With Google’s recent announcement of Common Mark Certificate (CMC) support for BIMI, there have been many questions floating around. As part of the founding group that started BIMI, we’re here to clarify some confusion around CMCs and ensure you have all the answers you need.
If you don’t see your question listed below, feel free to send us a message, and we’d be happy to find the answer for you. For now, learn more about CMCs and what they mean for BIMI.
- Frequently asked questions about BIMI and Certificates
- What is BIMI?
- What are Google’s recent BIMI changes?
- What is a Common Mark Certificate (CMC)?
- What is the main difference between VMC vs. CMC?
- How do I choose between the VMC and CMC?
- Where can I get a VMC or CMC?
- What inbox providers support CMC vs. VMC?
- What are the use cases for a CMC?
- How do CMCs prevent impersonation, given a trademark is not required?
- What are acceptable logo modifications for the CMC?
- Can I upgrade from a CMC to a VMC later?
- Can I have both a VMC and a CMC valid at the same time?
- What is the application process for a CMC?
- Is the application process different between a CMC and a VMC?
- How will Valimail help support me through my BIMI journey?
Frequently asked questions about BIMI and Certificates
What is BIMI?
Brand Indicators for Message Identification (BIMI) is an emerging email specification designed to enhance email authentication and brand recognition within supporting email clients. By connecting BIMI with DMARC, SPF, and DKIM, the protocol aims to provide a comprehensive solution for preventing domain impersonation, improving email security, and enhancing brand identification in the inbox. Valimail Amplify is the only fully automated BIMI solution on the market. It provides an extra layer of authentication and allows you to take credit for reaching DMARC enforcement by having your brand logo appear adjacent to email messages in your customers’ inbox.
What are Google’s recent BIMI changes?
Google announced they will no longer require a trademark: You can get BIMI with just a Common Mark Certificate (CMC) as long as your logo has been used for at least a year.
While Google has had BIMI support with a Verified Mark Certificate (VMC), with these changes, BIMI will be available on mobile and desktop with either a VMC or a CMC. Google’s blue checkmark, previously only available on webmail, will now be rolling out to mobile.
You can read more in depth about it in our latest blog post.
“Common Mark Certificates are a significant step forward in making email authentication and BIMI more broadly accessible, empowering businesses of all sizes to leverage this powerful technology. This provides IT a more streamlined process for implementing BIMI, while presenting a golden opportunity to email marketers, allowing them to boost brand recognition and engagement in a crowded inbox. As CTO of Valimail and Chair of the AuthIndicators Working Group, the developers of Brand Indicators for Message Identification (BIMI), I’ve seen the work that has gone into spearheading this effort and couldn’t be more pleased to support Google’s endeavor. Ultimately, this makes the inbox safer for all.”
Seth Blank, CTO of Valimail and Chair of the AuthIndicators Working Group
What is a Common Mark Certificate (CMC)?
A CMC allows companies to get their logo next to their email in the inbox before the message is even opened. The logo confirms your DMARC status and announces your organizations authenticated identity. Unlike a VMC, a CMC doesn’t require your logo to be trademarked.
What is the main difference between VMC vs. CMC?
The main difference between the two certificates is that the CMC doesn’t require you to trademark your logo. However, if you opt for the CMC, you won’t receive Google’s blue checkmark next to your logo. That option is reserved for users who choose the VMC. In addition, VMC trademark logos need to match the databases exactly, and any differences are not acceptable. That is not the case with CMC. Minor modifications to the logo are accepted.
| Blue Checkmark Webmail | Blue Checkmark Mobile | Logo Variation | Mobile | |
| VMC | Yes | Yes | No | Yes |
| CMC | No | No | Yes | Yes |
How do I choose between the VMC and CMC?
First, you should consider your eligibility. If you have a trademarked logo, you can get a VMC. With a VMC, the logo must fit within the inbox reticle (i.e. circle) unaltered. If your logo has been in use for at least 12 months on your website, you can get a CMC. CMCs allow for minor logo modifications.
Here’s a quick breakdown to help you decide whether a VMC or CMC is right for you:
| VMC | CMC | |
| Pros | – Logo and Google’s Blue Checkmark show on desktop and mobile – Highest security bar | – No trademark required – Easier to obtain |
| Cons | – Slower to obtain (if you don’t already have a trademark) | – No Google Blue Checkmark – The logo has to have been in use for over a year |
Valimail can help. If you want to fast-track your BIMI implementation with Valimail Amplify, we’ll help you determine which one is right for you and then help you acquire and manage the process for getting either a VMC or CMC.
Where can I get a VMC or CMC?
You can obtain a CMC or VMC from a trusted certificate authority or provider that offers a CMC, like DigiCert or Entrust. Valimail partners with DigiCert to make the process easy for you.
“DigiCert is proud to support the growing adoption of Common Mark Certificates, making it easier for businesses to implement BIMI and protect their brand. The ability to use CMCs without requiring a registered trademark opens up more opportunities for organizations to enhance their email security and branding efforts. Valimail’s integration of CMCs ensures more companies can take advantage of this technology to build trust with their customers while protecting their communications.”
Dean Coclin, Senior Director of Digital Trust Services at DigiCert
What inbox providers support CMC vs. VMC?
Here are the current inbox providers that support CMCs and VMCs:
| Major Inbox Providers that support BIMI | VMC* – requires trademark logo | CMC – requires logo with one year of use |
| X | X | |
| Yahoo | X – not required | X – not required |
| Apple | X |
What are the use cases for a CMC?
For companies at DMARC enforcement that want to have their logo displayed in the inbox, CMCs open up another option if you don’t have a trademarked logo. As long as the logo has been in use for one year on your website, you can now utilize BIMI to bring your brand into the inbox. (see pdf for changes to this section)
For companies that want to slightly modify their logo so it displays better in the “circle” next to the sender field in customer inboxes, CMCs can be used.
“We were looking for a solution that could increase our brand protection and brand visibility by having our logo show up in our inbox without having to trademark our logo. The Common Mark Certificate (CMC) helped us achieve this.”
Global Financial Management Company
How do CMCs prevent impersonation, given a trademark is not required?
With the CMC, a comprehensive verification process will still occur. It starts with confirming that the logo is not trademarked to any other organization and that it has been in use by your organization for at least a year. You will also need to prove ownership of the emailing domain, and the email must authenticate as coming from that corporate domain.
In addition, you will need to confirm the identity of the person at your organization applying for the CMC and that they are authorized to work for your organization.
If you partner with Valimail, we can guide you through this process from start to finish without any heavy lifting on your end.
What are acceptable logo modifications for the CMC?
The location of any word mark elements MAY be rearranged in relation to the design mark elements. (Below: the left side is the original logo, right is the permitted modification)
A portion of the design mark element MAY be removed (but more than 49% of the design mark element SHALL NOT be removed), and the remaining design mark element SHALL NOT be altered from the original.
When the word mark element consists of a single word, the one word MAY be separated into multiple parts which may be stacked or not.
When the word mark element consists of multiple words, the words MAY be separated into multiple parts which may be stacked or not, or the multiple words MAY be combined into a single word.
Modified Word Marks MAY be shown in any font or color against a colored or patterned background as long as no color is specified in the registration.
Can I upgrade from a CMC to a VMC later?
Yes, first you will need to get a registered trademark for your logo and then acquire a new VMC which will require a new verification process. If you partner with Valimail, we can guide you through the VMC process and ensure everything gets set-up properly.
Can I have both a VMC and a CMC valid at the same time?
Yes, you can certainly own both. Though only one logo can be assigned to a sending domain at a time. In addition, if you use a CMC logo, then you will lose the benefit of the blue checkmark at Google. (This last sentence may not be great advice. Switching the default BIMI record to use an alternate logo may result in older email showing with the alternate logo at some inbox providers, which may not be what the domain owner intends. Selectors are the best way to use alternate logos/certificates, but as noted, they’re not currently widely supported by ESPs or inbox providers)
One of the key benefits of Valimail Amplify is that you have the flexibility to manage multiple brand entities, domains, and logos in the solution.
What is the application process for a CMC?
You will need to provide evidence of the ownership of the CMC logo. The process for ownership is that the logo has been used on a website that you own in the last 12 months (and can validate DNS access to that website)
In addition, a check on the Trademark database will be done to see if the trademark is NOT registered to anyone else. Then the process will involve vetting the person requesting the CMC and their confirmation they work for the company.
Is the application process different between a CMC and a VMC?
Both processes require the person applying for the certificate to prove:
- They are who they say they are (identity verification)
- They work for the company that they say they are working for (employment verification) and are authorized to acquire the certificates on behalf of that company
- The domain in question is owned by the company
The validation of the logo to be used is slightly different:
- For VMCs, you must provide evidence of the trademark for that logo in the name of the company applying for the certificate
- For CMCs, you must provide evidence of the ownership of that logo:
- That it is a derivative of an already trademarked logo in the name of the company applying for the certificate OR
- That is has been used on a website that you own in the last 12 months (and can validate DNS access to said website)
- DigiCert will check on one of the Trademark databases to see if the trademark is NOT registered AT ALL (i.e., not even listed on the database).
- Once that is confirmed, they will use archive.org to confirm if the trademark has been listed on the website within 12 months and if it matches what is listed on the order.
How will Valimail help support me through my BIMI journey?
At Valimail, our dedicated Product Support Engineers can guide you through BIMI implementation from start to finish without any heavy lifting on your end.
For more information, contact our team of BIMI experts.
