Mark Certificates

Even with SPF, DKIM, and DMARC all passing, BIMI still needs one more piece before it will display your logo: a Mark Certificate. This guide explains what a Mark Certificate is, the two types you can get, and walks through the identity and trademark validation process, both of which will be conducted by the certificate authority you purchase your mark certificate from.

What is a mark certificate?

Anyone can publish authentication records for a domain, so how can you be sure that a domain actually belongs to the entity it's claiming to? A Mark Certificate exists to answer this question. Does the entity behind this domain actually have the right to use this specific logo?

A Mark Certificate is the email equivalent of an Extended Validation (EV) TLS/SSL certificate, the kind that used to show a green address bar for verified businesses on the web. Where an EV certificate proves a website belongs to a legitimate, verified business, a Mark Certificate proves two things at once: that your organization is a real, legally registered entity, and that your organization actually owns the rights to the specific logo you're trying to display. A Certificate Authority (a company trusted to perform this kind of verification) issues the certificate only after confirming both.

Types of mark certificates

There are two kinds: Verified Mark Certificates (VMC) and Common Mark Certificates (CMC). The core difference is whether your logo is a registered trademark.

Acquiring a mark certificate

What to gather before you begin the purchase process

Having the following ready before you begin the application tends to make the whole process go faster:

• Your organization's exact legal name and registration number, as they appear in official government records.
• DBA documentation, if you operate under a different public-facing name.
• Proof of your registered physical business address.
• For a VMC: your trademark registration number and supporting documentation. For a CMC: whoever will sign your organization's declaration or letter of authorization.
• The name and contact information of the person who will complete the video identity verification.
• Your logo, already prepared as a valid BIMI SVG file, see the logo requirements guide.

Where to purchase a mark certificate

Let's BIMI has recommends GlobalSign for purchasing a Mark Certificate as we've found their business validation process the smoothest and their team reliable to work with. If you are implementing BIMI on your own using these guides, please consider using our affiliate links below to purchase your certificates. Using our link helps us continue building out these BIMI guides.

Let's BIMI Managed customers. If you're using Let's BIMI's Pro (coming soon), you'll be able to purchase a mark certificate right in the app, making it incredibly easy to acquire your certificate. You won't need to go to a certificate authority separately. Additionally if any validation issues arise we'll work directly with our GlobalSign account manager to quickly diagnose and resolve so you can get your certificate issued faster.

The trademark requirement (VMC only)

What it is: Legal proof that your organization owns the rights to the specific logo you're submitting.

Why it's specific: A trademark on your company name isn't enough. The trademark needs to cover the design mark, the actual visual logo, since has to match the SVG file you submit. A word-only trademark on your brand name doesn't satisfy this requirement on its own.

What's required:

• The trademark must be registered, not just filed. A pending application generally isn't sufficient, most CAs require the registration to have been issued.
• Accepted trademark offices vary by CA. Larger, well-established national and regional offices (for example the USPTO in the US) tend to be broadly accepted, but coverage isn't universal. Confirm with your CA before you begin, especially if your trademark is registered outside a major jurisdiction.
• The registered mark needs to reasonably match the logo you're using for BIMI. If your logo has changed since you registered the trademark, that mismatch can hold up validation.

Who typically does this: Legal or trademark counsel. If your organization doesn't have one on retainer, this is usually the point where it's worth engaging outside counsel, trademark registration isn't something easy navigate for the first time.

If you're going the CMC route instead

You generally won't need a registered trademark at all. In its place, most CAs have you sign a declaration or letter of authorization attesting that your organization has the rights to use the logo. It's a lighter-weight legal step, but check with your specific CA for the exact document they require.

Business identity validation (both VMC and CMC)

Regardless of which certificate type you're getting, the CA also has to independently verify that your organization is real, legally registered, and that the person applying is actually authorized to represent it. This follows the same Extended Validation (EV) standard used for website certificates.

What gets checked depends on your organization type:

• Private companies need to be legally incorporated and in good standing, with your legal name and registration number matching official records.
• Government entities need documentation establishing them as a recognized government body.
• Sole proprietors / individual businesses need government registration plus identity verification of the individual, which is often where face-to-face validation applies most directly.
• Non-commercial entities need recognition under international law or by a signatory government.

To confirm all of this, the CA's validation team cross-checks your information against independent sources, things like government business registries, tax records, or a letter from a licensed attorney or accountant vouching for the details. If your business operates under a different name than its registered legal name (a "doing business as," or DBA), that also needs its own supporting documentation. Your registered business address gets checked too, and it needs to be a real, physical location, not a P.O. box.

⚠️ Audit and update your public business information to ensure a smooth validation

Certificate authorities will manually validate your business information using reputable third-party sources, usually Dun & Bradstreet. You may even be asked for your Dun & Bradstreet number. You will want to view your company's information shown on Dun and Bradstreet and confirm that every single piece is up to date. Address, phone number, officers, etc. Any information that is not updated will cause delays in verifying your business information.

The face-to-face identity check

This is the step most people don't expect, and it's a common source of delay if you go in unprepared during the certificate authority business validation process.

What is it

A live verification that the specific person submitting the application is who they claim to be, and that they're actually authorized to act on your organization's behalf.

How it works

1. The CA sends the applicant a link to complete Video ID verification.
2. The applicant records a short video showing their face and a government-issued photo ID. This is checked using automated liveness detection (confirming it's a real person on camera, not a photo or recording) plus ID authentication.
3. A human validation specialist reviews the result and signs off.
4. If the automated check is inconclusive, the CA may follow up with a live video call (e.g. over Zoom) to complete verification in person.

How to prepare

• Pick the right person up front, someone whose name and role can be corroborated against your business registration, a company website, or something like a LinkedIn profile. A mismatch between "who's on camera" and "who the company records say represents this business" is the most common cause of delay here.
• Have a valid, unexpired government-issued photo ID ready before starting.
• Do it somewhere with decent lighting and a stable connection, since a failed liveness check just means doing it again.
• Expect to also confirm your role at the company. Being ready to explain your title and authorization avoids a back-and-forth.
• Don't leave this until the end. It's an easy step to underestimate, but a failed or inconclusive attempt adds days, especially if it escalates to a scheduled video call.

Who should be involved

This isn't a single-person task. In practice it usually touches:

• Legal or trademark counsel, for the trademark registration (VMC) or authorization declaration (CMC).
• Whoever holds your official business registration documents, often legal ops, finance, or an executive assistant, to supply legal name, registration number, and address details.
• A company officer or authorized representative available to complete the video identity verification personally.
• Whoever owns your logo file, to make sure what's submitted is a valid BIMI SVG and, for a VMC, actually matches the registered trademark.

FAQ