Summary
For a Verified Mark Certificate (VMC), the question of who should attest to a trademark at a notary can lead to internal debates within organizations. While specific practices may vary, the general consensus points towards individuals or teams who hold the authority to legally represent the company. This typically includes legal departments or executives with signatory powers. It's also important to note that the requirement for a physical notary may be evolving with some Certificate Authorities (CAs) moving towards digital or alternative verification methods. Ultimately, VMC links your email branding to your legally registered trademark, adding a layer of authenticity and security that goes beyond standard email authentication.
Key findings
- Authorized representative: The individual attesting to the trademark for a VMC must be someone officially authorized to represent the company. This commonly falls to legal teams or executives with signature authority.
- Evolving notary requirements: Some Certificate Authorities, like Entrust, are reportedly moving away from requiring a physical notary for trademark attestation, streamlining the VMC issuance process.
- Trademark linkage: A VMC is intrinsically linked to a registered trademark. You must have a legally registered trademark to qualify for a VMC, as this is the basis of brand verification.
- BIMI requirements: While BIMI can be implemented without a VMC (self-assertion), major mailbox providers (MBPs) such as Google generally require a VMC to display the verified brand logo. Learn more about whether VMC is mandatory for Gmail logo display.
Key considerations
- Internal responsibility: Organizations should clearly define which department or individual is responsible for the VMC attestation process to avoid internal friction and ensure compliance.
- Trademark registration: Prior to pursuing a VMC, ensure your company's logo is a registered trademark with an intellectual property office recognized by the VMC ecosystem. Certera provides details on how to trademark your logo to qualify for VMC.
- Cost vs. benefit: Evaluate the cost of obtaining a VMC against its perceived benefits, especially if your primary audience is not on mailbox providers that require it for logo display. Consider the cost of VMC certificates.
- Security implications: Understand that VMC adds a critical layer of anti-phishing protection by verifying your brand logo, making it harder for impersonators to leverage visual identity.
What email marketers say
Email marketers often face a balancing act when considering VMC adoption. While the visual appeal of a verified logo in the inbox is attractive, the associated costs, administrative overhead, and the differing requirements across mailbox providers are significant points of discussion. Many question whether the investment in a VMC is justified, especially if a large portion of their audience is not using platforms that strictly enforce VMC for logo display. There's a strong desire for BIMI to be more accessible without these additional barriers.
Key opinions
- Team responsibility: There's confusion and debate among marketing, product, and legal teams about who is ultimately responsible for the administrative task of VMC trademark attestation.
- VMC as an exception: Many marketers view obtaining a VMC certificate as an exception rather than a standard practice, suggesting it's not a universal requirement for BIMI implementation.
- Cost vs. accessibility: The financial cost of VMCs is a significant concern, potentially hindering broader BIMI adoption, particularly for small to medium-sized businesses.
- Prioritizing general BIMI: Some marketers advocate for making customers BIMI-ready in general, without necessarily pushing for VMC certification, unless there's a specific, compelling business case.
Key considerations
- Audience reach: Before investing in a VMC, marketers should analyze their recipient base to determine how many are using mailbox providers that support VMC-enabled BIMI. Consider which email clients actually support BIMI.
- Trademark status: If a trademark is not already registered, the additional effort and cost of trademark registration must be factored into the overall VMC consideration.
- Alternative paths: Marketers should be aware that BIMI can be implemented with self-assertion for some mailbox providers, offering a path to brand display without the VMC cost. You can implement BIMI without a VMC for several email clients.
- Long-term strategy: Consider the long-term value of a verified brand logo in terms of trust and brand recognition, weighing it against the initial and ongoing investment required for VMC.
Marketer view
Email marketer from Email Geeks asks which team should attest to a trademark for a VMC, highlighting internal disputes between product, CRM, and legal departments regarding this responsibility.
Marketer view
Marketer from Online Forum points out that obtaining a VMC certificate can be viewed as an overhead, especially for small to medium-sized businesses, given the associated costs.
What the experts say
Experts emphasize that VMC's primary purpose is to enhance trust and combat phishing by providing a robust, verified link between a sender's brand and their email. While the attestation process may seem bureaucratic, it serves to confirm the legitimate ownership of a trademarked logo. Experts also highlight the ongoing efforts by the AuthIndicators Working Group to make BIMI more broadly accessible, acknowledging the varying implementation rules across mailbox providers. The security benefit of VMC is a key argument for its adoption, despite the operational costs involved.
Key opinions
- Legal representation: The person attesting to the trademark must be able to officially represent the company, typically from legal or an executive role with signature authority.
- Security imperative: VMC is a critical security measure. Without it, it would be much easier for bad actors to use legitimate-looking logos with DMARC-enforced domains for phishing, undermining email trust.
- Mailbox provider discretion: Different mailbox providers have different rules regarding VMC, with some requiring it for logo display while others allow self-assertion. This reflects varied internal reputation management solutions.
- Accessibility efforts: The AuthIndicators Working Group (AIWG) is actively exploring ways to expand identification options and logo support to make BIMI more accessible to a wider range of senders in the future.
- Operational costs: Operating robust identification management systems for VMC is expensive and challenging to automate, contributing to the costs associated with VMC certificates.
Key considerations
- Anti-phishing benefits: While VMC has a cost, its contribution to preventing brand impersonation and enhancing trust is a significant deliverability and security benefit. The SSL Store clarifies how VMCs qualify for BIMI.
- Navigating CA requirements: Be aware that specific CAs may have different requirements for attestation, including whether a notary is still required. It's important to understand which VMC issuer works for Google BIMI.
- Future of BIMI: Stay informed about developments from the AIWG regarding new forms of identification and logo support that could make BIMI more widely available without the VMC requirement.
- DMARC enforcement: VMC relies on a strong DMARC policy (at quarantine or reject) to function effectively. Ensure your DMARC is properly enforced for maximum VMC benefits. Understand DMARC, SPF, and DKIM.
Expert view
Expert from Email Geeks advises that the individual attesting to a trademark for a VMC should be someone who can officially represent the company, such as a legal representative or an executive with signature privileges.
Expert view
Expert from WordtotheWise.com stresses that VMC adds a crucial layer of verification, making it harder for spammers to impersonate brands, even with a DMARC policy in place.
What the documentation says
Official documentation from Certificate Authorities and the BIMI working group outlines the strict requirements for VMC issuance, particularly regarding trademark validation and the attestation process. These guidelines ensure the integrity and security of the verified brand logo display. The emphasis is on legally registered trademarks and a robust verification process to prevent fraudulent use of brand imagery in email communications. The documentation also clarifies that a VMC is an extension of email authentication standards like DMARC, providing an additional layer of visual trust.
Key findings
- Qualified trademark: A VMC requires a logo that is a registered trademark in a qualified intellectual property office, which means it must be officially recorded and protected.
- CA validation: Certificate Authorities perform a thorough validation process to ensure the applicant is the legitimate owner of the trademark and has the right to use the logo for email.
- Chain of trust: VMC extends the chain of trust established by DMARC, SPF, and DKIM, providing a verifiable link between the authenticated sender and their visual brand identity.
- SVG file format: The brand logo must be provided in a specific SVG Tiny PS format, which is validated by the CA for compliance and security. Read more about BIMI requirements for SVG files.
Key considerations
- Trademark registration process: Companies must navigate the legal process of trademark registration before applying for a VMC. This involves specific filing requirements and can take time.
- CA-specific procedures: While general requirements exist, each accredited Certificate Authority may have slight variations in their VMC issuance and attestation procedures. It's important to understand the pricing and approach behind VMC and BIMI.
- Compliance with standards: Adherence to BIMI specifications and CA guidelines is crucial for successful VMC implementation and ensuring the logo displays correctly in supporting inboxes.
- Ongoing validation: VMCs, like other certificates, have a validity period and require renewal, ensuring that the trademark status and company information remain current and verified.
Technical article
BIMI Working Group Specification clarifies that a Verified Mark Certificate (VMC) serves to securely bind a sender's verified logo to their authenticated email domain through a trusted Certificate Authority.
Technical article
DigiCert documentation outlines that VMC issuance requires rigorous validation of the trademark's authenticity and ownership, typically involving legal verification and official registry checks.
Related resources
5 resources
Related pages
What are the BIMI requirements for SVG files and Yahoo brand recognition?
Is DigiCert the only working VMC issuer for Google BIMI?
What is the pricing and approach behind VMC (Verified Mark Certificates) and BIMI (Brand Indicators for Message Identification)?
What is the cost of VMC certificates and are there cheaper alternatives?
Is VMC mandatory for Gmail logo display, and what are the alternative methods?
Do I need a VMC for BIMI to work with Google and Gmail?
Is a notary required to get a VMC for BIMI?
How do I set up BIMI? Is a VMC certificate always required?
A guide to BIMI accredited certificate providers
Understanding the business value and ROI of implementing BIMI
