Frequently asked questions: Demystifying Common Mark Certificates (CMC) and BIMI

Brand Indicators for Message Identification (BIMI) is an emerging email specification designed to enhance email authentication and brand recognition within supporting email clients. By connecting BIMI with DMARC, SPF, and DKIM, the protocol aims to provide a comprehensive solution for preventing domain impersonation, improving email security, and enhancing brand identification in the inbox. Valimail Amplify is the only fully automated BIMI solution on the market. It provides an extra layer of authentication and allows you to take credit for reaching DMARC enforcement by having your brand logo appear adjacent to email messages in your customers’ inbox.

Google announced they will no longer require a trademark: You can get BIMI with just a Common Mark Certificate (CMC) as long as your logo has been used for at least a year. 

While Google has had BIMI support with a Verified Mark Certificate (VMC), with these changes, BIMI will be available on mobile and desktop with either a VMC or a CMC. Google’s blue checkmark, previously only available on webmail, will now be rolling out to mobile. 

A CMC allows companies to get their logo next to their email in the inbox before the message is even opened. The logo confirms your DMARC status and announces your organizations authenticated identity. Unlike a VMC, a CMC doesn’t require your logo to be trademarked.

The main difference between the two certificates is that the CMC doesn’t require you to trademark your logo. However, if you opt for the CMC, you won’t receive Google’s blue checkmark next to your logo. That option is reserved for users who choose the VMC.  In addition, VMC trademark logos need to match the databases exactly, and any differences are not acceptable. That is not the case with CMC. Minor modifications to the logo are accepted. 

First, you should consider your eligibility. If you have a trademarked logo, you can get a VMC. With a VMC, the logo must fit within the inbox reticle (i.e. circle) unaltered. If your logo has been in use for at least 12 months on your website, you can get a CMC. CMCs allow for minor logo modifications.

Here’s a quick breakdown to help you decide whether a VMC or CMC is right for you: 

You can obtain a CMC or VMC from a trusted certificate authority or provider that offers a CMC, like DigiCert or Entrust. Valimail partners with DigiCert to make the process easy for you.

Here are the current inbox providers that support CMCs and VMCs:

For companies at DMARC enforcement that want to have their logo displayed in the inbox, CMCs open up another option if you don’t have a trademarked logo. As long as the logo has been in use for one year on your website, you can now utilize BIMI to bring your brand into the inbox.  (see pdf for changes to this section)

For companies that want to slightly modify their logo so it displays better in the “circle” next to the sender field in customer inboxes, CMCs can be used.

With the CMC, a comprehensive verification process will still occur. It starts with confirming that the logo is not trademarked to any other organization and that it has been in use by your organization for at least a year. You will also need to prove ownership of the emailing domain, and the email must authenticate as coming from that corporate domain.

In addition, you will need to confirm the identity of the person at your organization applying for the CMC and that they are authorized to work for your organization.

If you partner with Valimail, we can guide you through this process from start to finish without any heavy lifting on your end.

The location of any word mark elements MAY be rearranged in relation to the design mark elements. (Below: the left side is the original logo, right is the permitted modification)

A portion of the design mark element MAY be removed (but more than 49% of the design mark element SHALL NOT be removed), and the remaining design mark element SHALL NOT be altered from the original.

When the word mark element consists of a single word, the one word MAY be separated into multiple parts which may be stacked or not.

When the word mark element consists of multiple words, the words MAY be separated into multiple parts which may be stacked or not, or the multiple words MAY be combined into a single word.

Modified Word Marks MAY be shown in any font or color against a colored or patterned background as long as no color is specified in the registration.

Yes, first you will need to get a registered trademark for your logo and then acquire a new VMC which will require a new verification process.  If you partner with Valimail, we can guide you through the VMC process and ensure everything gets set-up properly.

Yes, you can certainly own both. Though only one logo can be assigned to a sending domain at a time. In addition, if you use a CMC logo, then you will lose the benefit of the blue checkmark at Google.  (This last sentence may not be great advice. Switching the default BIMI record to use an alternate logo may result in older email showing with the alternate logo at some inbox providers, which may not be what the domain owner intends. Selectors are the best way to use alternate logos/certificates, but as noted, they’re not currently widely supported by ESPs or inbox providers)

One of the key benefits of Valimail Amplify is that you have the flexibility to manage multiple brand entities, domains, and logos in the solution.

You will need to  provide evidence of the ownership of the CMC logo. The process for ownership is that the logo has been used on a website that you own in the last 12 months (and can validate DNS access to that  website) 

In addition, a check on the Trademark database will be done to see if the trademark is NOT registered to anyone else. Then the process will involve vetting the person requesting the CMC and their confirmation they work for the company.

Both processes require the person applying for the certificate to prove:

• They are who they say they are (identity verification)
• They work for the company that they say they are working for (employment verification) and are authorized to acquire the certificates on behalf of that company
• The domain in question is owned by the company

The validation of the logo to be used is slightly different:

• For VMCs, you must provide evidence of the trademark for that logo in the name of the company applying for the certificate
• For CMCs, you must provide evidence of the ownership of that logo:
  • That it is a derivative of an already trademarked logo in the name of the company applying for the certificate OR
  • That is has been used on a website that you own in the last 12 months (and can validate DNS access to said website) 
  • DigiCert will check on one of the Trademark databases to see if the trademark is NOT registered AT ALL (i.e., not even listed on the database). 
  • Once that is confirmed, they will use archive.org to confirm if the trademark has been listed on the website within 12 months and if it matches what is listed on the order. 

At Valimail, our dedicated Product Support Engineers can guide you through BIMI implementation from start to finish without any heavy lifting on your end.

For more information, contact our team of BIMI experts.