What are the recommended VMC providers for BIMI setup after Entrust's acquisition by Sectigo?
Published 26 Jun 2025
Updated 6 Aug 2026
11 min read
Summarize with
Updated on 6 Aug 2026: We updated this guide for Sectigo's completed migration and the current VMC issuer options.
For a new BIMI setup, shortlist DigiCert, GlobalSign, and SSL.com, the three issuers in the current BIMI Group Mark Certificate Issuer directory. DigiCert remains the conservative default when Gmail and Apple Mail logo display is the priority. Sectigo now sells VMCs and CMCs and handles former Entrust accounts, but confirm the exact certificate chain and acceptance by target mailbox providers before purchase.
BIMI success depends on more than appearing on an issuer list. Gmail, Apple Mail, Yahoo, Fastmail, and other mailbox providers decide whether they honor a given Mark Verifying Authority. A certificate can be valid PKI and still fail to produce the inbox logo you expected.
- Conservative default: Choose DigiCert when Gmail and Apple Mail logo display is the commercial requirement.
- Existing Entrust users: Use Sectigo support for the migrated account, then check the issuer chain before renewal.
- Listed alternatives: Compare GlobalSign and SSL.com, then test the target inboxes before rollout.
- DMARC prerequisite: Do not buy a VMC until DMARC enforcement and alignment are clean.
The short answer
For one conservative recommendation, use DigiCert for a new VMC or Mark Certificate unless procurement or regional validation requirements point elsewhere. GlobalSign and SSL.com also appear in the current issuer directory and deserve a direct commercial comparison. Sectigo is relevant for migrated Entrust customers and now offers its own VMCs and CMCs, but its current issuer-directory status requires an extra acceptance check.
|
|
|
|---|---|---|
 DigiCert | Conservative default | Compare cost |
 GlobalSign | Listed alternative | Test target inboxes |
 SSL.com | Listed alternative | Test target inboxes |
 Sectigo | Former Entrust accounts | Not in current directory |
Entrust | Existing certificates | No new ECS VMCs |
Practical VMC provider shortlist after Entrust's public certificate business moved to Sectigo.
Entrust's published dates say VMC and S/MIME issuance from Entrust Certificate Services ended on May 12, 2025, existing certificates remain valid through expiration, and the public certificate migration finished on September 18, 2025. The Sectigo FAQ explains how Entrust customer data and certificate inventory moved to Sectigo Certificate Manager.
The important distinction
Migration of a customer account is not the same thing as changing the issuing CA inside an already issued certificate. A VMC issued under an Entrust chain stays under that chain until it is replaced or renewed.
- Account migration: Moved access, inventory, records, contacts, and management workflow.
- Certificate chain: Controls which root and intermediate CA mailbox providers evaluate.
- Renewal decision: Confirms the new issuer, validity, and supported certificate type.
What changed after Entrust's sale
The Entrust sale created two separate questions that are easy to mix together. The first is operational: where do former Entrust public certificate customers manage their accounts after the completed migration? The answer is Sectigo. The second is delivery-facing: which VMC issuer chain will Gmail, Apple Mail, and other receivers honor for BIMI logo display? That answer depends on the actual certificate chain and each mailbox provider's policy.
A generic "Sectigo acquired Entrust" answer is not enough for BIMI. For TLS, a valid certificate generally does the job if the client trusts the root. For BIMI, the VMC or CMC must also satisfy mailbox-provider expectations for Mark Certificates, and providers can accept different issuers.
What the migration handled
- Portal access: Customer accounts moved out of Entrust ECS into Sectigo management.
- Inventory: Certificate metadata and domain records moved with the account.
- Support path: Sectigo is now the contact for migration, renewal, and replacement questions.
What still needs checking
- Issuer chain: The certificate path is what receivers evaluate for trust.
- Mailbox support: An MVA listing does not force every receiver to show the logo.
- BIMI record: The DNS record still needs the correct logo or certificate URL.
The safest procurement question is: "Which issuing CA and certificate type will we receive, and which mailbox providers have accepted that chain for BIMI display?"
Check the current issuer directory
The current Mark Certificate Issuer directory lists DigiCert, GlobalSign, and SSL.com. The directory also publishes supporting evidence such as each issuer's Certification Practice Statement, Certificate Transparency log, revocation information, root certificate, and audit report. It does not currently list Sectigo.
Sectigo now sells VMCs and CMCs, including through Sectigo Certificate Manager. That makes Sectigo a direct product option as well as the migration destination for Entrust customers. Its absence from the current directory does not prove that a certificate will fail, but it means buyers should request stronger evidence before depending on broad mailbox display.
Evidence to request before purchase
- Certificate details: Get the exact VMC or CMC product name, root, and intermediate chain.
- Issuer evidence: Review the CPS, CT logging, CRL or revocation data, and current audit.
- Mailbox acceptance: Ask which target providers have vetted the chain, then confirm with test mail.
- Renewal behavior: Confirm whether a renewal changes the issuer or requires fresh validation.
Provider recommendations
DigiCert remains the practical default for new VMC work. It appears in the current BIMI Group issuer directory and has an established deployment record. DigiCert also sells Mark Certificates, which matters because some senders consider CMCs when a trademark-backed VMC is not the right fit.
GlobalSign and SSL.com are current listed alternatives, not merely future options to watch. Compare validation coverage, procurement terms, certificate format, and support for the organization's trademark jurisdiction. For a brand where Gmail and Apple logo display is the business case, run a pilot message and verify inbox rendering before production rollout.
Sectigo is the operational choice for former Entrust customers and a new direct VMC or CMC option. Because Sectigo is absent from the current BIMI Group issuer directory, obtain written confirmation of the exact chain and its acceptance by the mailbox providers that matter. Do not infer acceptance only because the certificate is available for sale.
DigiCert CertCentral style screen showing Mark Certificate orders and validation status.
How to rank the choices
- Conservative default: DigiCert for new production VMCs where broad support matters.
- Listed alternatives: GlobalSign and SSL.com after commercial and mailbox testing.
- Sectigo evaluation: Use for Entrust support or direct issuance after verifying acceptance.
- Retired path: Do not start a new Entrust ECS VMC purchase path.
DMARC comes first
A VMC will not rescue a weak authentication setup. BIMI requires a suitable logo asset, a correct BIMI DNS record, and DMARC enforcement. The From domain needs DMARC at p=quarantine or p=reject, with pct=100 and an aligned SPF or DKIM result passing for each mail stream that needs the logo.
Suped is our DMARC and email authentication platform, not a VMC issuer. Suped's DMARC monitoring turns aggregate reports into source-level remediation, shows SPF and DKIM alignment problems, and tracks authentication health before certificate procurement.
BIMI readiness by DMARC policy
Certificate-dependent BIMI implementations require enforced DMARC before displaying a logo.
Not ready
p=none
Reporting only, useful for discovery but not enough for BIMI.
Eligible enforcement
p=quarantine
Supported when applied to all mail with pct=100.
Strongest posture
p=reject
Rejects unauthenticated mail when legitimate mail is aligned.
Example enforced DMARC recorddns
_dmarc 3600 IN TXT ( "v=DMARC1; p=reject; rua=mailto:dmarc@example.com; " "adkim=s; aspf=s; pct=100" )
Before buying the certificate, run the domain through the domain health checker and fix authentication gaps. If the domain uses many sending services, Suped's hosted SPF and SPF flattening can keep DNS lookup limits under control while DMARC enforcement moves forward.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
BIMI record setup
Once the certificate is issued, the BIMI TXT record uses l= for the logo location when required and a= for the Mark Certificate PEM. When the certified logo is embedded in the PEM, a common certificate-backed record leaves l= empty. The PEM should contain the entity certificate followed by any supplied intermediate and root certificates in issuing order. Host the file at a publicly reachable HTTPS URL, and make sure the embedded SVG matches the validated logo and BIMI profile requirements.
Example certificate-backed BIMI DNS recorddns
default._bimi 3600 IN TXT ( "v=BIMI1; l=; " "a=https://example.com/bimi/vmc.pem" )
If DMARC is still being staged, use Hosted DMARC to manage policy changes without repeated DNS edits. Validate the authentication record with the DMARC checker before moving the domain to enforcement.
Flowchart showing the BIMI setup path from DMARC enforcement to monitoring.
A common failure pattern is buying the certificate first, then finding unauthenticated mail streams, an SPF lookup problem, or an SVG that fails validation. Clean DMARC first, prepare the logo second, buy the certificate third, and test the actual inboxes last.
How to choose safely
Use a short checklist before signing off on a VMC provider. A sales statement that the certificate is valid is not enough. The certificate must work for the receiver mix that matters to the business.
- Ask for issuer details: Get the root and intermediate CA names before purchase or renewal.
- Confirm the type: Use a VMC for a qualifying registered trademark, or a CMC when the use case fits.
- Check mailbox targets: Test Gmail, Apple Mail, Yahoo, and Fastmail if they matter.
- Validate expiration: Plan renewal well before the current Entrust certificate expires.
- Budget for validation: Trademark, organization, domain control, and logo checks take longer than DNS setup.
A practical rollout order
- Authentication: Inventory senders and fix SPF or DKIM alignment failures.
- Enforcement: Move DMARC to quarantine or reject with pct=100 after reports are clean.
- Validation: Prepare the SVG and complete VMC or CMC checks.
- Launch: Publish BIMI DNS and test real messages in target inboxes.
If the organization already has an Entrust VMC, inspect the certificate chain and expiration date. Do not assume the certificate stopped working when Entrust ended new VMC issuance. Entrust states existing VMCs remain valid through expiration, but that does not remove the need to plan the next renewal route.
For teams comparing VMCs with CMCs, decide whether the brand needs Gmail's verified checkmark, trademark-backed identity, or a supported BIMI logo without that checkmark. The certificate types are not interchangeable. The VMC and CMC comparison explains the cost and eligibility tradeoffs.
Where Suped fits
Suped is our DMARC and email authentication product for the work before and after VMC issuance. It helps teams find sending sources, fix authentication failures, stage policy enforcement, and track SPF, DKIM, blocklist (blacklist), and deliverability signals in one workflow.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
This matters for BIMI because authentication changes can interrupt logo display. If a marketing platform stops signing with aligned DKIM, or a new CRM sends outside the SPF plan, the domain can lose the authentication posture needed for BIMI. Suped's alerts and issue detection flag those changes for remediation.
For a fuller provider checklist, use the VMC issuer guide. For the separate issue of Apple and Entrust trust behavior, read the Apple distrust explanation before renewing an older certificate.
Views from the trenches
Best practices
Confirm the issuing CA chain, not only the vendor name shown in the sales process.
Test Gmail and Apple Mail before promising visible BIMI logos to a client or board.
Renew old Entrust VMCs early enough to avoid rushed validation and DNS changes safely.
Common pitfalls
Assuming an account migration changes the issuer inside an already issued VMC chain.
Treating a BIMI issuer listing as proof that every mailbox provider accepts it today.
Buying a certificate before DMARC enforcement and aligned DKIM are stable enough.
Expert tips
Keep screenshots of mailbox rendering tests for each issuer and renewal cycle every time.
Ask certificate vendors to name the exact certificate type and intermediate CA in writing.
Track BIMI records, certificate expiry, and DMARC policy changes in one workflow.
Marketer from Email Geeks says existing Entrust-issued VMCs should keep working until expiry, but new issuance needs a different route after the cutoff.
2025-05-02 - Email Geeks
Marketer from Email Geeks says the migration moved customers and account data, while the issuing CA remains the key trust detail for receivers.
2025-05-02 - Email Geeks
Final recommendation
For new BIMI deployments, use DigiCert as the conservative default. GlobalSign and SSL.com are also in the current Mark Certificate Issuer directory and should be compared on validation coverage, support, and commercial terms. Use Sectigo for former Entrust account support or consider its direct VMC and CMC products only after confirming the exact chain and target mailbox acceptance.
For existing Entrust customers, do not rush a renewal without evidence. Check the current certificate issuer, expiration date, and inbox behavior. Then choose the next issuer based on the mailbox providers the audience uses, not only the certificate price.
The VMC choice matters, but DMARC readiness comes first. Use an enforced DMARC policy with pct=100 and aligned SPF or DKIM. Without that foundation, a valid Mark Certificate cannot produce consistent BIMI display.
