Skip to main content

VMC Certificate Analyzer

Verify your BIMI certificate in seconds

Validate your Verified Mark Certificate before enabling BIMI. Verify the issuer, authorized domains and validity period to display your logo in email clients.

Complete BIMI validation

Instantly decode a VMC to confirm your brand will display correctly in Gmail, Yahoo and Apple Mail inboxes.

Domain verification

Check that all your sending domains are present in the certificate SANs. A missing domain means no logo display.

Validity dates

Verify issuance and expiration dates. An expired certificate blocks logo display immediately.

URL and PEM support

Analyze from an HTTPS URL (as in your BIMI record) or paste the PEM content directly.

Detailed diagnostics

View the issuer (DigiCert, Entrust), jurisdiction, trademark registration number and all X.509 fields.

Why verify a VMC?

The VMC (Verified Mark Certificate) is the key to displaying your brand logo in Gmail, Yahoo and Apple Mail inboxes. Before enabling BIMI, validate that:

  • The issuer is a recognized authority (DigiCert, Entrust)
  • The certified domains (SAN) include all your sending domains
  • The validity period is not expired or close to expiration
  • The legal information matches your organization

What is a VMC certificate?

A Verified Mark Certificate is a special X.509 certificate that:

  • Attests to your organization's trademark rights
  • Links your SVG logo to your email sending domains
  • Is issued after verification of your registered trademark with an intellectual property office

VMC contents

FieldDescription
SubjectLegal identity of the organization
SANAuthorized domains, URLs and identities
IssuerCertificate Authority (DigiCert, Entrust)
ValidityIssuance and expiration dates
TrademarkRegistration number and jurisdiction

How does BIMI work with VMC?

  1. BIMI record: You publish a DNS record at _bimi.yourdomain.com pointing to your SVG logo and VMC
  2. DMARC verification: The email provider verifies DMARC passes with p=quarantine or p=reject
  3. VMC validation: The certificate is downloaded and validated (issuer, domains, dates)
  4. Logo display: If everything is valid, the logo appears in the inbox

Use cases

Case 1: Initial BIMI activation

Context: You just received your VMC and want to enable BIMI.

Actions:

  1. Analyze the VMC to verify your domains are included
  2. Confirm the validity dates are correct
  3. Publish the BIMI record with the VMC URL
  4. Test with our BIMI checker

Case 2: Logo not displaying

Context: BIMI is configured but the logo doesn't appear in Gmail.

Actions:

  1. Analyze the VMC to verify it's not expired
  2. Confirm the sending domain is in the SANs
  3. Verify DMARC is configured with p=quarantine or p=reject
  4. Wait 24-48h for propagation

Case 3: VMC renewal

Context: Your VMC expires in 30 days.

Actions:

  1. Order a new VMC from your CA
  2. Analyze the new certificate to verify the information
  3. Update the URL in your BIMI record
  4. Keep the old VMC active until full propagation

Common errors

Error codeCauseSolution
ERR_CERT_INPUT_MISSINGNo PEM or URL providedPaste the certificate or enter HTTPS URL
ERR_CERT_URL_INVALIDNon-HTTPS or invalid URLVerify the URL starts with https://
ERR_CERT_PEM_MISSINGNo certificate block in PEMInclude BEGIN/END CERTIFICATE lines
ERR_CERT_INVALIDCorrupted certificate or not a VMCCheck the source file
ERR_CERT_FETCH_FAILEDTimeout or redirectVerify URL accessibility

Best practices

  1. Renew 30 days before expiration to avoid any interruption
  2. Include all your sending domains in the SANs when ordering
  3. Host the VMC on a reliable URL with HTTPS and high availability
  4. Test after every change with this analyzer and the BIMI checker
  5. Document expiration dates in your operations calendar

Complementary tools

ToolPurpose
BIMI GeneratorGenerate a valid BIMI record with your VMC
BIMI CheckerVerify the BIMI record published on your domain
BIMI Syntax ValidatorValidate syntax BEFORE DNS publication
DMARC InspectorVerify DMARC policy (BIMI prerequisite)

Privacy

The certificate is sent to the CaptainDNS API only to decode its metadata. Processing is done in memory without storage. Only generic metrics (duration, size, status) are recorded for availability monitoring.