What is the cost of VMC certificates and are there cheaper alternatives?
Published 29 Jul 2025
Updated 23 Aug 2026
12 min read
Summarize with
Updated on 23 Aug 2026: We updated the pricing examples, trademark cost guidance, certificate scope, and current DMARC requirements.
A VMC certificate normally costs about $1,350 to $1,416 per year at current direct public pricing. DigiCert lists its Mark Certificate subscription at $1,416 per year, while Sectigo advertises VMC pricing as low as $1,350 per year with a multi-year subscription. The cheaper certificate alternative is a CMC, which Sectigo advertises as low as $990 per year. Reseller offers can start around $749 for a VMC and $649 for a CMC, so compare the issuer, term, certificate scope, validation help, file hosting, and renewal support before treating a quote as equivalent.
The direct answer is that there is no legitimate free VMC. There is also no dependable free CMC path today, because both VMC and CMC issuance require manual identity and logo validation. Cheaper paths exist, but each one changes the outcome: use a CMC, buy through a reseller, publish BIMI without a certificate where supported, or delay the certificate until DMARC enforcement is stable.
- Typical direct VMC price: Budget roughly $1,350 to $1,416 per year for the certificate before extra scope or service costs.
- Cheaper certificate: A CMC starts around $990 direct or $649 through some resellers when a trademark is not ready.
- Lower VMC quotes: Some reseller prices start near $749, but certificate terms and included setup work vary.
- Cheapest path: BIMI without a certificate costs less, but Gmail does not support that path and other provider support is limited.
- Biggest hidden cost: Getting to DMARC enforcement without blocking legitimate mail often costs more than the certificate.
The short answer on VMC cost
Treat VMC pricing as an annual operating cost, not a one-off setup fee. You pay for the certificate, validation work, and renewal cycle. You also need the technical setup around it: DMARC at enforcement, working SPF and DKIM, a compliant BIMI SVG, and a BIMI DNS record that points to the logo and certificate.
Current public pricing depends on the term and sales channel. DigiCert Mark Certificates show a 12-month subscription price of $1,416. Sectigo lists VMC pricing as low as $1,350 per year with a multi-year subscription and CMC pricing as low as $990 per year. Reseller offers start around $749 for a VMC and $649 for a CMC. Sectigo's CMC and VMC differences page separates trademark validation from the rest of the BIMI work. Use every figure as a planning anchor, because renewal, domain scope, and support terms differ.
|
|
|
|
|---|---|---|---|
VMC direct | $1,350-$1,416 | Logo and Gmail checkmark | Trademark required |
VMC reseller | $749+ | Same certificate category | Check issuer and scope |
CMC direct | $990+ | Certified logo display | No Gmail checkmark |
CMC reseller | $649+ | Lower certificate price | Compare term and service |
BIMI only | $0 cert | Self-asserted logo | Limited display |
Public annual price examples in USD. Low direct prices can require a multi-year term.
Public annual price examples
Approximate direct public list prices and lower reseller starting prices.
DigiCert Mark Certificate
1,416 USD/yearSectigo VMC
1,350 USD/yearSectigo CMC
990 USD/yearReseller VMC
749 USD/yearReseller CMC
649 USD/yearBIMI without certificate
0 USD/yearWhy VMC pricing stays high
The price is high because a VMC is not a normal domain-validated certificate. The certificate authority has to validate the organization, domain control, logo ownership, trademark registration, and the person requesting the certificate. That is closer to extended validation work than to automated web TLS issuance. Manual logo evaluation is also why VMC and CMC issuance has not become a free, fully automated process.
The market is also small. VMC buyers are usually brands that already send enough email for inbox identity to matter. That keeps prices closer to other manual validation products than to low-cost web certificates.
What a VMC validates
- Trademark: The logo must match a registered mark or accepted government mark.
- Organization: The legal entity must pass business identity checks.
- Requester: The person requesting the certificate has to be validated.
- Domain: The domain must pass control and email authentication checks.
What a CMC changes
- Trademark: A registered trademark is not required.
- Logo history: The logo normally needs at least 12 months of public use.
- Cost: The price is lower because trademark validation is removed.
- Inbox result: The logo can display, but Gmail does not add its blue verified checkmark.
The certificate is rarely the only cost
The certificate line item is visible, but the bigger work is often DMARC enforcement. If a domain has years of marketing, product, support, billing, and sales senders, budget time for sender discovery, SPF cleanup, DKIM fixes, monitoring, and a controlled move to p=quarantine or p=reject.
Count trademark and certificate scope costs
A VMC can require a separate trademark budget when the logo is not already registered. In the United States, the federal base application fee is $350 per class. An intent-to-use application adds a $150 statement-of-use fee per class, and incomplete or custom goods and services descriptions can add more. Legal searches, attorney work, and responses to objections sit outside those government fees. Other jurisdictions use different fee schedules.
Trademark registration is also a timing cost. Current US processing data puts the average time between filing and registration or abandonment at about 9.7 months. Registering a mark only to qualify for VMC therefore does not create an immediate route to the inbox, and it does not replace the annual certificate renewal. A CMC can make more financial sense when the logo already has the required public-use history.
|
|
|
|
|---|---|---|---|
Base trademark filing | $350 | Per class | One-time government fee |
Statement of use | $150 | Per class | Applies to intent-to-use cases |
Attorney and search work | Variable | By filing complexity | Separate from government fees |
Extra logo or domain scope | Quote required | By certificate and SAN | Can multiply annual cost |
Illustrative US filing fees exclude attorney work and vary by application facts.
Certificate scope matters as much as the headline rate. Each unique logo can require another certificate. Some issuers can place multiple related domains on one certificate, but included domains, SAN charges, and validation rules vary. Ask for a written quote that lists every logo, base domain, subdomain, certificate term, and renewal price.
Cheaper alternatives that actually exist
The lower-cost paths are a CMC, a reseller quote, self-asserted BIMI, or waiting until the domain is ready. None produces the same result in every inbox, so choose based on whether you need Gmail's verified checkmark, whether the logo is trademarked, and whether the domain is already at DMARC enforcement.
For free VMC searches, the answer is no. Manual validation is the limiting factor: the issuer still has to validate the organization, requester, domain control, logo evidence, and certificate request. For logo display without a VMC, the answer depends on the receiving mailbox provider, and the limits are covered in this BIMI without VMC explainer.
DigiCert Mark Certificates pricing screen for VMC and CMC options.
|
|
|
|
|---|---|---|---|
CMC | Usually | No trademark | No Gmail checkmark |
Reseller VMC | Often | Price comparison | Scope and support vary |
BIMI only | Yes | Limited-provider display | Not supported by Gmail |
Wait and fix DMARC | For now | Unready domains | Delayed BIMI |
Use this to choose the cheapest path that still meets the inbox outcome you need.
CMC is the best cheaper certificate option
If you do not have a registered trademark, CMC is the clearest lower-cost certificate path. It still requires validation, DMARC enforcement, and a BIMI-ready logo, but it removes the trademark requirement. A Prior Use Mark CMC normally needs at least 12 months of public logo use. It can support certified logo display at Gmail and other accepting providers, but it does not trigger Gmail's blue verified checkmark. For a deeper side-by-side treatment, use this VMC versus CMC guide.
When auditing an existing BIMI setup, use the BIMI TXT record only to find the certificate URL in a=. The reliable VMC vs CMC signal is the certificate's subject:markType field. Registered Mark and Government Mark identify VMC, while Prior Use Mark and Modified Registered Mark identify CMC. If a= is blank or missing, the setup is self-asserted BIMI rather than VMC or CMC.
What to fix before buying
Do not buy a VMC or CMC until the domain can hold a DMARC policy of p=quarantine or p=reject. For new records, omit the historic pct tag; RFC 9989 removed it. BIMI eligibility depends on an enforced policy, consistent DMARC alignment through SPF or DKIM, and records that receivers can evaluate. If DMARC is still at p=none, spend the money on authentication cleanup first.
Suped's DMARC monitoring supports that pre-certificate workflow: collect aggregate reports, find every sender, identify SPF and DKIM failures, and move policy in controlled stages. For teams that need CNAME-based policy control, Suped's hosted DMARC workflow supports policy changes without repeated DNS edits.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Example DMARC record ready for BIMIDNS
v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com;
That record is only an example. The right policy depends on what your reports show. Before you move to enforcement, use a DMARC checker to validate syntax, then send real email and confirm passing authentication at the mailbox level.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Once DMARC is enforced, the BIMI record points to the SVG logo and, for VMC or CMC use, the certificate file. Keep the DNS record short and clear, and host both files on reliable HTTPS endpoints.
Example BIMI record with certificateDNS
v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem
How to choose without wasting money
Do not make this decision by asking whether $1,350 is expensive in isolation. The better question is whether a verified inbox logo is worth the annual certificate cost plus the work needed to keep the domain eligible.
For a brand that sends high-volume customer email, has a registered trademark, and already runs DMARC at enforcement, a VMC is usually a clean purchase. For a smaller sender still discovering mail sources, waiting keeps that budget available for authentication first. You can check the wider domain health before buying the certificate.
DMARC policy choices before a VMC
BIMI can qualify at quarantine or reject. Choose the policy your reports support.
Not ready
p=none
DMARC is monitoring only, senders are still unknown, or alignment gaps remain.
BIMI-capable
p=quarantine
Quarantine applies to failures and legitimate mail has been tested against the policy.
Strict enforcement
p=reject
Reject is appropriate only when reports show the domain can refuse failed mail safely.
VMC buying decision flow for DMARC readiness, trademark status, and CMC alternatives.
The practical order of operations
- Enforce DMARC: Reach quarantine or reject without blocking real mail.
- Fix the logo: Prepare a square SVG Tiny 1.2 profile logo under the size limit.
- Pick certificate: Use VMC for a registered mark, or CMC when the logo lacks registration.
- Monitor renewal: Track expiry, DNS changes, and authentication drift after launch.
Suped supports the work that makes VMC possible: reaching enforcement, finding authentication issues, monitoring policy, and keeping sending sources clean after launch. Suped's product also brings SPF, DKIM, DMARC, hosted SPF, hosted MTA-STS, blocklist monitoring (blacklist monitoring), alerts, and multi-tenant reporting into one platform, which matters when the certificate is only one part of the workflow.
Views from the trenches
Best practices
Confirm DMARC enforcement before pricing a VMC, because certificates will not fix policy gaps.
Budget for certificate renewal, trademark work, SVG cleanup, and DMARC monitoring.
Test BIMI with real messages after DNS changes, because inbox support varies by provider.
Common pitfalls
Buying a VMC before enforcement creates a certificate that cannot deliver value yet.
Treating CMC as a free path causes surprises because validation and renewals still apply.
Ignoring certificate expiry removes the logo and checkmark even when DNS still looks valid.
Expert tips
Use CMC when the logo has public history but the registered trademark is not ready yet.
Keep the BIMI SVG tiny, square, script-free, and hosted over reliable HTTPS before review.
Review aggregate DMARC reports weekly after enforcement so new senders do not break quietly.
Marketer from Email Geeks says VMC pricing feels high, but the certificate is one line item once DMARC enforcement, legal review, and logo validation are included.
2021-07-13 - Email Geeks
Marketer from Email Geeks says certificate prices tend to stay in a narrow band because validation is manual and the buyer pool is low volume.
2021-07-13 - Email Geeks
The practical buying decision
A VMC costs enough that it should only be bought when the brand has a clear reason to display a verified logo in supported inboxes and the domain is already technically eligible. If DMARC enforcement is not finished, the cheaper move is to finish DMARC first.
If the logo is not trademarked, choose CMC or wait for the trademark instead of forcing a VMC path. If the brand has a registered mark, sends meaningful email volume, and needs Gmail's verified checkmark, the annual VMC fee is easier to justify.
The cheapest useful plan is usually this: monitor DMARC, fix every sender, move to quarantine or reject, prepare the SVG, test BIMI, then buy the certificate that matches the logo's legal status. That sequence avoids paying for a certificate before the domain can use it.
