Straight answers, including the ones that talk you out of buying

You claim or create the listing inside Google Business Profile, and then Google chooses the verification method it wants: a video walkthrough, a mailed postcard, a phone call, email, or in some cases instant verification if your website and account are already trusted. You do not get to pick the method, and Google can switch it mid-process. As of mid-2026 most small businesses are pushed toward video verification. The whole thing is free, and plenty of businesses finish it themselves in one sitting with no help from anyone.

Almost always because the three things Google is comparing do not agree: the name on the listing, the address on the listing, and what a person would actually find if they drove there. The usual culprits are a virtual office, a coworking desk, a mailbox store or your registered agent's address, a business name with keywords stuffed into it that do not appear on your signage, a category that does not match what the video shows, or repeated edits made to the listing while it was under review. Fix the underlying mismatch before you try again. Retrying the same submission with the same facts produces the same result.

One continuous, unedited video, filmed live inside the Google app while you are standing at the business location. Google generally wants to see permanent signage, the street or building around it so the location can be placed, the interior including areas customers cannot access such as a stockroom or locked office, and proof that you personally run the business: keys, tools of the trade, a branded vehicle, the point of sale, or logging in to a business system. You cannot upload a file you recorded earlier, and nobody can record it on your behalf, because the point is that the owner is on site. We prepare a shot list and walk you through it on a call, but you hold the phone.

Stop editing the profile, do not create a duplicate listing, and do not file the same appeal five times, because repeat submissions push you back in the queue and can look like abuse. Read the suspension notice, work out which rule you tripped (address, name, categories, or a policy-sensitive business type), correct the underlying problem on the listing, and then file one clean reinstatement with dated evidence: exterior signage photos, a lease or utility bill in the business name at that address, registration documents, and a short written explanation of what changed. Be honest with yourself about the cause. If you genuinely have no physical presence at the address on the listing, no appeal fixes that, and we will tell you so instead of taking your money.

Usually a few days to a few weeks. Clean documentation cases sometimes clear in 48 to 72 hours; hard cases involving multiple locations, a prior suspension, or a policy-sensitive category can run a month or more across several rounds of evidence. Nobody has a back channel that makes Google move faster. Any agency quoting you a guaranteed turnaround is quoting you a hope, not a process.

Usually no. Google requires in-person contact with customers, either at your address or at theirs. If you travel to customers, you can verify as a service area business, hide the street address and set a service radius, which is completely legitimate and very common. If you never meet customers face to face, you are not eligible, and forcing it with a home address or a mailbox is exactly what gets profiles suspended six months later. If that is your situation we will say so on the first call and point you at things that will actually help.

No. Creating and verifying a Business Profile is free, and there is no paid tier that speeds it up or guarantees it. If someone phones or emails claiming your listing is about to expire or be removed unless you pay, that is a scam and you should hang up. What you can pay for is a person's time: fixing the name, address and category problems, assembling documentation, running the appeal, and knowing which evidence works. That is what our $300 to $800 fee covers, and none of it goes to Google.

It means Gmail confirmed that the message really came from the domain it claims, and that the logo shown belongs to a mark the sender is entitled to use. Technically it is BIMI, a DNS record pointing at your logo, plus a Verified Mark Certificate from a certificate authority, sitting on top of DMARC at enforcement. It is not a trust score, a quality rating, or an endorsement of your company by Google. It only says the identity checks passed.

They are two different levels of the same system. Your logo showing in the circle where a sender's initials normally appear can be earned with a Common Mark Certificate. The blue checkmark next to the sender name requires a Verified Mark Certificate, which requires a registered trademark. Same DNS work underneath, different certificate, different price, different visible result.

Yes, for the checkmark specifically. A Verified Mark Certificate requires a mark registered with an accepted trademark office such as the USPTO, and the logo file has to match the registered mark exactly, not a newer redraw of it. A pending application does not count; you wait until it registers. If you have no trademark and no plans to file, the checkmark is off the table for now, and the Common Mark Certificate path is the honest answer rather than a consolation prize.

The certificate itself runs $749 to $1,416 per year depending on the certificate authority and the term, and you pay that directly to the CA. We never resell it or mark it up. Our fee for the setup work is $2,000 to $3,000, one time, which covers DMARC enforcement, the logo file conversion, the BIMI record, and shepherding the CA validation. If you still need to file a trademark, that is a separate process with its own government and attorney fees and a timeline usually measured in many months, and it is work for a trademark attorney, not for us.

Your logo displayed in Gmail, without the blue checkmark. A CMC is built for companies with no registered trademark: the certificate authority verifies that you have been publicly using the logo for at least 12 months, often using web archive evidence of your own site. It costs roughly $649 a year to the CA, and it is not recognized by Apple Mail. For a lot of small businesses this is the sensible choice, because you get most of the visible benefit for a fraction of the total cost and no trademark requirement.

Because Microsoft does not render BIMI. As of August 2026, Outlook.com, Exchange Online and Microsoft 365 mailboxes show sender initials or a generic icon no matter what you have published, and Microsoft has not announced an implementation date. A pilot was reported back in 2023 and it never became something a sender can rely on. If most of your customers read mail in Outlook, that is a real argument for spending your money on authentication and deliverability instead of a certificate, and we will look at your actual sending data with you before you buy anything.

Plan on four to ten weeks end to end, assuming your trademark is already registered. DMARC has to reach enforcement first, which is usually the slow part at roughly two to six weeks of monitoring and fixing senders. Certificate authority validation then takes about two to four weeks and includes a live video identity check with an officer of your company holding their ID, or a notarized equivalent. Gmail picks up the change within a day or two after that, but only on newly delivered mail; messages already sitting in someone's inbox will not change.

SPF is a list you publish in DNS naming the servers allowed to send email using your domain. DKIM is a cryptographic signature attached to each message that proves it was not forged or altered on the way. DMARC ties those two results to the domain a human actually sees in the From line and tells receiving servers what to do when a message fails: take no action (p=none), send it to spam (quarantine), or refuse it (reject). Without a DMARC policy at enforcement, anyone in the world can put your domain in the From field of an email.

Phishing, mostly. In February 2024 Gmail and Yahoo began requiring SPF, DKIM, DMARC, one-click unsubscribe and a spam complaint rate under 0.3% from bulk senders, generally meaning about 5,000 or more messages a day to their users. Microsoft followed with similar requirements for high volume senders into Outlook.com in May 2025. All three now recommend SPF, DKIM and DMARC for every sender regardless of volume, and a basic p=none DMARC record satisfies the letter of the requirement.

If you send low volume, probably nothing dramatic tomorrow. Over months your mail becomes more likely to land in spam, your domain stays trivially forgeable by anyone who wants to invoice your customers in your name, and the day you finally send a real campaign you will be fixing this under time pressure. High volume senders who ignore it get junked or rejected outright at the server, which means the mail never arrives at all and you never see a bounce your staff would notice. The realistic small business risk is a slow deliverability decline plus zero protection against impersonation.

It can if it is done carelessly, and that is the most common way small businesses hurt themselves here. Jumping straight to p=reject before you have found every legitimate sender means your invoicing tool, CRM, booking system, help desk, payroll provider and the bookkeeper who sends from your domain can all start getting rejected. The safe order is to publish p=none first, read the aggregate reports for a few weeks, authorize or fix each sender you find, then tighten to quarantine and finally to reject. Done in that order, normal mail keeps flowing the entire time.

Typically four to eight weeks for a small business with a handful of sending tools. Longer if you have several domains, a long tail of legacy systems, or nobody left who knows what is sending mail as you. The DNS edits themselves take an afternoon. The rest of the time goes into monitoring and hunting down the one surprise sender that nobody remembered was there.

Honestly, many of you can. If you run Google Workspace or Microsoft 365, send through a single email platform, and are willing to read a DMARC report, this is a careful weekend using free tooling and your provider's own documentation. Hire us when your DNS is a mess, when you have multiple domains or a dozen tools sending on your behalf, when you already tried and mail broke, or when your own hours are worth more than the $497 to $1,497 fee. We would rather tell you it is simple than sell you a sprint you did not need.

They are two separate things and people mix them up constantly. Business verification is free and is simply proving to Meta that your company is a real registered entity using documents like a registration certificate or utility bill; it unlocks advertising and WhatsApp features, not a badge. Meta Verified is a paid monthly subscription that adds the blue badge, impersonation monitoring and priority support, and it generally requires you to have completed business verification first. Paying for the second does not replace doing the first.

It is a subscription paid directly to Meta, roughly $14.99 to $499.99 per month per asset depending on tier, platform and country. The words per asset matter: a Facebook Page and an Instagram account can bill separately, so a two-account business at a mid tier adds up faster than people expect. Higher tiers buy more support and monitoring, not a bigger or bluer badge. Our setup fee is $250 to $500 and we only take it as an add-on to another engagement, because on its own this is not worth paying an agency to do.

The most common reason is a name mismatch, where the legal name in your Business Manager does not match your registration document exactly, or your Page name matches neither. After that it is documents that are self-prepared with no official seal or signature, blurry or cropped scans, expired paperwork, foreign-language documents without a certified translation, thin or incomplete profiles, and accounts that are simply too new. Resubmitting over and over makes things worse, because repeated attempts from the same admin can trigger an automatic rejection. Fix the mismatch first, then submit once.

No. Meta makes the decision, and no agency, reseller or self-described insider controls it. Anyone guaranteeing a badge is either lying to you or intending to submit falsified documents in your name, which puts your Page, your Business Manager and your ad account at permanent risk. What genuinely moves the odds is an application that is clean, consistent and complete, and that is the only claim we will make about our own work.

Almost certainly. The tells are consistent: they contacted you first by DM or WhatsApp, they guarantee approval, they ask for your password or your two-factor code or a photo of your driver's license, they want payment in crypto, gift cards or a peer-to-peer app, and they claim a contact inside Meta. No legitimate verification process ever requires handing another person your password or your login code. If you already gave someone credentials, change your password now, revoke active sessions, check your Page and Business Manager for admins you do not recognize, and turn on two-factor authentication.

The minimum that each platform grants through its own official delegation system, always with you as the owner. In practice that is a Manager role on your Google Business Profile, partner access to your Meta Business Manager, either DNS delegation at your registrar or a scoped list of records we ask you to add, and a dedicated named admin user in your Google Workspace or Microsoft 365 tenant. Every one of those is visible to you in your own admin panel, and you can revoke any of them yourself in about a minute without asking us. We also work under a scope-limited Letter of Authorization that names the exact domains and record types we are allowed to touch.

Because holding your password makes us a target and destroys the audit trail on your own account, and because storing your government ID means storing precisely what an identity thief wants most. It is a hard policy: we never accept or store passwords, government-issued ID documents, or payment card numbers, even when a client offers them to save time. If any vendor in this category asks for your password or asks you to email a photo of your driver's license, treat that alone as a reason to walk away. We do collect business records at intake such as registration documents, licenses, a utility bill, bank statements, your EIN letter, trademark certificates, logo artwork and storefront photos, and those are company documents rather than personal identity documents.

Four things, and they exist specifically so that an agency cannot do them. The certificate authority identity check for a VMC or CMC, which means an officer of your company on a live video call holding their ID, or a notarized equivalent. The Google Business Profile verification video, which the owner records live on site in the Google app. Paying platform subscriptions with your own card, and approving your own two-factor prompts. Total time on your side is usually an hour or two, in short sessions we schedule with you in advance.

We tell you exactly why and what would have to change, in plain language. Sometimes there is a real second attempt available: better evidence, a corrected legal name, different signage, or a different verification path. Sometimes the answer is that you do not qualify yet, because there is no registered trademark, no physical location, or a business type the platform will not verify, and in that case we say so rather than selling you another round. We do not guarantee outcomes and we cannot, because Google, Meta, Apple, Microsoft, Yahoo, X, LinkedIn, TikTok and the certificate authorities make every approval decision themselves. We are not affiliated with, endorsed by, or sponsored by any of them; what we guarantee is correct and complete work through official channels.

Flat fees per service line, quoted before any work starts: Google Business Profile Verify and Rescue $300 to $800 (some reinstatements can be structured pay-on-success), Email Compliance Sprint for SPF, DKIM and DMARC $497 to $1,497, Logo in the Inbox with BIMI and a Common Mark Certificate $1,500 to $2,500, Gmail Blue Check with BIMI and a Verified Mark Certificate $2,000 to $3,000, Meta Verified setup $250 to $500 as an add-on only, and Trust Monitoring at $50 to $150 per domain per month. Third-party costs are quoted separately and paid by you directly to the platform or certificate authority, never through us and never marked up: VMC $749 to $1,416 a year, CMC about $649 a year, Meta Verified $14.99 to $499.99 a month per asset. Payments to us run through Stripe, so we do not see or store your card number.

Sometimes you should not, and we will say that on the first call. Verifying a Google Business Profile costs nothing, DMARC records are free to publish, and Meta business verification is free; if you have one location, one email platform and some comfort in DNS, you can do most of this yourself with public documentation. The case for hiring us is when the cost of getting it wrong is bigger than the fee: a suspended profile that was feeding your phone, a domain being spoofed to your customers, mail already landing in spam, or a certificate application that will fail on a formatting detail nobody warned you about. The certificate and subscription costs are unavoidable either way, and they go to the CA or the platform, not to us.

At handoff you get an access register listing every account we touched, every role we held, every DNS record we added or changed, and how to remove each one yourself. On completion or termination we relinquish all access within seven business days, and you can revoke it sooner at any time without notice or penalty. Nothing we set up depends on us staying in the account. If you later hire someone else, the register is written so they can pick it up without calling us.