DigiCert CMC Complete Guide: Requirements, Process, Timeline, and Setup

The Common Mark Certificate (CMC) is a particular kind of DigiCert Mark Certificate that allows businesses to show their verified logo beside the sender’s name in eligible email clients.

CMC functions with BIMI that stands for Brand Indicators for Message Identification and DMARC, standing for Domain-based Message Authentication, Reporting, and Conformance, allowing people to get to know that an email was sent from a verified business.

The CMC is useful for businesses that do not have a logo yet registered as a trademark but have already used the logo for at least 12 months. Unlike the Verified Mark Certificate (VMC), which requires a logo to have a trademark, CMC does not require that; however, DigiCert still verifies a business and a logo.

The guide outlines requirements related to DigiCert CMC, validation process, order timeline, ordering process, and BIMI setup.

Prerequisites

Before making an application for a DigiCert Common Mark Certificate (CMC), it is important to check that your domain, organization, email validation, and brand logo follow the prescribed requirements:

A Controlled Email Domain

To receive a Common Mark Certificate, it is essential to have control over a domain through which emails are sent from the organization; i.e., the domain (e.g., example.com) has to belong to the organization.

Additionally, DigiCert requires you to prove domain ownership (domain control validation (DCV)) because ownership validation is a prerequisite for obtaining a CMC.

DMARC at Enforcement

Your email domain should be configured with DMARC and enforced policies. Policies that only monitor, i.e., p=none, are never sufficient for obtaining a CMC. Thus, it is important to check that your company is able to send emails legitimately and has an enforcement DMARC policy, i.e., p=quarantine or p=reject.

Setting Up SPF and DKIM

SPF and DKIM records must be appropriately set up in the email delivery systems that your organization uses. SPF pinpoints the validated email delivery infrastructure, while DKIM gives a coded signature to outgoing emails.

The authentication processes work with DMARC while remaining a significant part of the email authentication infrastructure needed for BIMI to be effective.

Using a Brand Trademark

Your business needs a brand trademark that meets the Common Mark Certificate of DigiCert guidelines. A CMC can be issued for a logo that has not been legally registered, unlike in the case of VMC, as long as it meets the conditions of prior use.

The requirement for the trademark is to be used in public by the business for a period longer than a year on the domain that the business controls.

SVG-P/S Compatible Logo

Your logo needs to be in SVG-P/S format. Even a standard SVG exported from design software can contain some features that are banned in the profile. Therefore, you should check your SVG to ensure that it fulfills the requirements of DigiCert and can be used for BIMI.

Also Read: How to Implement BIMI in Gmail, Yahoo & Apple Mail?

Evidence of Prior Logo Use

If you apply for a CMC based on prior use, you should provide evidence that the logo was used in public for at least a year. DigiCert may find historical usage via publicly available resources, including archived website pages.

Make sure to collect evidence of prior logo usage so that the certification process won’t be delayed.

DigiCert CertCentral Account

To request and manage a CMC, you will need access to a DigiCert CertCentral account. Depending on the account configuration, the Common Mark Certificate product may be disabled initially and need to be enabled first by the administrator/account manager for the item to become available for ordering. You can contact our support team for any assistance during purchase or setup.

Validation of Company Information

DigiCert seeks to verify the company applying for the certificate. Thus, you need to give correct legal company data and obey any demands with documentation or verification during the validation process.

Verified Contact

A suitable verified contact must be made available for completion of the DigiCert validation and approval process.

The contact may be expected to respond to DigiCert’s verification requests or to take part in other identity-validation processes. Therefore, an authorized person must be available at all times to avoid delays.

HTTPS Hosting for BIMI Assets

After the CMC is issued, the BIMI logo and certificate must be made available through HTTPS if it is being hosted yourself. Thus, it is required that the domain or web server is HTTPS-enabled in order to host BIMI-related materials.

Alternatively, DigiCert hosting services are a viable replacement for hosting these files yourself.

DigiCert CMC Process: Validation & Verification

The DigiCert Common Mark Certificate (CMC) process requires several levels of validation and verification prior to the issuance of the certificate. The overall process examines the organization, domain, brand logo, and the eligibility of the logo for BIMI purposes.

Step 1: Set Up the Organization and Domain

• Ensure that the organization and the email-sending domain are set up properly before you begin the application process.
• Ensure that the domain has the requisite SPF, DKIM, and DMARC set up, and that DMARC has an enforcement policy in place.
• You should also have access to the domain so you can complete the Domain Control Validation (DCV).

Step 2: Prepare and Validate the Logo

• Prepare the brand logo for BIMI purposes. It is important to note that the logo does not have to be a registered trademark, but must meet DigiCert’s Common Mark criteria.
• Additionally, the logo must be supplied in SVG-P/S file format. Make sure to validate your SVG before submission to be sure it meets required technical specifications.

Step 3: Confirm Previous Usage of the Logo

• In case of a CMC based on prior usage, DigiCert ensures that the logo has been in use publicly for at least 12 months.
• The logo must be connected to a domain that is owned by the organization at that time.
• DigiCert may use publicly available resources, as well as old versions of websites to check the usage of the logo.

Step 4: Place the CMC Order in CertCentral

• Log in to CheapSSLWEB.com and place a Common Mark Certificate request.
• Enter the necessary information about the organization, domain, and logo, and upload the ZIP logo.

Step 5: Finish Domain Control Validation

• DigiCert checks whether the organization has control of the domain stated in the CMC request.
• You’re expected to perform the chosen Domain Control Validation method, such as putting the necessary DNS information on the domain or doing any other supported method of validation.
• The certificate is not going to be issued until the required validation is done.

Step 6: Conducting Validation of the Organization

• DigiCert undertakes the validation of the organization that is applying for the certificate.
• When applying for the certificate, it is necessary to provide organization details that can be verified with the resources of the organization.
• In accordance with the verification requirements, DigiCert may demand that additional documents are provided or conduct additional verification of the organization and its agents.

Step 7: Performing Validation of the Verified Contact

• The verified contact should undergo the necessary verification of the application for the certificate.
• DigiCert may contact the verified representative to ensure the request or may require additional forms of verification of identity.
• It is advisable for the contact person to be available during the verification process, as they need to be a reference individual.

Step 8: Reviewing the CMC Application by DigiCert

• After the verification of the organization, contact, and logo has been done, DigiCert turns to reviewing the application rather than the request for the certificate.
• It is at this stage that it becomes clear whether the information is appropriate and in accordance with the requirements in the issuance of the certificate.

Step 9: Receipt of CMC Certificate

With finishing all necessary validation procedures, DigiCert issues the Common Mark Certificate, which can be used in the course of the deployment of BIMI to an organization.

Step 10: Host the Logo and the Certificate

After the release, the BIMI logo and the certificate should be made available over HTTPS.

You can host the needed files on your own infrastructure or utilize the hosting service of DigiCert, depending on the configuration of your certificate.

Step 11: Publication of BIMI DNS Record

The last step in implementation is publishing a BIMI DNS record for the domain. The record in question refers to the organization’s SVG logo and the certificate related to it.

A simplified example is:

default._bimi.example.com
v=BIMI1;
l=https://example.com/logo.svg;
a=https://example.com/cmc.pem

URLs should lead to the location where the logo and certificate exist.

Step 12: Verify the BIMI Deployment

In the end, you need to check if the BIMI record is publicly available and properly working. The whole process should look like this:

Email Sent -> SPF Authentication -> DKIM Authentication -> DMARC Enforcement -> BIMI DNS Record -> CMC Validation -> Brand Logo Display

The logo will only be shown in the relevant clients and systems that use BIMI and the correct Mark Certificate arrangement.

What is the Timeline to Get CMC Cert Issued

The time taken to obtain a DigiCert Common Mark Certificate (CMC) largely depends on the time taken by the organization to complete domain, organization, logo, and contact verification. Preparing these items in advance can help avoid unnecessary delays.

Activity	Typical Planning Window
Preparation and documentation	1–3 days
DigiCert validation process	Several days(1-7 Days)
Certificate issuance	After successful validation
BIMI deployment and testing	1–3 days
Overall planning estimate	Several days to a few weeks

Step-by-Step Process to Obtain a DigiCert CMC

Obtaining a DigiCert Common Mark Certificate (CMC) involves preparing email authentication, verifying your organization and domain, submitting your brand logo, and completing DigiCert verification. Once the certificate is issued, you can use BIMI to display your organization’s verified logo in supported email clients.  

Step 1: Domain Verification

The first step is to know the domain that your organization is using to send the emails. You need to have control over the domain, as DigiCert requires Domain Control Verification (DCV) in the CMC process.

Before proceeding, Verify that:

• You control the domain’s DNS.
• The domain is used for legitimate organizational email.
• SPF is configured correctly.
• DKIM is configured correctly.
• DMARC is configured with an enforcement policy.

Step 2: Configure DMARC

DMARC is an important prerequisite for a CMC and BIMI deployment. Configure DMARC for the domain and ensure that it uses an enforcement policy rather than only monitoring mode.

A typical DMARC record is published at:

_dmarc.example.com

For example: v=DMARC1; p=reject; rua=mailto:[email protected]

Depending on your email environment, p=quarantine may also be used as an enforcement policy. Before moving to enforcement, make sure legitimate email sources are properly authenticated so that legitimate messages are not unnecessarily affected.

Step 3: Configure SPF and DKIM

Next, ensure that the email infrastructure of the organization is verified properly through the utilization of SPF and DKIM. SPF specifies servers that are permitted to send mail, while DKIM indicates a secret signature in the emails.

DMARC makes use of the aforementioned aspects to understand if emails fulfill its criteria.

Inspect all outside sources of mail, such as email marketing systems and transactional email service providers that make use of the company on their messages.

Step 4: Prepare the Brand Logo

Design the logo that you will show using BIMI. Although a CMC logo doesn’t necessarily have to be a registered trademark, it does need to conform to DigiCert’s requirements for a valid Common Mark.

More specifically, the requirements for a logo are as follows:

• Represent an organization/brand;
• Be characterized by the necessary prior-use eligibility;
• Be publicly used for the required time period;
• Be provided in the appropriate SVG-P/S format;
• Be valid for use in BIMI.

As a case in point, any historical use of the logo on the business’s website in excess of 12 months can be taken into account when proving its validity.

Step 5: Validate the SVG Logo

The logo needs to comply with the required SVG-P/S specifications. A regular SVG file exported from a design application may contain unsupported elements, metadata, scripts, or other content.

Before submitting the CMC request, validate the SVG and correct any compatibility issues.

Using a properly formatted logo before placing the order can help avoid delays during DigiCert’s logo validation.

Step 6: Prepare Evidence of Prior Logo Use

If you are applying for a CMC based on prior use, prepare information that demonstrates the logo has been publicly used for the required period.

Useful evidence can include:

• Historical versions of the organization’s website.
• Archived webpages.
• Public company websites.
• Other publicly accessible references showing the logo’s historical use.

For example: Current website -> Historical website records -> Logo appears consistently -> 12+ months of qualifying use -> Prior-use verification

DigiCert may independently verify the historical use of the logo during its validation process.

Step 7: Log in to DigiCert CertCentral/CheapSSLWEB Dashboard

After preparing the required information, just log in to your CheapSSLWEB account dashboard and process for the certificate request.

If you already have access, log in to your DigiCert CertCentral account and begin the certificate request.

If the CMC option is not available in your account, the product may need to be enabled by the account administrator or DigiCert account representative.

Step 8: Add the Organization

Select the organization that will be associated with the CMC. If the organization has not previously been validated, DigiCert will require the necessary organization validation.

Make sure the submitted information is accurate and consistent with the organization’s official records.

You may need to provide or confirm:

• Legal organization name
• Organization address
• Organizational contact information
• Authorized representative information
• Additional documentation requested by DigiCert

Step 9: Add and Validate the Domain

Enter the email domain that will be associated with the CMC.

For example: example.com

DigiCert will require you to complete Domain Control Validation. Follow the validation instructions provided in CertCentral.

Depending on the available validation method, you may need to add a specific DNS record or complete another supported verification method.

Step 10: Upload the Brand Logo

Upload the prepared SVG-P/S logo as part of the CMC request.

At this stage, DigiCert reviews the logo against its applicable requirements. If the logo does not satisfy the required format or other conditions, you may need to modify and resubmit it. Therefore, it is useful to validate the SVG before uploading it.

Step 11: Complete Verified Contact Validation

DigiCert requires a verified contact as part of the Mark Certificate validation process. The contact should be an authorized person who can respond to DigiCert’s verification requests.

The contact may need to:

• Confirm the certificate request.
• Complete identity verification.
• Respond to DigiCert’s validation team.
• Approve the certificate request.

Keeping the verified contact available during the application process can help prevent unnecessary delays.

Step 12: Complete DigiCert Validation

After submitting the required information, DigiCert performs the necessary validation.

The major validation stages can be represented as: Organization Validation + Domain Control Validation + Logo Validation + Prior-Use Verification + Verified Contact Validation -> DigiCert Review

If DigiCert requires additional information, provide it through the requested validation channel. The certificate proceeds toward issuance only after the applicable requirements have been successfully completed.

Step 13: Receive the CMC

Once DigiCert completes the required validation and approves the request, the Common Mark Certificate is issued.

At this point, you have the certificate required to associate your verified brand logo with BIMI.

Step 14: Host the Logo and Certificate

After receiving the CMC, make the logo and certificate available through HTTPS for your BIMI deployment.

You can either:

• Host the files yourself, or
• Use DigiCert’s hosting service, where available.

For self-hosting, make sure the URLs are publicly accessible:

https://example.com/logo.svg

https://example.com/cmc.pem

Do not use inaccessible, HTTP-only, or private URLs for BIMI assets.

Step 15: Publish the BIMI DNS Record

The final deployment step is to publish a BIMI DNS record for your domain.

The BIMI record is typically published under:

default._bimi.example.com

A simplified example is:

v=BIMI1;
l=https://example.com/logo.svg;
a=https://example.com/cmc.pem

Where:

• v specifies the BIMI version.
• l points to the organization’s SVG logo.
• a points to the applicable Mark Certificate.

Use the actual URLs generated or configured for your DigiCert deployment.

Step 16: Test the Complete Setup

Once you create the BIMI record, check that the whole email authentication process is functioning well.

Conclusion

If you are interested in safeguarding your brand with a DigiCert CMC, let CheapSSLWeb help you pick the right certificate solution for your organization. Research your options, get in touch with the experts regarding the certificate requirements and process, and take the first steps toward ensuring your brand protection in emails.

Get a solution from DigiCert CMC with CheapSSLWeb this very moment and take steps toward becoming more visible and reliable in the world of authenticated emails.

Search