Are there any material differences between VMC issuers?
Updated on 17 Oct 2026: We clarified VMC issuer domain coverage, reseller support responsibilities, and DMARC requirements under RFC 9989.
Yes, there are material differences between VMC issuers, mostly in commercial terms and operational processes. DigiCert, GlobalSign, and SSL.com all issue Verified Mark Certificates for BIMI. If a mailbox provider accepts the issuer and your domain meets the BIMI requirements, each certificate has the same basic job: it binds a validated logo mark to your domain so the mailbox can show that logo.
The practical differences are price, domain packaging, validation process, support quality, renewal terms, and acceptance by the mailbox providers you care about. The current public BIMI Group issuer list names DigiCert, GlobalSign, and SSL.com as Mark Verifying Authorities (MVAs). The BIMI Group also says that inclusion does not guarantee that every mailbox provider will accept an issuer's certificates.
- Direct answer: Do not pay more because one VMC has better deliverability mechanics. Pay more only if the issuer gives you faster validation, better domain packaging, confirmed mailbox acceptance, or procurement fit.
- Get written quotes for your actual domain list, with the same support scope, renewal price, and reissue terms. For example, compare one main organizational domain plus six additional domains on every quote.
- Before buying: Fix DMARC, prepare the trademark evidence, validate the SVG Tiny PS logo, and confirm the VMC will cover the domains you plan to use in BIMI.
What actually differs between issuers
VMC issuer selection is a buying and execution decision. Email authentication depends on DMARC, SPF, and DKIM. The VMC issuer validates your right to use the mark and issues the certificate referenced by your BIMI DNS record.
For a single-domain purchase, the difference is often price and administrative effort. For a multi-domain purchase, packaging can become a major budget item. For a time-sensitive launch, the issuer's evidence review and support response time affect the issuance date. Logo display still depends on sender reputation and each mailbox provider's display rules.
|
|
|
|---|---|---|
Annual subscription with hosted files and 24x5 support; separate certificates per base domain and logo | Per-domain and per-logo pricing, reissues, and renewal total | |
Optional SANs for multiple domains; published 30-day DMARC preparation requirement | SAN fees, validation timing, and renewal total | |
One-year and multi-year pricing with hosted SVG; separate VMCs per sending domain | Separate-certificate costs, validation timing, and renewal terms |
Current VMC issuer comparison at a practical buying level.
DigiCert CertCentral order screen for a Verified Mark Certificate.
Acceptance is receiver-specific
Being listed as an MVA does not force every mailbox provider to accept that issuer. Before buying, ask the issuer to confirm current support for your target mailbox providers and keep that confirmation with the quote.
- Issuer status: Check whether the issuer is accepted by the mailbox providers where your audience opens mail.
- Trust material: Confirm that the certificate chain and CRL endpoints are current, then review the issuer's latest audit position.
- Support trail: Keep written confirmation of domain coverage, reissue rules, and renewal pricing.
The technical certificate is usually not the differentiator
A VMC is not a deliverability accelerator by itself. It does not make SPF pass, repair DKIM alignment, or move a DMARC policy to enforcement. It is part of the BIMI chain after the authentication foundation is already working.
Usually the same
- BIMI role: The VMC validates the brand mark used by the BIMI DNS record.
- Policy need: The domain still needs DMARC enforcement for major BIMI display paths.
- Logo need: The SVG must match BIMI formatting rules and the validated mark.
Often different
- Price shape: Base price and additional domain pricing can diverge sharply.
- Validation help: Issuer intake and support can change how quickly evidence problems are resolved.
- Renewal terms: Revalidation, reissue, and extra domain rules change the total cost.
The technical comparison matters most when an issuer has a mailbox-provider acceptance gap, a certificate chain issue, or a revocation problem. Confirm those points before purchase, but do not mistake the issuer name for a deliverability advantage.
VMC issuer choice depends on price, validation, domains, and acceptance.
Price and domain packaging are the biggest differences
For a multi-domain order, quote structure can matter more than the certificate brand. Public US list prices show $1,752 for DigiCert's 12-month VMC subscription and $1,500 for SSL.com's one-year VMC. GlobalSign's order flow supports SANs for multiple domains, but confirm its final domain and renewal terms in the quote.
Published one-year VMC base prices
Advertised annual totals in USD before taxes or add-ons. Domain coverage, hosting, discounts, and renewal terms differ.
SSL.com one-year price
1,500 USDDigiCert annual subscription
1,752 USDThe base certificate price is only one line item. DigiCert's product guidance specifies a certificate per unique base domain and logo, while SSL.com states that each sending domain requires its own VMC. Ask whether an additional domain is added as a Subject Alternative Name (SAN), requires separate validation, triggers a reissue, or needs a separate certificate. Ask separately about extra logos. The answer changes both the initial invoice and the renewal cost.
Subdomains need a specific answer
A BIMI record at the organizational domain can be inherited by subdomains that do not publish their own record. DNS inheritance alone does not grant certificate coverage; the inherited assertion must also satisfy the certificate domain checks. Separate subdomain assertions, selectors, or logos can change the required certificate scope, so put the exact design into the quote request.
- Ask clearly: Will an organizational-domain VMC cover mail from mail.example.com and news.example.com under the planned BIMI records?
- Check DNS: Make sure the BIMI lookup path and selector resolve to the intended organizational-domain or subdomain record.
- Price renewal: Confirm whether adding a domain later resets validation or triggers a new certificate fee.
Buying directly or through a reseller
The seller and the issuing certificate authority (CA) are not always the same company. A reseller changes the purchase and support path, while the named CA controls certificate approval and issuance. Confirm the issuing CA on the quote rather than counting the seller as an additional VMC issuer.
- Ask whether the quote includes trademark eligibility and SVG prechecks or only certificate issuance.
- Identify who answers CA evidence requests, and request a validation contact with a response target.
- Confirm who hosts the SVG and PEM files, maintains those URLs, and replaces the certificate at renewal.
- Document certificate account access, cancellation terms, and responsibility for renewal reminders.
Buying directly suits teams that can manage validation and BIMI deployment internally. Compare the added support in a reseller quote against the same CA-issued certificate bought directly. The purchase channel does not override mailbox-provider acceptance or guarantee logo display.
What the validation process actually checks
The core VMC checks come from shared issuance requirements, but issuers differ in how they collect evidence and resolve exceptions. A clean application proves the organization exists, the applicant is authorized, the organization controls each requested domain, and the organization owns or is licensed to use the registered mark.
- Organization and applicant: Prepare official registration details, a reachable business contact, and evidence that the certificate approver can act for the organization.
- Domain control: Expect control validation for the FQDNs requested in the certificate, and involve the DNS team before the order starts.
- Trademark rights: Provide the registration number and trademark office, and confirm the issuer accepts that office and mark. If another entity owns the mark, prepare a valid licence or authorization letter.
- Logo match: The submitted SVG must match the registered mark, including the colors the trademark record permits.
- A VMC can be valid for no more than 398 days under the Mark Certificate Requirements. A multi-year purchase covers successive certificates, so compare revalidation work and replacement-file handling as well as first-year price.
CAA can block the chosen issuer
Issuers must check CAA before issuing a VMC. If your DNS publishes an issuevmc restriction, it must authorize the issuer selected for every covered FQDN. Review CAA before paying or switching issuers. CAA issue and issuewild tags for TLS certificates do not authorize or restrict VMC issuance.
Ask each issuer whether it will precheck the trademark record and SVG, which domain-control method it will use, what identity step the approver must complete, and what happens if the evidence needs correction. Those answers expose the operational difference better than a base price alone. GlobalSign's published prerequisites require DMARC enforcement 30 days in advance. Treat that as an issuer preparation requirement, and ask each issuer when its validation clock starts.
DMARC readiness matters more than the issuer
The most common VMC mistake is buying the certificate before the domain is ready. BIMI requires messages to pass DMARC through SPF or DKIM alignment, with p=quarantine or p=reject at the organizational domain and enforcement covering the sending subdomain. A policy of sp=none leaves covered subdomains ineligible. If DMARC is still at p=none, the VMC can sit unused.
RFC 9989 makes pct historic. Older BIMI documentation still refers to pct=100; omitting pct retains the older default of 100 without adding a historic tag to a new record.
Suped is our DMARC reporting and email authentication platform. Its DMARC monitoring workflow supports a VMC project by showing which senders pass SPF or DKIM with DMARC alignment, which sources fail, and what still blocks a safe move to enforcement.
Example DMARC TXT record for BIMI readinessdns
_dmarc.example.com. 3600 IN TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com;"
If DNS access is slow or split across teams, Suped's Hosted DMARC can make policy staging easier because day-to-day policy changes happen in Suped instead of repeated DNS edits. For a focused record check, use the DMARC checker before sending a VMC application.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
After DMARC is stable, the BIMI record points to the approved SVG in l= and the VMC certificate chain in a=. Both must be publicly retrievable over HTTPS. Confirm whether hosting and replacement PEM publication are included in the quote. An expired certificate or broken fetch can stop logo display even when email authentication still passes.
Example BIMI TXT record with a VMC URLdns
default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/bimi.svg; a=https://example.com/vmc.pem;"
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
How to choose between DigiCert, GlobalSign, and SSL.com
Make the issuers quote the same package, then choose the best combination of confirmed mailbox acceptance, total cost, validation clarity, and support. Do not compare a base one-domain price against a bundled multi-domain quote.
- Mailbox fit: Ask each issuer to confirm support for the mailbox providers that matter to your audience.
- Domain scope: List the main domain, each additional organizational domain, every sending subdomain, and any alternate selectors.
- Logo proof: Prepare trademark documents and match the SVG to the registered mark you expect to validate.
- Quote details: Ask for first-year cost, renewal cost, add-on domain fees, reissue fees, and refund terms.
- Support path: Ask who handles validation questions and how quickly evidence issues are reviewed.
- Exit plan: Confirm how renewal, cancellation, revocation, and issuer migration work before you pay. Switching CAs requires a new certificate and the new CA's validation; arrange replacement hosting and the BIMI a= URL before the old certificate expires.
|
|
|
|---|---|---|
One domain | Compare first-year and renewal totals | Public pricing changes |
Several domains | Compare SAN and domain scope line by line | Packaging drives total cost |
Strict launch date | Compare validation support and response targets | Evidence delays vary |
DMARC not ready | Wait before applying | Enforcement comes first |
A compact buying guide for common VMC situations.
Practical recommendation
If all three issuers are accepted for your target mailbox providers, choose the lowest total-cost issuer that gives clear written answers on domain coverage, validation, and renewal. Do not pay a large premium for the issuer name alone.
- For one domain: Support quality and validation speed can matter as much as price.
- For many domains: Additional domain fees usually decide the lowest-cost quote.
- For tight launches: Pick the issuer that gives named validation contacts and clear evidence guidance.
Views from the trenches
Best practices
Ask each issuer for main domain and add-on domain pricing in writing before approval.
Confirm the VMC subject, trademark evidence, logo file, and BIMI DNS selector early.
Keep DMARC at quarantine or reject before treating a VMC quote as launch-ready today.
Common pitfalls
Comparing base certificate price only misses add-on domain fees and validation delays.
Buying a VMC before fixing DMARC leaves the logo blocked by mailbox provider checks.
Assuming one issuer works everywhere ignores mailbox provider acceptance and root trust.
Expert tips
Map organizational-domain inheritance and separate subdomain BIMI records before quoting.
Request renewal terms, revalidation steps, and support paths before signing the quote.
Document every BIMI selector, SVG URL, VMC URL, and DMARC policy in one runbook.
Marketer view
Marketer from Email Geeks says the current issuers produce largely equivalent VMC outcomes for BIMI, so price and process usually drive the decision.
2026-01-20 - Email Geeks
Marketer view
Marketer from Email Geeks says GlobalSign quote examples have been lower for additional domains than DigiCert quote examples in multi-domain buys.
2026-01-20 - Email Geeks
