A Mark Certificate is a digital certificate that enables a brand’s logo to appear next to an email in supported inboxes through the BIMI standard. By displaying your verified logo, Mark Certificates help recipients visually confirm your identity which boosts brand recognition, strengthens email engagement, and reduces the risk of phishing or spoofing. A domain must have proper authentication (DMARC, SPF, DKIM), and the logo must meet BIMI and SVG requirements to use a mark certificate. There are Verified Mark Certificates (VMC) and Common Mark Certificates (CMC) available.

BIMI (Brand Indicators for Message Identification) is an email authentication standard that displays a brand’s logo in supported email clients. For Gmail users, Google displays a blue checkmark next to the sender’s name to indicate a verified logo. A VMC (Verified Mark Certificate) is a digital certificate issued by a trusted authority that verifies logo ownership, often required for BIMI implementation. CMC (Common Mark Certificate) shares a common goal of verifying logo ownership but does not require a registered trademark. CMCs are a faster and more accessible path to BIMI compliance, however they do not trigger the Gmail blue checkmark.

BIMI works alongside email authentication tools like SPF, DKIM and DMARC to visually prove that a sender is legitimate, helping their messages stand out and be trusted in recipients’ inboxes. SPF (Sender Policy Framework) prevents email spoofing by allowing domain owners to specify which mail servers are authorized to send emails on behalf of their domain. DKIM (DomainKeys Identified Mail) adds a security layer by allowing the sender to attach a digital signature to the email to confirm the sender's identity and to verify the content has not been altered in transit. DMARC (Domain-based Message Authentication Reporting & Conformance) builds on SPF and DKIM by providing a policy framework that tells receiving mail servers how to handle emails that fail SPF or DKIM checks. It also allows domain owners to receive reports on email authentication results.

BIMI works by linking your email address to your brand’s logo using DNS records. To become BIMI compliant, companies must ensure that their emails are authenticated using SPF, DKIM and DMARC, then set up a DNS record that points to their logo image and VMC. SPF confirms who can send emails on your behalf, DKIM adds a digital signature to prove they haven’t been altered, and DMARC ties it all together to prevent spoofing and phishing.

BIMI-participating mailbox providers like Gmail, Apple Mail and Yahoo check the BIMI record when receiving emails from the company’s email domain. If DMARC passes, it will verify if there is a BIMI record in DNS for the sender domain name (and so be re-directed to the VMC and logo image to display); if DMARC fails, it won’t look for BIMI.

VMC logos are currently supported in inboxes of email clients that implement BIMI — including Gmail, Yahoo Mail, Apple Mail, Zoho Mail, Fastmail, La Poste, Onet.pl, Zoner, and au.com. Gmail also displays a blue checkmark for verified senders with VMC. An updated list of mailbox providers is maintained by the BIMI group.

Mark Certificates are valid for one year. PositiveSSL offers Mark Certificates through Sectigo. Sectigo offers its customers multi-year subscriptions on Mark Certificates, up to three years, which ensure continuous coverage and cost-saving benefits.

If your organization has one domain and one logo, you may only need one VMC or CMC. If you have multiple domains for which you would like one and the same logo to be displayed in the recipient's inboxes, you can use one VMC or CMC for all domains. If you have multiple logos you wish to display in recipient’s inboxes, you need one certificate per unique logo.