Mark certificate: what it is, VMC vs CMC, and what it needs

A mark certificate is a certificate that a certificate authority issues after an independent check that a brand has rights to a logo. A mailbox provider can read it, together with a BIMI record in the sender's DNS, when it decides whether to show that logo beside authenticated email. It is separate from the SSL certificate on a website: it answers who holds rights to a logo, not which server answers for a domain.

Issuer

a certificate authority, in accordance with the Minimum Security Requirements for Issuance of Mark Certificates

Two kinds

Verified Mark Certificate (VMC) and Common Mark Certificate (CMC)

Verified by

an independent Mark Verifying Authority (MVA), which confirms the brand's rights to the mark

Works with

BIMI, specified in an IETF Internet-Draft

Depends on

a DMARC policy of quarantine or reject on the organizational domain

Result

a brand logo that a mailbox provider can show next to an authenticated email

VMC and CMC: the two kinds of mark certificate

The BIMI draft defines two kinds of mark certificate, and an MVA issues both. A verified mark certificate (VMC) supports a logo that represents a registered trademark or a government mark. A common mark certificate (CMC) supports a logo that represents a prior use mark or a modification of a registered trademark.

This page says mark certificate when a point holds for both kinds, and VMC or CMC when the basis of the logo matters.

The DV, OV and EV levels in DV, OV and EV certificates classify TLS server certificates. A mark certificate is issued under its own requirements document, and it confirms rights to a logo rather than control of a server.

Where BIMI fits

BIMI, Brand Indicators for Message Identification, lets a domain owner publish the logo it wants shown. It also gives mail systems a way to verify that the logo is genuine. The published record is a DNS TXT record. It points to the SVG logo and, optionally, to a mark certificate.

BIMI does not change message delivery. The BIMI Group FAQ describes it as a display signal on top of strong authentication, and it sets the bar at DMARC alignment.

A record with no certificate is called self-asserted. The BIMI Group describes it as the simplest class: the logo is published without being verified as belonging to the domain. Its FAQ adds that some mailbox providers accept such a record and may show the logo without a VMC. The certificate adds the independent check on rights to the logo.

What an application needs

The BIMI Group lists these requirements for a VMC:

1. A registered trademark for the image. Supported jurisdictions are named in the BIMI Group VMC guidelines.

2. An SVG Tiny P/S version of the logo.

3. DMARC enforcement on the organizational domain: p=quarantine or p=reject, with no sp=none and no pct<100.

4. A BIMI record for the domain in DNS.

The MVA also asks for organization identity documents and proof of rights to the mark, such as a trademark registration or statutory protection. Pricing varies by MVA, so this page gives no figures.

A checklist before you apply

Work through the points in order. The first one that fails is the next task.

1. Pick the basis. A registered trademark or a government mark points to a VMC. A prior use mark or a modified registered trademark points to a CMC. With no evidence of rights, only a self-asserted record remains.

2. Read the DMARC policy on the organizational domain. Quarantine or reject passes. A subdomain policy of sp=none fails, and so does pct<100.

3. Check the file type. The logo must be an SVG Tiny P/S file. The BIMI Group publishes conversion tools for logos that are not.

4. Fetch the logo as an outside client. The file must be publicly accessible over HTTPS, with the correct content type and caching. A logo hosted on a different domain from the BIMI record is fine. Robots rules, geo-fences, IP allowlists and CDN rules that deny provider fetches can block the fetch.

5. Collect the evidence. That means organization identity documents and proof of rights to the mark.

6. Test after publishing. Send aligned mail to test inboxes and look at the display on the provider's side. Caching and reputation can delay or limit display.

What a mark certificate does not do

It does not change delivery. BIMI is a display signal, not a delivery mechanism.

It does not replace authentication. BIMI requires DMARC alignment at a minimum, so the DMARC policy has to be in place first.

It does not guarantee display. The BIMI Group words the goal as a logo that mailbox providers can consider displaying beside authenticated emails, and it notes that caching and reputation can delay or limit display.

It does not secure a website connection. That job belongs to the SSL certificate on the site.

For a server's SSL certificate, how trust reaches it through intermediate certificates is explained on the certificate chain page.

FAQ

Sources

1. IETF Internet-Draft, Brand Indicators for Message Identification (BIMI): definitions of mark certificate, VMC, CMC and MVA; DMARC condition.

2. BIMI Group, Verified Mark Certificates (VMC) and BIMI: VMC requirements and self-asserted records.

3. BIMI Group FAQ: what BIMI does and does not change, logo hosting, evidence, testing.