Decide what the certificate must accomplish
A Verified Mark Certificate project should begin with a target experience and an evidence plan, not a purchase. Identify the brand, legal owner, sending domains and receiving services where the indicator matters. Distinguish a logo beside the sender from a receiver-specific verified checkmark. An issuer can validate and issue certificate material without guaranteeing every recipient's interface or inbox placement. The resulting decision should connect rights, technical readiness and ongoing ownership.
This article is a documentary preparation guide. It does not establish eligibility for a real applicant, provide legal advice, or submit an application. BIMI remains draft work rather than an established IETF Standards Track RFC. The sources below are issuer and receiver documentation, whose claims are kept within their actual scope; missing issuer confirmation remains an explicit release gate.
Separate mark rights from domain control
DigiCert's VMC page, modified 30 October 2026, describes a registered trademark requirement, a suitable SVG-P/S logo and DMARC readiness. Its comparison material additionally identifies government marks as a VMC option. Treat that distinction as a reason to obtain the issuer's current category-specific checklist, not to assume that owning a domain establishes qualifying mark rights. A domain registration, company incorporation and trademark registration are different evidence. DigiCert VMC requirements DigiCert certificate comparison
Prepare a rights reference identifying the exact mark, registrant, jurisdiction, registration status and relationship to the applicant. If a subsidiary uses a parent's mark, or a recent acquisition changed ownership, ask the issuer which authorization and organizational records it requires. Do not infer acceptance from a visually similar logo or a trademark application that is still pending. Legal and issuer reviewers must resolve those questions before the certificate is treated as available.
Prepare organization and representative verification carefully
DigiCert describes organization-level validation and additional checks on the applicant representative, including identity documentation and an in-person or video interaction. Its page mentions notarized documents or a live webcam validation route, alongside a confirmation meeting. Ask the issuer which current process applies to the applicant rather than combining every listed option into a universal mandatory sequence. DigiCert validation description
The preparation worksheet should record who can respond and where the approved secure submission channel is, not collect passports or other identity documents in a general project folder. Confirm authority to represent the organization and make sure a substitute contact exists for absences. Keep evidence retention and access controls proportionate. No sensitive documents have been collected or transmitted for this manuscript, and the proposed checklist is not an issuer-confirmed approval.
Confirm the exact asset and authentication prerequisites
The certificate application should reference one approved SVG candidate with a recorded digest and brand-owner acceptance. DigiCert requires the SVG-P/S profile; Google adds Gmail-specific absolute dimensions of at least 96 pixels in each direction. A compliant-looking export and a legally qualifying mark still require separate technical and rights reviews. Do not submit a convenient placeholder and plan to replace it after issuance without asking how that affects the certificate. Google SVG and certificate workflow
Google's current setup page requires a VMC or CMC and documents DMARC enforcement with p set to quarantine or reject and pct set to 100. Attribute those exact values to the receiver documentation rather than presenting the page as the complete current DMARC protocol specification. The mail team must establish actual authentication readiness for its senders; a certificate procurement deadline is not a reason to make an unreviewed enforcement change.
Build a source-dated receiver matrix
For the Gmail row, the retained Google page says VMC-verified senders receive a checkmark and describes certificate-backed PEM deployment. It also accepts CMC for the logo path. Those are different outcomes. For every other receiver, obtain its own current primary documentation and record the certificate categories, asset requirements and promised or discretionary display behavior. Leave unsupported rows unknown rather than filling them from a vendor's marketing comparison. Google receiver requirements
The matrix should include receiver and client, documentation date, accepted certificate class, desired indicator, required deployment material and remaining verification. A statement about Gmail does not establish Apple Mail or Yahoo behavior. Likewise, a historical screenshot is not a current support contract. DigiCert's comparison page contains a mobile-checkmark note that may lag receiver changes; use the receiver's own documentation for receiver-specific display claims.
Original issuer-readiness worksheet
The following proposed checklist is designed to become issuer-confirmed, but no issuer has confirmed it for an applicant here. Give each item a responsible owner and a dated evidence reference rather than a yes/no guess.
- Application identity: legal entity, authorized representative and secure issuer contact route.
- Mark category: exact registered or other issuer-supported category and rights evidence reference.
- Domain scope: requested domains, control owner and unresolved organizational relationships.
- Logo candidate: approved file digest, structural findings and visual approval.
- Mail readiness: target receiver requirements and actual authentication evidence still needed.
- Issuer process: current requested documents, validation steps and unresolved questions.
- Receiver matrix: supported category and intended experience for each named service.
- Continuity: renewal owner, replacement contact, hosting responsibility and rebrand procedure.
Procurement should wait for an explicit decision on material uncertainties. If eligibility depends on a rights transfer, do not convert a tentative answer into a purchasing assumption. If the target receiver does not offer the desired indicator for the selected category, resolve the requirement before paying. This is a governance proposal, not a statement about refund rights or guaranteed issuance time.
Fictional example: a subsidiary uses its parent's mark
Fictional Willow Transit wants a verified sender indicator for a regional subsidiary. The logo belongs to the parent, the mail domain belongs to the subsidiary, and the employee preparing the application is in a shared service team. The proposed review finds three distinct questions: rights to the exact mark, applicant authority, and domain scope. None can be answered simply by showing that the website displays the logo.
The next step would be an issuer-confirmed list of acceptable organizational and authorization evidence, accompanied by a source-dated receiver matrix. The team would also freeze the approved SVG candidate and assign renewal ownership across the entities. This is a fictional planning example only. No trademark registry, issuer application, certificate or message delivery was tested, and no eligibility determination has been made.
Leave release dependent on real confirmation
The catalogue requires an issuer-confirmed evidence checklist and target-provider support matrix. This manuscript supplies the structure and a documented Gmail example, but not applicant-specific issuer confirmation or a complete matrix for a real deployment. Original evidence therefore remains open, alongside human SME, source applicability, production routes, visual accessibility and owner release. Keep issuance, deployment and receiver observation as separate milestones rather than declaring the project complete when one document arrives.