The Business Verification Checklist for 2026, in Priority Order

The short version

Most of the verification that matters for a small US business is free. The paid ones are worth buying only after the free ones are done, and one of them requires a registered trademark you probably do not have yet.

Here is the order we would run it in. Each step either makes the next one possible or is cheap enough that skipping it makes no sense.

• 1. SPF, DKIM and DMARC at enforcement. Free. Six other items on this list depend on it.
• 2. Google Business Profile. Free. The biggest single return of anything here.
• 3. Meta business verification. Free. Not the same thing as Meta Verified.
• 4. Bing Places. Free. Ten minutes if your Google profile is already verified.
• 5. Apple Business Connect place card. Free.
• 6. LinkedIn identity and workplace verification. Free.
• 7. D-U-N-S number. Free, but slow, so start it early.
• 8. Apple Branded Mail. Free. Logo in Apple Mail with no trademark required.
• 9. Self-asserted BIMI. Free. Logo in Yahoo and Fastmail.
• 10. CMC or VMC for Gmail. Paid, roughly $650 to $1,500 a year.
• 11. Meta Verified and X Premium Business. Paid subscriptions. Judge on merit.

Step 1: email authentication, because everything stacks on it

SPF, DKIM and DMARC are three DNS records that tell receiving mail servers which systems are allowed to send email as your domain, and what to do when something fails the check. They cost nothing beyond the DNS edits.

Get this wrong and Apple Branded Mail, BIMI and the Gmail logo are all closed to you. The requirement is specific. Your DMARC policy must be p=quarantine or p=reject on the organizational domain. The pct tag must be absent or explicitly set to 100. The subdomain policy sp= must not be left at none. A policy of p=none does not qualify anywhere, at any provider.

The failure mode is going straight to p=reject. Your invoicing tool, your helpdesk and your email platform all send on your behalf, and if any of them is not aligned, that mail starts bouncing silently. Publish p=none with an rua reporting address first, read the aggregate reports for a few weeks, fix every legitimate source, then move to quarantine, then reject.

Step 2: Google Business Profile (free)

This is the highest return item on the list, and it is free. Google now defaults to video verification in a lot of cases, which is where most people fail.

What the video has to be:

• Recorded live inside the Google Maps mobile app, signed into the account that manages the profile. Desktop uploads and pre-recorded files are rejected outright.
• One continuous, unedited take of at least 30 seconds.
• Exterior signage plus a street identifier, such as a street sign or a building number.
• Your business name visible on signage or branded material, matching the profile exactly.
• Proof you actually run the place. Opening the till, the stockroom, the back office, branded tools in the van for a service business.
• Review takes up to five business days.

Do not touch the profile after it verifies

Once you are verified, resist the urge to tidy everything up in one sitting. Changing the name, address, primary category and phone number all at once is the pattern Google associates with a hijacked listing, and it can trigger a re-review or an outright suspension.

Change one field, wait, then change the next. If you are suspended, fix the underlying problem before you appeal. Appeals are limited and a denial makes the next attempt harder. Screenshot your name, address, categories, hours and service area now, so you have a record of what the profile looked like when it was healthy.

Step 3: the free afternoon

These five take a few hours total and cost nothing.

Meta business verification lives in Business Settings under Security Center. It is free, and it is not the blue check. It confirms your legal entity so you get higher API access and more account trust. Your legal entity name has to match an official registration or tax document exactly, and the address or phone on that document has to match what you typed. Reviews run from a few minutes to about two weeks.

Bing Places is free with no paid tier. If your Google profile is already verified, import it. Bing will usually verify you instantly and keep the two in sync.

Apple Business Connect claims your place card across Apple Maps, Siri, Wallet and Messages. Free. Apple moved its brand tools under Apple Business in April 2026, so older walkthroughs will not match the current menus.

LinkedIn verification is free for everyone and always has been. Identity runs through CLEAR in the US, Canada and Mexico, or Persona elsewhere. Workplace verification runs off a work email address or Microsoft Entra. Nobody needs Premium for this.

A D-U-N-S number from Dun and Bradstreet is free. Standard issue can take up to 30 business days, so file the request now even if you do not need it yet. Expedited service exists and is paid.

Step 4: get your logo in the inbox for free

Two of the logo programs cost nothing. Do both before you consider paying for the third.

Apple Branded Mail puts your logo next to your name in Apple Mail. It is free and requires no trademark. You need an Apple Business Connect account, Apple has to verify the business, and your brand and logo have to be approved. You verify the sending domain with a TXT record. DKIM is mandatory and SPF alone is not accepted. DMARC has to be at quarantine or reject. You get 14 calendar days to finish domain verification before the process resets and you start over, and final review usually runs five to seven days. One brand covers up to 100 combined domains, subdomains and specific addresses.

Self-asserted BIMI gets your logo into Yahoo and Fastmail. BIMI is a DNS record pointing at a logo file. Publish it without the certificate tag and it is free:

default._bimi.example.com IN TXT "v=BIMI1; l=https://example.com/logo.svg;"

The logo must be SVG Tiny PS, which is a restricted profile of SVG, not an ordinary SVG export. Gmail and Apple Mail will ignore a self-asserted record because both want a certificate. Yahoo and Fastmail will show it.

Step 5: Gmail, where it stops being free

Gmail accepts two certificate types, and the difference between them is the whole decision.

A Common Mark Certificate needs no trademark. The certificate authority instead checks that your logo has been in continuous public use for around 12 months, often against web archive records of your own site. It gets your logo into Gmail. It does not produce the blue checkmark. Expect roughly $650 to $1,200 a year depending on the issuer and the term you buy.

A Verified Mark Certificate requires a trademark registered with a national or regional IP office. It gets you the logo and the blue verified checkmark next to your sender name in Gmail. Expect roughly $780 to $1,500 a year. You add the a= tag to the BIMI record pointing at the PEM file.

If you do not already hold a trademark, the certificate is not the real cost. USPTO base filing is $350 per class in 2026, under the single-fee system that replaced TEAS Plus and TEAS Standard in January 2025. Surcharges stack on top, per class: $100 for incomplete information, $200 for writing your own goods and services description instead of picking from the ID Manual, and $200 for each additional 1,000 characters. Registration takes many months. If the checkmark is worth waiting a year for, file. If it is not, buy a CMC and move on.

Step 6: the subscription badges

These are recurring costs with no permanent asset at the end, so treat them as marketing spend rather than infrastructure.

Meta Verified starts around $14.99 a month, and the business tiers climb into the hundreds. Pricing varies by country and Meta changes it without much notice, so treat the checkout screen inside your own account as the only source of truth. It is priced per Facebook Page, Instagram account or WhatsApp number, so a brand running several assets pays several times over. We run it on our own Instagram account of about 52,000 followers. The impersonation protection and the direct support line are the real value. The badge itself is not.

X Premium Business is $200 a month or $2,500 a year for Basic, and $1,000 a month for Full Access, which adds affiliate badges, priority handles and impersonation defense. If X is not already producing revenue or inbound for you, this is an easy no.

What we would tell you not to buy

Being useful here means saying no to some of this.

• A VMC when you hold no trademark and have no plan to file one. Buy a CMC, get the logo, skip the checkmark.
• Any badge on a platform that is not already producing revenue or inbound for you. A badge does not create an audience.
• Anyone selling a guaranteed verification. Platforms decide. A vendor promising the outcome is either guessing or planning to submit something untrue on your behalf.
• Anyone who asks for your account password, a photo of your driver's license or passport, or a card number to hold. We never take any of those, and no legitimate provider needs them.

Working with us

We ran this entire stack on our own business first, a hockey apparel store called Bench Clearers. VMC through GlobalSign, BIMI live in Gmail with the blue check, and Meta Verified on the Instagram account. We know where each of these breaks because we broke them. We work only through official channels, we never ask for passwords, government ID documents or card numbers, and if we do not believe a piece of this can succeed for your business we will say so and decline the work rather than take the fee. Most of the list above you should genuinely do yourself. Talk to us about the parts you should not.