What are the differences between CMC and VMC certificates, including cost and requirements?
Published 28 Jul 2025
Updated 9 Oct 2026
13 min read
Summarize with
Updated on 9 Oct 2026: We updated CMC and VMC requirements for current DMARC rules and mailbox support.
A CMC, or Common Mark Certificate, is usually cheaper and easier to obtain than a VMC because it can validate a logo through at least 12 months of public use instead of requiring a matching registered trademark. Some issuer workflows also accept a modified registered trademark for CMC. A VMC, or Verified Mark Certificate, is stricter because the logo must match a registered trademark or eligible government mark, but it can add Gmail's verified checkmark when the rest of the domain setup qualifies.
Both certificates belong at the end of a Brand Indicators for Message Identification (BIMI) project. Before buying either one, the sending domain needs enforced DMARC, aligned SPF or DKIM for legitimate mail, a BIMI-ready SVG logo, domain control validation, and clean enough authentication reporting that the certificate does not sit unused.
- Cheaper: CMC is normally the cheaper certificate path. DigiCert's direct retail example is in the low four figures per year, while other issuer and reseller quotes differ.
- Easier: CMC avoids the trademark filing barrier for a prior-use mark, but it still requires company validation, domain control, and evidence that the logo has been used publicly.
- Stricter: VMC requires an eligible registered mark that matches the submitted logo closely, plus the same organization and domain checks.
- Visibility: VMC can add the Gmail verified checkmark. CMC supports logo display at participating providers but does not create that checkmark.
DigiCert's current public pricing lists annual subscriptions at US$1,416 for CMC and US$1,752 for VMC. At these listed prices, CMC costs US$336 less per year, about 19% below VMC. These are direct retail examples, not market-wide minimums. Prices change by region, currency, contract, and renewal terms.
CMC vs VMC at a glance
The cleanest comparison separates what proves rights to the logo, what the mailbox provider shows, and what work must happen before the certificate can help. The certificate itself does not fix authentication. It proves the logo after the domain has met BIMI and DMARC requirements.
|
|
|
|---|---|---|
Logo proof | Prior use or issuer-supported registered-mark paths | Registered trademark or government mark |
Trademark | Not required for prior use | Required for normal brand logos |
Gmail verified checkmark | No | Yes, when accepted |
Typical buyer | Established logo without a matching trademark | Trademarked brand |
Issuer examples |
Practical CMC and VMC comparison
A CMC still requires organization and domain validation. For a prior-use mark, the issuer checks that the same logo is displayed now and appeared on the same controlled domain at least 12 months earlier, using approved archived webpages. Modified registered trademarks follow a separate evidence path. These checks are defined in the mark-certificate requirements.
DigiCert CMC and VMC pricing comparison for BIMI certificates.
DigiCert and Sectigo both publicly describe CMC and VMC options. The BIMI Group's certificate issuer list identifies participating issuers. Confirm current certificate availability and mailbox acceptance before building a launch timeline.
Certificates do not guarantee deliverability
CMC and VMC do not repair SPF, DKIM, or DMARC, and they do not guarantee inbox placement. Their direct function is authenticated logo display. A VMC can also produce Gmail's verified checkmark when Gmail accepts the BIMI setup.
Requirements before either certificate
Neither certificate matters until the domain has enforced DMARC. For BIMI, use p=quarantine or p=reject across all applicable mail, without a weaker subdomain policy or test mode. Suped's DMARC monitoring workflow shows which sources pass, which fail, and what must be fixed before a BIMI certificate has value.
RFC 9989 makes pct historic, so new DMARC records can omit it. Google's BIMI documentation still specifies pct=100. If a legacy record retains pct, keep it at 100 for compatibility; omitted pct also defaults to 100 under the older rules. Do not use percentage sampling or t=y test mode for a BIMI launch.
Check the domain's authentication posture before asking legal or finance to approve a certificate purchase. Suped's domain health checker gives a quick view of DMARC, SPF, and DKIM readiness, while Suped's platform provides ongoing reporting and issue tracking.
Example DNS records for DMARC enforcement and BIMIdns
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:reports@example.com" default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"
Replace example.com and the report address with your domain and reporting destination. Publish the SVG and issuer-provided PEM certificate chain at the corresponding HTTPS URLs.
If the domain is still at p=none, move through staged enforcement only after legitimate sources pass aligned SPF or DKIM. Suped's Hosted DMARC supports policy staging without repeated DNS edits, especially when several business units send through different systems.
Do not buy the certificate first
A VMC or CMC can sit idle if authentication is not ready. Check these items before starting the certificate order.
- DMARC: The organizational domain uses quarantine or reject, and the sending subdomain has no weaker override or test mode.
- Mail sources: Legitimate messages pass DMARC through SPF or DKIM with domain alignment; configure both authentication methods.
- BIMI SVG: The logo uses SVG Tiny Portable/Secure (SVG Tiny P/S), has a square aspect ratio, and is hosted over HTTPS. Gmail recommends a file size of 32 KB or smaller.
- Ownership: The applicant can prove legal organization details and domain control.
Suped is our DMARC reporting and email authentication platform. Suped does not issue CMC or VMC certificates. Its reports help teams find legitimate sending sources that fail DMARC and monitor authentication after enforcement.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
After the initial check, monitor live reports for at least one normal sending cycle. This avoids passing a static DNS check while a forgotten invoicing, recruiting, support, or marketing platform still sends unauthenticated mail.
How certificate validation differs
The main difference between CMC and VMC is the evidence behind the mark. Both require identity validation and domain control. VMC asks for an eligible registered mark that matches the logo. CMC accepts prior use or an issuer-supported registered-mark path. A pending trademark application is insufficient for VMC; the issuer must accept the trademark office and confirm ownership or an authorized licence.
VMC validation
- Mark proof: A registered trademark, service mark, or eligible government mark.
- Logo match: The submitted SVG must match the official mark record closely.
- Document load: Trademark registration, organization and domain checks, plus applicant identity verification under the issuer's process.
- Gmail result: Logo display plus the verified checkmark when Gmail accepts the setup.
CMC validation
- Mark proof: A prior-use mark, or a registered-mark path supported by the issuer.
- Logo match: A prior-use logo must be visible on a controlled domain and match the submitted SVG.
- Document load: Organization validation, domain control, and evidence of 12 months of use for a prior-use mark.
- Inbox result: Logo display at participating providers that accept CMC, without Gmail's verified checkmark.
CMC is useful for companies with a real brand but no finished trademark registration. It is not a shortcut around identity checks. The certificate authority still needs to confirm that the company exists, that the applicant can be reached through a reliable channel, and that the applicant controls the domain.
The current mark-certificate requirements also define a provisional CMC path based on a trademark registered at least three years before the application, even when the displayed logo differs. Confirm issuer availability and mailbox acceptance for this path. For prior-use CMCs, business age alone does not prove the specific logo's history.
Choose VMC for an eligible registered logo or CMC for qualifying prior use after DMARC enforcement.
The strict logo match matters more than many teams expect. If the trademark is a word mark but the BIMI logo is a stylized icon, or if the registered mark contains words removed from the email version, the VMC path can slow down. For a prior-use CMC, the question becomes whether the same logo has enough visible history in normal business use.
CMC and VMC costs and validation timeline
CMC has a lower price in the DigiCert example, but compare current quotes and included domain coverage before choosing on cost. The bigger saving can be time when a business does not already have a registered trademark. Filing or correcting a trademark can cost more than the annual certificate difference and can add months before a VMC order is ready.
DigiCert annual subscription prices
Direct retail examples for CMC and VMC, not the lowest available market prices.
CMC
1,416 USDVMC
1,752 USDThe visible certificate price is one line item. A project also includes legal review, brand file preparation, DNS work, certificate renewals, and authentication cleanup. If the trademark already exists and matches the logo, VMC can justify the extra certificate cost when Gmail's checkmark is required. If the trademark is missing, CMC is usually the practical starting point. Compare the VMC certificate cost with the cost and delay of trademark work.
- Certificate fee: Budget for an annual certificate fee. Issuer pricing and reseller discounts vary; the chart is one direct retail example.
- Trademark cost: VMC can require legal filing work if the brand has no matching registration.
- Design cost: Both paths need a compliant SVG logo, which often needs design cleanup.
- DNS cost: The domain must publish correct DMARC and BIMI records with stable HTTPS locations.
- Renewal cost: Separate the subscription term from certificate validity. Multi-year payment plans still require reissuance before each certificate expires.
Price is not the only filter
If the brand requires Gmail's verified checkmark, choose VMC and budget for trademark validation. If the brand needs BIMI logo display without trademark filing, choose CMC and confirm that the target mailbox providers accept it.
The commercial process normally follows a certificate authority workflow: select CMC or VMC, submit organization details, validate domain control, provide the logo files, complete identity checks, and publish the final BIMI DNS record with the certificate URL. Issuer-hosted logo and certificate files can reduce the chance of a broken URL later. Certificate issuance after complete validation is separate from trademark registration, which Google says can take 6 to 12 months. Ask the issuer for its document checklist and expected validation time rather than assuming a fixed turnaround.
Certificate coverage and renewals
Certificate cost depends on unique logos and the issuer's domain-coverage rules, rather than mailbox or recipient counts. DigiCert's published guidance calls for one certificate per unique logo and one per unique base domain. Coverage differs by issuer, so confirm whether several base domains sharing one logo need separate certificates or can share a multi-domain certificate.
- Unique logos: A parent brand, sub-brand, or seasonal logo can require separate certificate coverage.
- Base domains: Confirm coverage for each organizational domain and its subdomains; do not assume that one issuer's certificate-count rule applies to every issuer.
- Selectors: BIMI selectors can publish different logos, but each logo still needs matching certificate coverage where a certificate is required.
- Validity: The mark-certificate requirements cap validity at 398 days; DigiCert specifies 397 days. Retail subscriptions commonly renew every 12 months.
Assign renewal ownership before launch. A changed logo, legal organization name, domain set, or certificate file location can trigger replacement work before the normal renewal date. Keep the PEM URL stable and monitor it so an expired or unreachable certificate does not remove the BIMI result. When moving from CMC to VMC after trademark registration, obtain a new VMC and update the BIMI a= URL or replace the hosted certificate at its existing URL.
Which certificate should you choose?
Choose VMC when the logo already has an eligible trademark, the company wants Gmail's verified checkmark, and the budget can handle the higher annual certificate cost. Choose CMC when the logo has qualifying public history but no matching trademark, or when an issuer accepts the logo as a modified registered trademark.
- Use VMC: The logo has a current trademark record that matches the file intended for inbox display.
- Use CMC: The logo has qualifying prior-use evidence, or the issuer confirms eligibility under a registered-mark CMC path.
- Wait: DMARC is still at p=none, enforcement is partial or in test mode, legitimate mail fails alignment, or the logo is not BIMI-ready.
- Recheck: The brand uses multiple base domains, selectors, sub-brands, or regional marks that need separate certificate planning.
Suped's DMARC reporting turns authentication failures into a fix list for certificate readiness. Teams can review sending sources and coordinate corrections before enforcing DMARC across their domains.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
The dashboard answers the pre-certificate questions: which sources send mail, which pass authentication, and whether the domain is ready for enforcement. For focused record validation during setup, Suped's DMARC checker provides a quick check before production DNS changes.
Where CMC and VMC logos appear
Mailbox support affects the value of either certificate. Gmail accepts both CMC and VMC for BIMI logo display, while only VMC qualifies for Gmail's verified checkmark. Other providers have their own display and certificate rules.
|
|
|
|---|---|---|
Gmail | CMC enables eligible logo display; VMC also qualifies for the verified checkmark. | |
Apple Mail | Apple describes a 'digitally certified' indication when its BIMI requirements are met. | Both the sender and underlying email service provider must meet Apple's BIMI requirements; confirm acceptance of the chosen certificate. |
Yahoo Mail and AOL | Yahoo documents BIMI logos in its mobile mail apps and evaluates sender eligibility. |
Mailbox-specific BIMI display requirements
Test authenticated messages in the inboxes your recipients actually use. A valid certificate does not guarantee logo display for every message; receiver acceptance and sender reputation still affect the result.
Common implementation mistakes
Common BIMI launch problems include ordering the certificate before full DMARC enforcement, using a logo outside the required SVG profile, publishing an unreachable certificate URL, or missing DMARC alignment with the visible From domain.
BIMI record with certificate URLdns
default._bimi.example.com. IN TXT "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/certificate.pem"
That record is small, but every value behind it matters. The logo URL must stay live, the certificate URL must be reachable over HTTPS, and the certificate must match the organization and mark validated by the certificate authority. Host the full issuer-provided PEM chain, including the required intermediate and root certificates, as described in Google's BIMI setup instructions.
Mistakes that delay launch
- Policy gap: The domain uses p=none, a weaker subdomain policy, test mode, or legacy pct below 100, rather than full enforcement.
- Logo gap: The SVG is a normal web SVG, not the restricted BIMI-safe profile.
- Mark gap: The submitted mark does not match the trademark record or public-use evidence.
- Owner gap: No one owns annual renewal, DNS hosting, and certificate file availability.
If the team is still deciding whether a certificate is required, separate that decision by asking whether a VMC is required for the target providers and what users should see.
