Reference
Glossary
Every term we use, explained in plain English, with the technical detail for those who want it.
You'll find a small book icon next to technical terms across VerifiedInbox. Click it to open the definition in a side panel without leaving the page. Here are all the terms in one place.
Alignment
#Making sure the 'from' domain matches the domain that passed the checks.
It's not enough for an email to pass a check — it has to pass it for the same domain your readers see in the 'From' line. That match is called alignment.
Technical detail
DMARC passes when SPF (MAIL FROM / Return-Path) or DKIM (d=) passes and the authenticated domain aligns with the RFC5322.From domain (relaxed: same organizational domain; strict: exact match).
API key
#A password for software to use your account.
A secret key that lets your tools or AI assistant work with your account. Keep it private.
Technical detail
Bearer token (vi_live_… or vi_test_…), scoped to one organization and environment.
Related:MCPTest mode (sandbox)
BIMI
#The standard that lets inboxes show your logo.
BIMI stands for Brand Indicators for Message Identification. It is a small public setting on your domain that tells inboxes where to find your official logo.
Technical detail
A TXT record at default._bimi.<domain> (v=BIMI1; l=<SVG URL>; a=<certificate URL>). Requires DMARC at p=quarantine or p=reject.
Related:DMARCVMC (Verified Mark Certificate)CMC (Common Mark Certificate)SVG Tiny P/S
Blue checkmark
#The verified badge Gmail shows next to a sender's name.
When a company proves who it is, Gmail shows its logo and a small blue checkmark next to its name. It tells readers the email really comes from that company.
Technical detail
Gmail displays the checkmark when a message passes DMARC at enforcement and the sender publishes a BIMI record backed by a Verified Mark Certificate (VMC).
Business verification
#Confirming your company is real and registered.
We confirm that your company is officially registered and that you're allowed to act for it. The certificate issuer does a final check too.
Technical detail
Legal entity lookup against an official/aggregated company registry (first release: OpenCorporates), followed by the issuer's organization and verified-contact validation.
Related:Certificate issuer
Certificate issuer
#The trusted company that checks your details and issues the certificate.
An independent, trusted company (we work with DigiCert) that double-checks your business and logo before issuing your certificate. Their fee is shown separately.
Technical detail
A certificate authority accredited for mark certificates under the AuthIndicators Working Group requirements.
Related:VMC (Verified Mark Certificate)CMC (Common Mark Certificate)Issuer fee
CMC (Common Mark Certificate)
#A certificate for your logo without the checkmark.
A digital certificate for companies whose logo is not a registered trademark yet. Gmail shows your logo, but not the blue checkmark. You need to show the logo has been in public use for at least 12 months.
Technical detail
A mark certificate validated on prior use (≥ 12 months, e.g. archived web captures) instead of trademark registration. Same DNS/BIMI requirements as a VMC.
Related:VMC (Verified Mark Certificate)Prior use (12 months)
DKIM
#A digital signature that proves an email wasn't altered.
DKIM adds an invisible signature to every email you send. Inboxes check the signature to make sure the email really came from you and wasn't changed on the way.
Technical detail
Public keys published as TXT (or CNAME) records at <selector>._domainkey.<domain>. Messages carry a DKIM-Signature header with d= and s= tags.
Related:DKIM selectorDMARCAlignment
DKIM selector
#The name of a specific DKIM signature key.
Each service that sends email for you uses its own signature key, and each key has a short name called a selector (for example “google” or “selector1”). We can't list them automatically, so you may need to tell us yours.
Technical detail
The s= tag of the DKIM-Signature header; the key lives at <selector>._domainkey.<domain>. Selectors cannot be enumerated via DNS.
Related:DKIM
DMARC
#Your domain's instructions for handling fake emails.
DMARC is a public setting that tells inboxes what to do with emails that pretend to come from your domain but don't. To show your logo, it must tell inboxes to block or quarantine fakes.
Technical detail
A TXT record at _dmarc.<domain> (v=DMARC1; p=none|quarantine|reject; pct; rua; sp; adkim; aspf). BIMI requires p=quarantine or p=reject with pct=100.
DNS
#The internet's public address book for your domain.
DNS is where your domain's public settings live — where your website is, which service handles your email, and the settings needed for your logo. You change them at your domain provider (like Cloudflare or GoDaddy).
Technical detail
The Domain Name System. Records are served by your domain's authoritative nameservers and cached by resolvers for their TTL.
DNS record
#One setting in your domain's public address book.
A single entry in your domain settings. We'll tell you exactly what to copy and paste, and where.
Technical detail
A resource record with a name (host), type (TXT, CNAME, MX, …), value and TTL.
Related:DNSTXT record
Domain
#Your company's internet name, like yourcompany.com.
The name after the @ in your email address. To show your logo, you need your own domain — shared ones like gmail.com belong to someone else.
Related:SubdomainOrganizational domain
Domain ownership check
#Proving you control the domain.
You add one small setting we give you to your domain. It proves you control it, so nobody else can order a certificate for it.
Technical detail
A TXT record at _verifiedinbox.<domain> containing verifiedinbox-verification=<token>.
Related:DNS record
Issuer fee
#The certificate issuer's own yearly charge.
The issuer charges its own yearly fee for checking your business and issuing the certificate. We collect it at checkout without markup and show it as a separate line. If issuance is rejected, you get a refund.
Related:Certificate issuer
Logo & certificate hosting
#We keep your logo and certificate online for inboxes to fetch.
Inboxes download your logo and certificate from the internet. We host both on fast, secure servers, so you never have to manage files.
Technical detail
Served over HTTPS from https://bimi.getverifiedinbox.com with correct content types; referenced by the l= and a= tags of your BIMI record.
Related:BIMI
Looks identical
#How we confirm the inbox-ready logo looks the same as your original.
We draw your original file and the inbox-ready copy at the same size on a white background and compare them pixel by pixel. If less than half a percent of the logo changed visibly, they look identical. Up to 3% counts as small differences; more than that is flagged so you can check carefully.
Technical detail
Both SVGs are rendered at 256×256 px on white. A pixel counts as changed when any colour channel differs by more than 32/255. score = changed pixels ÷ logo area; identical < 0.005, minor < 0.03, otherwise significant.
Related:SVG Tiny P/S
Mailbox provider
#The service that hosts your company's email.
The company that runs your email, for example Google Workspace, Microsoft 365 or Zoho.
Related:MX record
Matches your logo
#How we decide a registered trademark shows your logo.
For each registered mark we find, we download its image from the US trademark office and compare it with your logo. An AI image check does the comparison, with a visual fingerprint as a backup. A score of 80% or more counts as a match; lower scores are shown as similar so you or our team can confirm.
Technical detail
The mark image is compared with a 256 px rendering of your logo by a vision model, or by perceptual-hash similarity when the model isn't available. similarity ≥ 0.80 → match_found; 0.60–0.80 → similar.
Related:Registered trademarkUSPTO
MCP
#A way for AI assistants to use VerifiedInbox for you.
MCP (Model Context Protocol) lets AI assistants like Claude, ChatGPT or Cursor check your domain and move your verification forward, step by step.
Technical detail
Streamable HTTP MCP server at https://api.getverifiedinbox.com/mcp with OAuth (WorkOS) or API-key auth; anonymous tools use a guest token.
Related:API key
MX record
#Tells the internet which service receives your email.
This setting points to the service that receives email for your domain, such as Google Workspace or Microsoft 365.
Technical detail
Mail exchanger records listing the hosts (with preference) that accept SMTP for the domain.
Related:DNS recordMailbox provider
Organizational domain
#PEM file
#The file format of your certificate.
A standard text file that contains your certificate. We host it for you.
Technical detail
Base64 DER certificates between -----BEGIN CERTIFICATE----- markers; the BIMI a= tag points to the full chain.
Related:Logo & certificate hosting
Prior use (12 months)
#Proof your logo has been public for at least a year.
For a CMC, you need to show your logo has been used publicly for at least 12 months — for example on your website. We check public web archives to help.
Technical detail
Evidence such as Internet Archive (Wayback Machine) captures showing the mark on the domain ≥ 12 months ago.
Related:CMC (Common Mark Certificate)
Registered trademark
#Legal registration of your logo with a trademark office.
An official registration that says your logo belongs to your company. A blue checkmark (VMC) requires one. We check the US Trademark Office (USPTO) for you.
Technical detail
A design mark (or design-plus-words mark) registered with an accepted intellectual property office; the first release supports USPTO only.
Related:USPTOVMC (Verified Mark Certificate)Trademark filing service
Reissue
#Getting a new copy of your certificate, e.g. after a logo change.
If you update your logo or something changes, we can request a fresh copy of the certificate within the same paid year.
Related:RenewalRevocation
Renewal
#Certificates last about a year; we renew them for you.
Certificates expire after about 13 months. We track the date, remind you well ahead, and renew automatically so your logo never disappears.
Technical detail
Mark certificates are valid for at most 398 days. Renewal orders start 45 days before expiry; reminders at 60/30/14/7/1 days.
Related:VMC (Verified Mark Certificate)CMC (Common Mark Certificate)
Revocation
#Permanently cancelling a certificate.
Cancels the certificate for good. Your logo will stop showing in inboxes. Only do this if something is wrong.
Related:Reissue
Safe DMARC rollout
#Tightening email protection in steps so real emails keep arriving.
If you send email every day, turning on strict protection too quickly can block your own newsletters or invoices. A safe rollout starts by only watching, then tightens over a few weeks once every service that sends email for you is set up. New domains and domains that send little email can switch on full protection straight away.
Technical detail
p=none with rua reporting (suggested 14 days) → p=quarantine; pct=25 → p=quarantine (pct=100) → p=reject (recommended). Waiting times are suggestions; advance when aggregate reports show all legitimate sources pass SPF or DKIM with alignment.
SPF
#The list of services allowed to send email for your domain.
SPF is a public list of the services (like Google Workspace or your newsletter tool) that are allowed to send email using your domain name.
Technical detail
A TXT record beginning with v=spf1 at the domain apex. Limited to 10 DNS-querying mechanisms; only one SPF record is allowed.
Subdomain
#A name under your domain, like news.yourcompany.com.
A name that lives under your main domain. Some companies send newsletters from a subdomain.
Related:DomainOrganizational domain
SVG Tiny P/S
#The special logo file format inboxes require.
Inboxes need your logo in a very specific, simplified format. We convert your logo automatically, keep your original file untouched, and show you a side-by-side preview to approve.
Technical detail
SVG Tiny 1.2 Portable/Secure profile: version="1.2" baseProfile="tiny-ps", a <title>, square viewBox, no scripts, external references, raster images or animation; ≤ 32 KB recommended.
Related:BIMILogo & certificate hosting
Test mode (sandbox)
#A safe practice area where nothing is charged or issued.
Test mode lets you try every step without paying or ordering a real certificate. Switch it on from your dashboard; everything you do there is kept separate.
Technical detail
Environment `test`: Stripe test mode, simulated issuer, separate data and vi_test_ API keys.
Related:API key
Trademark filing service
#Help registering your logo as a trademark.
If your logo isn't registered yet, we can help you file it. Email trademark@getverifiedinbox.com. Registration usually takes several months; meanwhile you may qualify for a CMC.
TTL
#How long other servers remember a domain setting.
Short for “time to live”. It's how long copies of your domain settings are kept around the internet before they refresh.
Technical detail
Time-to-live in seconds on a DNS record; caching resolvers keep answers up to this long.
Related:Authoritative nameserver
TXT record
#A DNS record that holds a line of text.
A type of domain setting that simply holds text. Email security settings use this type.
Technical detail
A DNS record of type TXT. Values longer than 255 characters are split into multiple strings that are concatenated.
Related:DNS record
USPTO
#The United States Patent and Trademark Office.
The US government office that registers trademarks. We look up your logo there.
Related:Registered trademark
VMC (Verified Mark Certificate)
#The certificate that unlocks your logo and the blue checkmark.
A digital certificate that proves your logo is a registered trademark owned by your company. With it, Gmail shows your logo and the blue checkmark.
Technical detail
An X.509 certificate with the BIMI extended key usage and the logo embedded (RFC 3709 logotype). Requires a registered trademark. Valid for about 398 days.
Related:CMC (Common Mark Certificate)Registered trademarkCertificate issuer