guarantee logo display or inbox placement. Mailbox providers also apply their own support and sender reputation requirements. See the BIMI Group's sender FAQ for display conditions.
Example BIMI TXT value at default._bimi.example.comDNS
v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem;
Multi-year plans still need certificate renewal
A two- or three-year purchase is a commercial subscription, not one certificate that stays valid for the whole term. The BIMI Group's certificate requirements cap mark-certificate validity at 398 days; issuers also offer shorter periods, including one year. Confirm who handles revalidation and replacement-file deployment during a multi-year plan.
- Ask for the total commitment, payment schedule, renewal price, and cancellation terms rather than comparing annualized headline prices alone.
- Confirm whether reissues, added domains, logo changes, and HTTPS file hosting are included or charged separately.
- Set an expiry reminder and confirm who publishes the replacement PEM file and tests logo display after renewal.
- If switching sellers, confirm the new issuer is accepted by your target mailbox providers and keep a valid certificate deployed during the transition.
An expired mark certificate stops meeting certificate-dependent BIMI requirements, so the logo or Gmail checkmark can disappear. Expiry alone does not disable SPF, DKIM, or DMARC. Continue the normal authentication workflow while renewing the certificate.
How to choose without wasting money
Do not make this decision by asking whether $1,350 is expensive in isolation. The better question is whether a verified inbox logo is worth the annual certificate cost plus the work needed to keep the domain eligible.
For a brand that sends high-volume customer email, has a registered trademark, and already runs DMARC at enforcement, a VMC is a practical option when Gmail's verified checkmark matters. Check which mailbox providers your recipients use before committing to the annual fee. For a smaller sender still discovering mail sources, waiting keeps that budget available for authentication first. You can check the wider domain health before buying the certificate.
DMARC policy choices before a VMC
BIMI can qualify at quarantine or reject. Choose the policy your reports support.
Not ready
p=none
DMARC is monitoring only, senders are still unknown, or alignment gaps remain.
BIMI-capable
p=quarantine
Quarantine applies to failures and legitimate mail has been tested against the policy.
Strict enforcement
p=reject
Reject is appropriate only when reports show the domain can refuse failed mail safely.
VMC buying decision flow for DMARC readiness, trademark status, and CMC alternatives.
The practical order of operations
- Enforce DMARC: Reach quarantine or reject without blocking real mail.
- Fix the logo: Prepare a square SVG Tiny P/S logo and follow the issuer's file-size limit.
- Pick certificate: Use VMC for an accepted registered or government mark, or compare CMC eligibility if registration is missing.
- Monitor renewal: Track expiry, DNS changes, and authentication drift after launch.
Suped's DMARC reporting and email authentication platform supports the work around a BIMI certificate: reviewing aggregate reports, identifying legitimate senders with authentication failures, and checking new senders after enforcement. Keep that monitoring in place after logo deployment so changes in sending sources do not go unnoticed.
Views from the trenches
Best practices
Confirm DMARC enforcement before pricing a VMC, because certificates will not fix policy gaps.
Budget for certificate renewal, trademark work, SVG cleanup, and DMARC monitoring.
Test BIMI with real messages after DNS changes, because inbox support varies by provider.
Common pitfalls
Buying a VMC before enforcement creates a certificate that cannot deliver value yet.
Treating CMC as a free path causes surprises because validation and renewals still apply.
Ignoring certificate expiry removes the logo and checkmark even when DNS still looks valid.
Expert tips
Use CMC when the logo has public history but the registered trademark is not ready yet.
Keep the BIMI SVG tiny, square, script-free, and hosted over reliable HTTPS before review.
Review aggregate DMARC reports weekly after enforcement so new senders do not break quietly.
Marketer view
Marketer from Email Geeks says VMC pricing feels high, but the certificate is one line item once DMARC enforcement, legal review, and logo validation are included.
2021-07-13 - Email Geeks
Marketer view
Marketer from Email Geeks says certificate prices tend to stay in a narrow band because validation is manual and the buyer pool is low volume.
2021-07-13 - Email Geeks
Frequently asked questions
Public examples include a $1,350 annualized multi-year VMC rate and a $1,752 12-month VMC subscription. Some reseller offers start around $749 per year. Prices are in USD before applicable taxes. Compare the total payable, certificate scope, support, and renewal price.
No generally available free VMC option was found among the issuers compared. A normal website TLS certificate or a self-signed certificate does not replace the identity and logo validation required for a mark certificate.
Usually at the same issuer and term. Advertised CMC offers start around $990 direct or $649 through some resellers. The Prior Use Mark route requires at least 12 months of logo use on a domain you control. Compare the final quote: a reseller VMC can cost less than another issuer's direct CMC.
Yes. A CMC can provide certified logo display without a VMC, but it does not trigger Gmail's blue verified checkmark. Self-asserted BIMI without either certificate works only at providers that accept it, and Gmail does not.
Fetch the certificate from the BIMI record's a= tag and inspect subject:markType. Registered Mark and Government Mark mean VMC. Prior Use Mark, Modified Registered Mark, and Provisional Mark mean CMC under the current Mark Certificate Requirements. Check issuer availability and receiver acceptance separately.
No. Get DMARC to quarantine or reject first, then buy the certificate. Otherwise you pay for a certificate before the domain can use it properly.
