Verified Mark Certificates (VMC) & Common Mark Certificates (CMC)
Improve security, boost brand trust, increase engagement
This is a new email security product to prepare for.
You might have seen some emails in your inbox with an avatar (aka BIMI) beside the subject + sender name. Depending on your email software, this is likely to be displayed by a VMC, which adds a validation process to the BIMI avatar. VMC is an easy-to-see assurance that the sender has been verified, & this email is 100% genuine.
VMC is expensive and so far it's only been cost-effective for the big end of town. Now, there’s a similar product called CMC aimed at medium-small business.
Key takeaways
- A mark certificate displays a verified unique avatar beside an email subject line, that identifies the email as truly coming from the (apparent) sender
- VMC-validated emails also get a blue tick in Gmail
- VMC & CMC make a bold visual statement about your email's security
- VMCs/CMCs can boost email open rates by 10-50%, according to 3rd party studies
- If CMCs & VMCs become the norm (like https:// has for websites): emails with no avatar will look dubious - like spam. Your customers won’t want to open them
- A VMC avatar uses a registered trademark
- You don’t need a trademark for CMC. But you do need a recognised logo: one that's been on your website for at least a year
- Not all email programs display VMC avatars yet. Fewer show CMC - as yet
- The two email clients with most of the market (Apple and Google) both support VMC
- Our email hosting provides the right email security to allow you to add CMC or VMC to your emails.
What does CMC or VMC do?
A CMC or VMC adds unique and highly protected data to your domain name, that:
- confirms there is DKIM sender protection on your emails - if an email says it's from your email address, it really is
- attaches your unique, registered avatar to the email's subject+sender information
- protects your avatar - it can't be used by other parties to 'verify' their emails.
So far, the avatar only shows up on some email software. Not all your email recipients will see it.
How do I get CMC or VMC?
- Either trademark your logo or display it on your website for a year.
- Ask us about specs for BIMI & VMC/CMC. Then using your logo as a starting point, design your preferred email avatar. Save it in the required format & size.
- Order a VMC or CMC through your digital certificate supplier (that's us).
- Follow the steps to allow the issuing Mark Verifying Authority (MVA) to validate your business's location & registration data.
- Once your business has been verified & the avatar approved, the MVA will send us your VMC/CMC.
- Have the avatar & your new VMC/CMC 'installed' on your email sending domain. This entails uploading the avatar file to the right folder location, installing a unique digital certificate & editing your domain's DNS records (our job again).
- Wait a wee while for the new DNS records to 'propagate' (20 mins to 48 hrs).
- Test email.
- Pay an annual renewal fee to keep your VMC/CMC operational.
- If you have any business data changes - eg contact details, entity name - it's important to tell us, so we can update them with the MVA. Otherwise your renewal will fail.
- If you use more than one domain for email, or change your email address to another of your domains: the VMC or CMC can cover that.
Should I buy a CMC or VMC?
CMC is very new. So far, CMC avatars only show up on messages sent to Gmail users. VMC is better known. Expect other mail software to adopt the technology; but at present, return on investment may be small unless your customers are heavy users of Gmail/Google Workspace (or Yahoo/Apple Mail, if you choose a VMC).
CMCs don’t come cheap yet. There are only 2 MVAs. Prices for website security certificates fell dramatically as more Certificate Authorities sold them & more websites adopted the technology. Will the same thing happen with CMC/VMC?
In our opinion:
- CMC may not be cost-effective yet for many of our current clients. Most will want to watch & wait, until more email software can display the verified avatars & customers begin to take notice.
- For a new business that wants to establish trust quickly & plans to market strongly via email, consider buying a CMC now. If you need a trademark anyway, choose VMC.
- It's important to be ready to move quickly if/when CMCs take on.
Scenario | VMC Benefits |
CMC Benefits |
| Your mailing list includes many Gmail/Google Workspace or Yahoo/Apple users | Displays your brand logo in your recipients' email inbox for all these email clients Displays blue verified tick in Gmail Visually marks your emails as legitimate, makes them stand out Increases open rates & engagement Helps fight phishing & spoofed emails |
Displays your brand logo in your recipients' email inbox (Gmail & Google Workspace only) Visually marks your emails as legitimate, makes them stand out Increases open rates & engagement Helps fight phishing & spoofed emails |
ALL our email hosting clients: your email uses DMARC with quarantine or reject setting | Visually marks your emails as authentic; displays your brand logo in your recipients' email inbox in Gmail, Apple Mail & various other email clients |
Visually marks your emails as authentic; displays your brand logo in your recipients' email inbox in Gmail & Google Workspace |
What should I do now?
Taking a few simple steps might save your email bacon in a year or two.
- Read our updates about CMC & VMC. Ask if you don't understand.
- Design a logo, if you don't have one: text, graphic or both. CMC requirements to be aware of when designing your logo
- Display your logo on your website asap.
- In a year's time, you can rework the logo into a CMC-style avatar if you need to.
-
You can also use the avatar design for a unique website favicon. (That's the little icon up in the browser tab when you visit any website. Our favicon is a wombat.)
Why use your own favicon, instead of a generic one like the WordPress W? It helps people to get back to your website easily, when they have multiple websites open in their browser.
What's BIMI?
BIMI stands for Brand Indicators for Message Identification. In short: an email avatar.
BIMI arrived a few years ago as a way to display a business logo on the email subject line.
There are two types of BIMI:
- simplest is 'self-asserted': you publish your logo without it being verified as belonging to your domain. Any design with the right dimensions & file format can be a self-asserted BIMI. It uses DNS records but no digital certificate. It's a marketing tool, not a security statement. Some email providers (eg Gmail) do not accept self-asserted BIMI records;
- adding a VMC or CMC brings more security to the BIMI. They connect a BIMI design uniquely to one, independently verified business.
More info
Litmus has a summary of the benefits of mark certificates and BIMI.
