How to Get a Verified Mark Certificate from DigiCert

What a DigiCert VMC actually is

A Verified Mark Certificate is a digital certificate that lets your logo appear next to your name in the inbox. It is the credential half of BIMI, which stands for Brand Indicators for Message Identification. BIMI is the standard that tells mailbox providers where to find your logo and where to find proof you are allowed to use it.

DigiCert is one of a small number of certificate authorities authorized to issue VMCs. Buying the certificate is not what makes your logo appear. Three things have to be true at once: a DMARC policy at enforcement, a BIMI record in your DNS, and a valid certificate that the record points to. Miss any one of the three and the inbox shows nothing. There is no partial credit.

A VMC is also what unlocks the blue verified checkmark in Gmail. DigiCert's other product, the Common Mark Certificate or CMC, gets your logo displayed but does not get you the checkmark.

What DigiCert charges

DigiCert lists the Verified Mark Certificate at $1,752.00 per certificate per year, sold as a 12-month auto-renewing subscription. The Common Mark Certificate lists at $1,416.00 on the same terms, so the VMC carries a $336 premium. Price is part of the difference between the two products, alongside what kind of mark you may use and whether you get the checkmark. The difference is what kind of mark you may use and whether you get the checkmark.

DigiCert's product page frames the same products monthly, at $146 per month for the VMC and $118 for the CMC, and both multiply out to the annual prices exactly. The separate comparison page still shows $124 and $125 per month against those same annual figures, so DigiCert's own pages do not reconcile cleanly. Read the number in the cart before you agree to anything, and confirm the renewal price rather than assuming it matches year one.

The subscription includes logo and certificate file hosting, access to the CertCentral management portal, and DigiCert 24x5 standard support.

The maximum validity for a mark certificate is 397 days. This is not a buy-once purchase. You revalidate roughly every year, and the identity check can come around with it.

Resellers quote different numbers, sometimes meaningfully lower. We paid about $780 a year for our own certificate through a reseller of a different certificate authority. Cheaper is real. Just read what falls out of the package, because validation support and file hosting are exactly the parts that go wrong.

DMARC at enforcement is the gate before the gate

Before DigiCert issues anything, your domain needs a published DMARC record at enforcement. That means a policy of p=quarantine or p=reject. A policy of p=none does not qualify.

Getting there is the part most people underestimate. Moving to enforcement before every legitimate sending source is aligned is how you silently quarantine your own invoices, your helpdesk replies, and your order confirmations. The right sequence is to run p=none with aggregate reporting for several weeks, read the reports, fix SPF and DKIM alignment for every sender you find in them, and only then tighten the policy.

The certificate is the cheap part of this project. DMARC enforcement is the work, and it is the part that carries the actual security benefit.

The trademark requirement is the real filter

DigiCert will not issue a VMC against a pending trademark application. The registration has to be granted and active on the day a validation specialist looks at it.

DigiCert also publishes a specific list of intellectual property offices it recognizes, and the list is short. It includes the United States Patent and Trademark Office, the Canadian Intellectual Property Office, the European Union Intellectual Property Office, the UK Intellectual Property Office, the Deutsches Patent- und Markenamt, the Japan Trademark Office, the Spanish Patent and Trademark Office, IP Australia, Intellectual Property India, the Korean Intellectual Property Office, INPI Brazil, INPI France, the Benelux Office for Intellectual Property, the Danish office, the Swedish Intellectual Property Office, the Swiss Federal Institute of Intellectual Property, and the Intellectual Property Office of New Zealand. Government marks and seals also qualify. Check DigiCert's current list before you file anything, because a perfectly valid registration from an office not on it counts for nothing here.

Here is the trap that kills more applications than any other requirement. The logo in your certificate has to match the registered mark. A validation specialist puts your SVG next to the registration image and compares them. If you rebranded after registering, or your registration is a black and white line drawing while your live logo is a colour lockup with a tagline attached, you have a mismatch and you will be rejected.

We hit this on our own certificate. The mark you filed and the mark you send email with have to be the same mark. Resolve that before you spend anything, because the fix is either a new trademark filing or a logo you may not want to use.

If your trademark is pending, or you never filed one, the CMC is the fallback. It accepts a prior use mark, meaning a logo you can demonstrate you have used for at least 12 months on a domain you control. DigiCert can verify that history through Archive.org. Cheaper at $1,416 a year, logo displays in providers including Gmail and Yahoo, no blue checkmark.

Your logo has to be SVG Tiny PS

BIMI requires the logo as an SVG in the Tiny Portable/Secure profile, a restricted subset of the W3C's SVG Tiny 1.2 standard. The restrictions strip out anything that could be abused: no scripts, no animation, no external references, no embedded raster images.

Almost no design tool exports this profile natively. Expect to hand-edit XML or run the file through a converter. Beyond the profile itself:

• A square viewBox. A viewBox of 0 0 800 400 fails the 1:1 requirement outright.
• Gmail wants a minimum of 96 by 96 and the size declared in absolute pixels.
• The mark centred, so it survives being cropped to a circle or a rounded square.
• A solid background rather than transparency, which renders unpredictably across clients.
• A title element inside the SVG.

The five validation steps DigiCert runs

Once you order, DigiCert runs a five-step process. Knowing the order helps, because each step can bounce back to you for more documents.

Step one is organization and domain validation, run to Extended Validation standards. DigiCert confirms your legal entity exists and that you control the domain the certificate covers.

Step two is SVG logo validation. You upload the file through CertCentral and DigiCert checks it for BIMI compliance and for the match against your registration.

Step three is trademark verification. You supply the registration number and the name of the issuing office at the point of upload, and a validation specialist confirms the logo matches the official record.

Step four is identity verification, covered below. It is the step that surprises people.

Step five is final approval. Your designated Extended Validation approver receives an approval email, and the certificate issues once they act on it. Make sure the person named as approver knows they are the approver and is not on holiday.

Identity verification: the video call or the notary

A VMC requires a named human to prove who they are, not just that the company exists. An authorized representative of the organization picks one of two routes.

The first is a live video call with a member of DigiCert's validation team. You join the call, hold a valid government photo ID up to the camera, and complete a liveness check. DigiCert asks you to join from a well-lit location and to disable virtual backgrounds.

The second is a notarized identity declaration completed by a DigiCert-approved notary or lawyer.

The video call is usually faster if you can get the scheduling to line up. The notary route is the better option when the authorized representative cannot make a call inside the window.

Be clear on where the line sits here. We prepare the representative, brief them on exactly what the specialist will ask, and stay alongside for the call. We never take custody of a passport, a driver's licence, or any government ID document. The person on the call holds their own ID up to their own camera. Any provider offering to handle that part for you is proposing something you should decline.

Logo hosting and the BIMI record

After issuance DigiCert gives you a PEM-encoded certificate chain file. That file and your SVG both have to sit on a publicly reachable server over HTTPS. Plain HTTP fails.

DigiCert will host both files for you as part of the subscription, and this is worth taking. Their hosting matches the PEM file byte-for-byte to the SVG and updates both automatically on every renewal and reissue. Self-hosting means you own the byte-match problem yourself and you have to remember to swap both files each renewal cycle. That is a quiet way to lose your logo twelve months from now.

Publishing the DNS record is still on you. It is a TXT record at default._bimi on your domain, in this shape:

v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/certificate.pem

CertCentral shows the hosted URLs on the Order details page, in the Logo and certificate hosting settings section.

How long it actually takes

DigiCert says that once all necessary documentation is verified, it can usually issue the certificate the same day. That is accurate and also misleading, because the clock that matters starts well before you place an order.

Realistic timing looks like this:

• Trademark registration, if you do not already hold one: eight to eighteen months depending on the office and whether you receive an office action. This dwarfs everything else in the project.
• DMARC from p=none to enforcement, done properly: four to eight weeks.
• SVG conversion and format validation: a day or two, longer if the logo needs rework to match the registration.
• DigiCert validation once you order: one business day to over a week, driven almost entirely by how fast you return documents and how fast your representative completes the identity step.

What DigiCert does not do after issuance

DigiCert issues certificates. That is the scope of what you bought, and it is worth being clear about the gap.

They do not publish your BIMI DNS record. You do that, and a typo there means no logo with no error message anywhere.

They do not manage or monitor your DMARC. If a sending source drifts out of alignment months from now and your policy starts failing, the logo quietly disappears and nothing tells you.

They do not troubleshoot a logo that a mailbox provider declines to render for reasons outside the certificate.

They do not chase your renewal validation. At 397 days you revalidate, and the identity check can come around again with it.

Their 24x5 support covers the certificate. It does not cover your email programme. Somebody needs to own monitoring after go-live, whether that is you or us.

When you should not buy one

We would rather tell you to skip this than take a fee for something that will not work. Reasons not to buy a DigiCert VMC:

• You hold no registered trademark and have no plans to file. Buy a CMC or buy nothing. Do not buy a VMC hoping the rules bend.
• Your audience is not on Gmail. The blue checkmark is a Gmail feature. If your list sits mostly on Outlook, the return is much weaker.
• You are not at DMARC enforcement and are not willing to do that work. Enforcement is where the security benefit lives. The logo is decoration on top of it.
• You are chasing Apple. Apple Branded Mail through Apple Business Connect does not require a VMC at all. You upload a logo to Apple directly. Do that first, because it is free.
• Your live logo cannot match your registration. Fix the mismatch before spending $1,752, not after.

Working with us

We ran this whole stack on our own business before we sold it to anyone. Our hockey apparel store, Bench Clearers, has a Verified Mark Certificate, BIMI live in Gmail with the blue checkmark, and Meta Verified on a 52,000-follower Instagram account. We know where the trademark-to-logo match breaks and what the identity call feels like because we sat through it. We work only through official channels, we never handle your passwords, ID documents, or card numbers, and if we look at your situation and do not believe a VMC can be issued, we will tell you that and decline the work rather than take the fee. Platforms make the final decision, always. If you want us to check whether your trademark and your logo will survive validation before you spend anything, that review is where we normally start.