Notifications
Clear all
Topic starter
24/06/2026 10:51 pm
TL;DR: Verified Mark Certificate adoption is expanding as email service providers add support and more trademark options become eligible, according to DigiCert. The security lesson is that visual trust in the inbox depends on validated identity, enforced DMARC, and trademark governance, not branding alone.
NHIMG editorial — based on content published by DigiCert: Verified Mark Certificate (VMCs) Adoption Grows, Increasing Digital Trust in Email Inboxes
By the numbers:
- Only 38% have automated certificate lifecycle management in place.
- 69% of organisations now have more machine identities than human ones.
- 57% of organisations lack a complete inventory of their machine identities.
Questions worth separating out
Q: How should organisations govern verified marks in email inboxes?
A: They should treat verified marks as part of certificate and identity governance, not as a marketing asset.
Q: Why do verified marks matter for email trust programmes?
A: They matter because they turn a visual indicator into a governed trust signal tied to authenticated sending identity.
Q: What should security teams check before enabling verified mark certificates?
A: They should check that the organisation can prove domain control, prove the right to use the trademark, and sustain certificate lifecycle oversight.
Practitioner guidance
- Add VMCs to certificate inventory processes Track VMC issuance, renewal dates, revocation status, and ownership alongside other certificate assets so visual trust does not drift away from current authority.
- Require DMARC enforcement before rollout Confirm that sender authentication policy is enforced for every domain that will display a verified mark, and block deployment where the email posture is still permissive.
- Validate trademark entitlement before certificate requests Link brand, legal, and security approval so the party requesting a verified mark can prove the right to use the trademark and the sending domain.
What's in the full article
DigiCert's full blog post covers the implementation and ecosystem details this post intentionally leaves for the source:
- Apple, Gmail, and other provider-specific rendering details that determine where VMCs appear in the inbox
- Expanded trademark eligibility discussion, including government marks and non-registered marks
- Validation steps for VMC issuance, including the applicant checks and proof-of-right workflow
- The DigiCert view on how BIMI adoption is evolving across mailboxes and clients
👉 Read DigiCert's analysis of Verified Mark Certificate adoption and inbox trust →
Verified Mark Certificates: what inbox trust changes for IAM teams?
Explore further
25/06/2026 7:42 am
VMCs are a trust-layer control, not a branding feature. The article makes clear that the logo only appears after domain, applicant, and trademark validation have been completed. That matters because the security value lies in identity assurance, not inbox aesthetics. Practitioners should treat VMCs as part of the broader certificate and email trust stack.
A few things that frame the scale:
- Only 38% have automated certificate lifecycle management in place, according to The Critical Gaps in Machine Identity Management report.
- 59% of companies face greater difficulties auditing machine identities, primarily due to lack of clear ownership and limited visibility.
A question worth separating out:
Q: How do VMCs differ from ordinary email branding?
A: Ordinary branding is a presentation choice, while a VMC is a validated identity artifact. The certificate links a brand mark to a sending identity that has been checked for domain ownership and trademark rights, which gives the inbox display a security basis that simple imagery does not have.
👉 Read our full editorial: VMC adoption exposes the trust gap in email inboxes
