From a technical perspective, email is today one of the best secured application-layer protocols. TLS transport encryption is a standard, DKIM signatures are widespread, and DMARC enables real enforcement of domain identity policy. Despite this, incident statistics remain unforgiving. Email is still responsible for the largest number of successful phishing attacks and security breaches resulting from human error.

The problem does not lie in cryptography. It lies in the decision-making moment, which still belongs to a human. The end user does not interpret SPF results or DKIM alignment. They do not analyze DNS records. What they do see, however, is the sender name, the subject line, and visual cues that, consciously or not, they interpret as signs of authenticity. It is precisely in this gap between correct technical validation and user perception that the Verified Mark Certificate was created. VMC does not attempt to “fix” email at the protocol level. Its role is to translate a complex cryptographic decision into an unambiguous visual signal that a user can understand without technical knowledge.

What VMC really is, and what it is not.

Verified Mark Certificate is often confused with a BIMI extension or treated as a branding element. Such simplification leads to incorrect design decisions. VMC is not a marketing tool and it is not an alternative to DMARC. It is a brand identity certificate embedded in the PKI ecosystem. From a technical standpoint, VMC is an X.509 certificate issued by a trusted certificate authority. Its uniqueness lies in the fact that it does not merely confirm control over a domain. It also confirms the right to use a specific trademark in the context of email communication.

source: own elaboration.

In practice, this means combining three domains that previously functioned independently:

• technical infrastructure (DNS, email, PKI),
• cryptography and trust chains,
• intellectual property law.

This combination means that the logo displayed in the inbox is not a sender declaration, but a verified identity attribute for which the certificate authority assumes responsibility.

BIMI and VMC: an execution relationship, not a competitive one.

BIMI (Brand Indicators for Message Identification) is a publication layer. It defines where and how an email client can find information about the brand associated with the sending domain. BIMI itself does not introduce a trust mechanism. Without VMC, it remains only a hint, not proof of identity. Mail providers understood this risk very quickly. Displaying logos without strong legal and cryptographic validation could directly strengthen phishing rather than limit it. For this reason, full BIMI support has, in practice, been coupled with the requirement to possess a VMC.

In this model, BIMI is responsible for mechanics, while VMC is responsible for credibility. One without the other has no operational sense.

From the user’s perspective, displaying a logo next to a message appears to be a UI decision. In reality, it is the final result of a multi-stage validation process that the email client performs before allowing any visual element. After receiving a message, the client is not yet concerned with branding. First, it must determine whether the sender’s domain meets the minimum conditions of integrity and identity consistency. Only after these conditions are met can it proceed to the BIMI and VMC layer.

The technical sequence is as follows:

• first, the sending source authorization is verified via SPF,
• then the DKIM signature and content integrity are checked,
• next, the DMARC policy is enforced, including domain alignment,
• only then is a DNS query for the BIMI record performed,
• finally, the VMC certificate and the associated logo are validated.

This order is critical. The email client never retrieves the logo or the certificate if the domain does not pass DMARC validation with at least a quarantine policy. This means that VMC does not “improve” domain reputation. It inherits it. The logo is not a remediation tool, but a reward for infrastructural maturity.

Why is a DMARC reject policy a necessary condition?

The requirement for a strict DMARC policy is sometimes perceived as excessive. In practice, it acts as a quality filter. An organization that cannot move to p=reject does not have full control over its sending ecosystem. In such an environment, displaying a logo could lead to risk escalation rather than reduction. Transitioning to reject forces an inventory of all sending sources, DKIM consolidation, and the elimination of historical configuration compromises. Only after this work is completed does it make sense to add a visual trust layer. From the perspective of mail providers, this is logical. The logo becomes a signal of operational maturity, not a simple visual identity element.

One of the most underestimated aspects of VMC is how the logo itself is treated. In the BIMI context, it is not an arbitrary marketing graphic. It is a security artifact that is validated in a manner similar to a certificate. The requirement to use the SVG Tiny PS format is not driven by aesthetics. It is a deliberate design decision aimed at reducing the attack surface. This profile eliminates the ability to embed scripts, interactive events, and non-standard elements that could be exploited to attack email client parsers. In this model, the logo becomes part of the trust chain. It must be deterministic, unambiguous, and safe to render. This is a fundamental difference from the classic branding approach.

The VMC acquisition process as an infrastructure project.

Obtaining a VMC is not a purchase transaction. It is a project that involves security, email, legal, and branding teams. Attempts to treat it as a simple domain add-on almost always result in delays or failure. The process begins with stabilizing the email infrastructure. This includes identifying all sending systems, unifying DKIM signatures, and gradually tightening the DMARC policy. This phase is often the most time-consuming because it exposes undocumented integrations and historical exceptions. In parallel, formal documentation is prepared. The certificate authority verifies the trademark registration, ownership data, and the relationship between the brand and the domain. This process is similar to EV validation, extended with elements of intellectual property law.

Only after these stages are completed can the certificate be issued and the BIMI record published.

Who issues VMC and why does it matter?

VMC is not a standard PKI product. It is issued only by selected certificate authorities, including:

• DigiCert
• Entrust
• Sectigo

What matters is not only the technical correctness of the certificate, but also the CA’s reputation in the eyes of mailbox providers. Acceptance of VMC is directly tied to trust in the issuer, which distinguishes this ecosystem from classic DV certificates.

VMC as a mechanism for reducing brand impersonation phishing.

From the perspective of security teams, the greatest value of VMC is not the logo display itself, but the change in phishing attack dynamics. Traditional brand impersonation phishing exploits the fact that users have no simple way to distinguish authentic communication from forged messages. The sender address may look similar, the content is convincing, and the lack of clear visual signals works in the attacker’s favor. Phishing numbers related to brand impersonation are as follows:

source: statista.com

VMC introduces asymmetry. An attacker can copy content, communication style, and even the displayed sender name. They cannot, however, obtain a VMC certificate or cause the real brand logo to be displayed, because they control neither the domain nor the trademark. As a result, users begin to perceive the absence of a logo as an anomaly, rather than its presence as something exceptional. This is a subtle but critical cognitive shift. Instead of teaching users how to recognize phishing, the infrastructure begins to support correct decisions automatically.

How does VMC influence user behavior, not just metrics?

VMC deployments are often evaluated through marketing metrics: open rate, CTR, engagement. While these metrics do improve, they do not capture the full scope of the change on the recipient side. Users gradually learn a new trust pattern. The logo becomes a consistent element of communication from a given organization, and its absence begins to raise uncertainty. Importantly, this process occurs without formal training or awareness campaigns. It is the result of repetition and consistency. From a security perspective, this model is far more scalable than traditional user education. It does not require technical knowledge or constant vigilance. It is enough for users to notice a discrepancy between the expected and actual visual signal.

Case study: a B2C financial institution in the European Union.

In one large EU financial institution, phishing reached an operationally burdensome level. Despite correct SPF, DKIM, and DMARC configuration, customers regularly reported suspicious messages impersonating bank communications. The SOC team was overloaded with reports, many of which concerned emails originating outside the organization’s infrastructure. The decision to implement VMC was made after a full migration to a DMARC reject policy. The project lasted several months and involved both technical and legal teams.

Six months after launching BIMI with VMC, several significant changes were observed:

• a significant drop in phishing reports, despite a global increase in phishing campaigns,
• customers began reporting messages without a logo as suspicious more often,
• SOC response times decreased because reports were more precise.

The most important outcome, however, was not the reduction in incident numbers, but a change in customer behavior. The logo became a reference point, not a decorative element.

Case study: a global B2B SaaS and system communication.

In a globally operating SaaS company, VMC was implemented not as a reaction to an incident, but as part of a “trust-by-design” strategy. The organization sent a large number of system messages: security notifications, configuration changes, account activity alerts. Previously, some of these messages were ignored or ended up in “other” or “spam” folders, because users treated them cautiously, fearing phishing. After VMC implementation, communication began to be perceived as more consistent and trustworthy.

The result was improved deliverability to major mail providers and increased interaction with system messages. Importantly, the number of false phishing reports generated by the organization’s own emails also decreased.

VMC and deliverability: an indirect but measurable relationship.

A frequent question from email teams is whether VMC directly affects deliverability. The answer is not directly, but systemically. VMC does not directly change spam scoring. It is not a reputation signal at the protocol level. However, it affects two factors that indirectly influence deliverability:

• user behavior (opens, interactions, lack of spam reports),
• consistency and maturity of email configuration (DMARC reject).

Mail providers increasingly base their algorithms on behavioral signals. In this context, VMC becomes part of an ecosystem that fosters positive signals, rather than attempting to artificially generate them.

Compliance and due diligence aspects.

In regulated organizations, VMC is beginning to play a role that goes beyond marketing and operational security. It is increasingly treated as evidence of best practices in electronic communication. From the perspective of standards such as ISO 27001 or requirements arising from NIS2, VMC is not mandatory. However, in security audits and due diligence processes, it is often cited as an element that strengthens control over the communication channel with customers and partners. Importantly, VMC is an auditable solution. Its issuance process includes formal legal and technical validation, which aligns with the logic of organizational controls rather than one-off configurations.

Where VMC does not make sense. An honest assessment of limitations.

Not every organization will benefit from implementing VMC. In environments where email is not a key communication channel with the end user, the cost and complexity of the project may outweigh the benefits. VMC does not protect against phishing based on lookalike domains and does not eliminate the need for brand abuse monitoring. It also does not replace user education or other security layers. Its value emerges where:

• the brand is recognizable and frequently targeted for impersonation,
• email is a critical operational channel,
• the organization has achieved DMARC maturity.

Discussions about the cost of VMC are often dominated by the price of the certificate itself. This is a perspective error. In practice, the cost of VMC consists of several elements, of which the certificate is often the least problematic. The largest cost is organizational maturity, which must be achieved for VMC to make sense at all. Organizations with chaotic email infrastructure, incomplete DMARC, and fragmented sending sources must first invest in putting the basics in order. Only in this context do direct costs appear:

• the VMC certificate fee, depending on the CA and validity period,
• legal work related to trademark validation,
• preparation and validation of the SVG Tiny PS logo,
• monitoring and maintenance of the BIMI configuration.

In mature organizations, this cost is predictable and relatively low compared to security budgets. In immature organizations, VMC can act as a catalyst for a broader remediation project, which should be treated as an investment rather than a flaw of the technology. Return on investment for VMC is rarely reducible to a single metric. Its value manifests at several levels simultaneously, some of which are indirect. The most commonly observed areas of impact include:

• reduction in phishing reports and SOC workload,
• a decrease in false alarms generated by the organization’s own communication,
• improved user behavior (open rates, response to alerts),
• strengthened domain reputation through consistent DMARC reject.

In B2C organizations, ROI is often calculated through reduced incident handling and call center costs. In B2B, more often through increased effectiveness of system and onboarding communication. In both cases, VMC acts as a multiplier of existing processes, not a magical solution to problems.

VMC in the context of other trust signals.

To properly position VMC within a security architecture, it is worth comparing it with other well-known trust signals. Each addresses a different problem and operates at a different level. This comparison is best understood not as competition, but as complementarity:

• SSL/TLS certificates, including EV, build trust in the connection and domain in the web context,
• DMARC builds trust in the domain in the email context,
• VMC builds trust in the brand in the email context, at the user interface level.

The key difference is that VMC uniquely combines technical, legal, and visual validation. As a result, it fills a gap that neither SSL certificates nor anti-spam mechanisms address.

FAQ. Most frequently asked questions about VMC.

1. Does VMC increase the cryptographic security of email?
No. VMC does not change algorithms or protocols. It increases operational security by changing user behavior and reducing the effectiveness of brand impersonation phishing.

2. Can VMC be implemented without a DMARC reject policy?
Not in practice. Mail providers require at least quarantine, and full BIMI effectiveness is achieved with reject.

3. Does VMC work for subdomains?
Yes, but each sending domain must be covered by a correct DMARC policy and validation. VMC is not inherited automatically.

4. Can one VMC certificate cover multiple brands?
No. VMC is issued for a specific trademark and a specific domain.

5. Does changing the logo require revalidation?
Yes. The logo is an integral part of the certificate, and any change requires a new process.

6. How long does the VMC acquisition process take?
From several weeks to several months, depending on DMARC readiness and completeness of legal documentation.

7. Does VMC affect spam score?
Not directly. It affects it indirectly through user behavior and email configuration stability.

8. Does VMC protect against phishing from lookalike domains?
No. It requires complementary brand abuse monitoring and user education.

9. Does VMC make sense for small businesses?
Only if the brand is recognizable and targeted for impersonation. Otherwise, DMARC remains the priority.

10. Is VMC a temporary trend or a long-term standard?
All indications suggest that BIMI and VMC will be developed and expanded, not withdrawn. This direction aligns with the growing role of trust signals on the UX side.

BIMI and VMC roadmap for 2025 to 2027.

The development of VMC is not complete. Observing the direction of changes among major mail operators, several likely trends can be outlined.

In the short term (2025), expectations include:

• further tightening of DMARC requirements,
• expanded BIMI support in additional mail clients,
• better integration of BIMI signals with reputation algorithms.

In the medium term (2026 to 2027), the following are realistic:

• additional brand-related trust attributes,
• stronger linkage between VMC and security alerts,
• standardization of audit processes around email communication.

In this context, VMC appears not as a final product, but as a foundation for the further evolution of trust in email.

VMC in a Zero Trust model for email communication.

There is increasing discussion about extending the Zero Trust philosophy beyond networks and applications. Email, as a channel that initiates many business processes, naturally fits into this model. VMC does not introduce implicit trust. On the contrary, it assumes that trust must be explicitly proven, and its absence is a warning signal. The logo is not a privilege. It is the result of meeting rigorous conditions. In this sense, VMC can be treated as Zero Trust for user perception. Verified Mark Certificate is not a universal solution, but in the right context it becomes an extremely effective element of a security architecture. It delivers the greatest value when:

• the brand is recognizable and genuinely exposed to phishing,
• email is a critical operational channel,
• the organization has achieved DMARC maturity,
• security is treated systemically rather than pointwise.

In such an environment, VMC ceases to be an “add-on”. It becomes a natural closure of the trust chain that connects cryptography, infrastructure, law, and user experience into a single, coherent decision model.

Do you have questions related to VMC? We invite you to contact us.