Domain Ownership Validation: What You Need to Prepare for VMC Certification

Verifying domain ownership is a foundational step for obtaining a Verified Mark Certificate (VMC). Certificate Authorities (CAs) require proof that your organization controls the domain associated with your brand and email communications. This process helps prevent misuse, spoofing, and ensures your logo is only displayed for legitimate senders.

• Implement DMARC Policy: Your domain must have a DMARC policy set to quarantine or reject. Domains with none will not qualify for VMC. Ensure SPF and DKIM records are also properly configured.
• Prepare for Domain Control Validation (DCV): The Certificate Authority (CA) will require proof of domain control, which may involve email verification, uploading a file to your web server, or adding a DNS TXT record as instructed.
• Trademarked Logo: Your brand logo must be registered with a recognized trademark authority and must match the logo submitted for VMC exactly.
• Organization Validation: The CA will verify your organization’s legal existence, commercial registration, and contact information. Be prepared to provide documentation and respond to verification calls.
• BIMI DNS Record: Publish a BIMI DNS TXT record referencing your hosted SVG logo and, after issuance, the VMC (.pem) file. Both must be accessible over HTTPS.

• CA Review: The CA will review your DMARC configuration, trademark documentation, and organization details. They will send verification requests to your listed contacts.
• Domain Control Methods: You may be asked to:
  - Respond to an email sent to a domain admin address (e.g., admin@yourdomain.com)
  - Upload a verification file to a specific path on your website
  - Add a unique DNS TXT record to your domain’s DNS settings
• Validation Timeline: The process can take from a few days to over a week, depending on how quickly you respond to CA requests and complete the required steps.

• DMARC Not at Enforcement: Domains with a DMARC policy of "none" will be rejected. Set to "quarantine" or "reject" and monitor for at least 30 days before applying.
• Incorrect DNS Records: Errors in SPF, DKIM, or BIMI records can delay validation. Use online tools to double-check all DNS entries.
• Trademark Mismatch: The logo submitted must match your trademark registration exactly. Any discrepancies can cause rejection.

• DMARC policy set to “quarantine” or “reject”: Ensure your DMARC policy is set to enforcement mode for eligibility.
• SPF and DKIM records in place: Confirm that both SPF and DKIM authentication records are properly configured for your domain.
• Domain control validation method ready: Prepare to validate domain control via email, DNS TXT record, or file upload as required by the Certificate Authority.
• Trademarked logo in SVG Tiny PS format: Use your registered trademark logo in the required SVG Tiny PS format for BIMI.
• Organization details and registration documents on hand: Have your organization’s legal and registration documents ready for validation.
• BIMI DNS record published and correct: Publish a BIMI DNS record referencing your SVG logo and ensure all information is accurate and accessible.

Find detailed answers in our VMC and BIMI FAQ section. 

Ensure your domain, DMARC policy, trademark, and DNS records are fully compliant to avoid delays in VMC certification.