# Glossary

> Every term we use, explained in plain English, with the technical detail for those who want it.

You'll find a small book icon next to technical terms across VerifiedInbox. Click it to open the definition in a side panel without leaving the page. Here are all the terms in one place.

### Blue checkmark

**The verified badge Gmail shows next to a sender's name.**

When a company proves who it is, Gmail shows its logo and a small blue checkmark next to its name. It tells readers the email really comes from that company.

*Technical:* Gmail displays the checkmark when a message passes DMARC at enforcement and the sender publishes a BIMI record backed by a Verified Mark Certificate (VMC).

*Related:* [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi), [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc)

### BIMI

**The standard that lets inboxes show your logo.**

BIMI stands for Brand Indicators for Message Identification. It is a small public setting on your domain that tells inboxes where to find your official logo.

*Technical:* A TXT record at default._bimi.<domain> (v=BIMI1; l=<SVG URL>; a=<certificate URL>). Requires DMARC at p=quarantine or p=reject.

*Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc), [SVG Tiny P/S](https://getverifiedinbox.com/docs/glossary.md#svg-tiny-ps)

### VMC (Verified Mark Certificate)

**The certificate that unlocks your logo and the blue checkmark.**

A digital certificate that proves your logo is a registered trademark owned by your company. With it, Gmail shows your logo and the blue checkmark.

*Technical:* An X.509 certificate with the BIMI extended key usage and the logo embedded (RFC 3709 logotype). Requires a registered trademark. Valid for about 398 days.

*Related:* [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc), [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark), [Certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer)

### CMC (Common Mark Certificate)

**A certificate for your logo without the checkmark.**

A digital certificate for companies whose logo is not a registered trademark yet. Gmail shows your logo, but not the blue checkmark. You need to show the logo has been in public use for at least 12 months.

*Technical:* A mark certificate validated on prior use (≥ 12 months, e.g. archived web captures) instead of trademark registration. Same DNS/BIMI requirements as a VMC.

*Related:* [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [Prior use (12 months)](https://getverifiedinbox.com/docs/glossary.md#prior-use)

### DMARC

**Your domain's instructions for handling fake emails.**

DMARC is a public setting that tells inboxes what to do with emails that pretend to come from your domain but don't. To show your logo, it must tell inboxes to block or quarantine fakes.

*Technical:* A TXT record at _dmarc.<domain> (v=DMARC1; p=none|quarantine|reject; pct; rua; sp; adkim; aspf). BIMI requires p=quarantine or p=reject with pct=100.

*Related:* [Safe DMARC rollout](https://getverifiedinbox.com/docs/glossary.md#dmarc-rollout), [SPF](https://getverifiedinbox.com/docs/glossary.md#spf), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim), [Alignment](https://getverifiedinbox.com/docs/glossary.md#alignment)

### Safe DMARC rollout

**Tightening email protection in steps so real emails keep arriving.**

If you send email every day, turning on strict protection too quickly can block your own newsletters or invoices. A safe rollout starts by only watching, then tightens over a few weeks once every service that sends email for you is set up. New domains and domains that send little email can switch on full protection straight away.

*Technical:* p=none with rua reporting (suggested 14 days) → p=quarantine; pct=25 → p=quarantine (pct=100) → p=reject (recommended). Waiting times are suggestions; advance when aggregate reports show all legitimate sources pass SPF or DKIM with alignment.

*Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [Alignment](https://getverifiedinbox.com/docs/glossary.md#alignment)

### SPF

**The list of services allowed to send email for your domain.**

SPF is a public list of the services (like Google Workspace or your newsletter tool) that are allowed to send email using your domain name.

*Technical:* A TXT record beginning with v=spf1 at the domain apex. Limited to 10 DNS-querying mechanisms; only one SPF record is allowed.

*Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim)

### DKIM

**A digital signature that proves an email wasn't altered.**

DKIM adds an invisible signature to every email you send. Inboxes check the signature to make sure the email really came from you and wasn't changed on the way.

*Technical:* Public keys published as TXT (or CNAME) records at <selector>._domainkey.<domain>. Messages carry a DKIM-Signature header with d= and s= tags.

*Related:* [DKIM selector](https://getverifiedinbox.com/docs/glossary.md#dkim-selector), [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [Alignment](https://getverifiedinbox.com/docs/glossary.md#alignment)

### DKIM selector

**The name of a specific DKIM signature key.**

Each service that sends email for you uses its own signature key, and each key has a short name called a selector (for example “google” or “selector1”). We can't list them automatically, so you may need to tell us yours.

*Technical:* The s= tag of the DKIM-Signature header; the key lives at <selector>._domainkey.<domain>. Selectors cannot be enumerated via DNS.

*Related:* [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim)

### Alignment

**Making sure the 'from' domain matches the domain that passed the checks.**

It's not enough for an email to pass a check — it has to pass it for the same domain your readers see in the 'From' line. That match is called alignment.

*Technical:* DMARC passes when SPF (MAIL FROM / Return-Path) or DKIM (d=) passes and the authenticated domain aligns with the RFC5322.From domain (relaxed: same organizational domain; strict: exact match).

*Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [SPF](https://getverifiedinbox.com/docs/glossary.md#spf), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim)

### DNS

**The internet's public address book for your domain.**

DNS is where your domain's public settings live — where your website is, which service handles your email, and the settings needed for your logo. You change them at your domain provider (like Cloudflare or GoDaddy).

*Technical:* The Domain Name System. Records are served by your domain's authoritative nameservers and cached by resolvers for their TTL.

*Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record), [Authoritative nameserver](https://getverifiedinbox.com/docs/glossary.md#authoritative-dns)

### DNS record

**One setting in your domain's public address book.**

A single entry in your domain settings. We'll tell you exactly what to copy and paste, and where.

*Technical:* A resource record with a name (host), type (TXT, CNAME, MX, …), value and TTL.

*Related:* [DNS](https://getverifiedinbox.com/docs/glossary.md#dns), [TXT record](https://getverifiedinbox.com/docs/glossary.md#txt-record)

### TXT record

**A DNS record that holds a line of text.**

A type of domain setting that simply holds text. Email security settings use this type.

*Technical:* A DNS record of type TXT. Values longer than 255 characters are split into multiple strings that are concatenated.

*Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record)

### MX record

**Tells the internet which service receives your email.**

This setting points to the service that receives email for your domain, such as Google Workspace or Microsoft 365.

*Technical:* Mail exchanger records listing the hosts (with preference) that accept SMTP for the domain.

*Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record), [Mailbox provider](https://getverifiedinbox.com/docs/glossary.md#mailbox-provider)

### Mailbox provider

**The service that hosts your company's email.**

The company that runs your email, for example Google Workspace, Microsoft 365 or Zoho.

*Related:* [MX record](https://getverifiedinbox.com/docs/glossary.md#mx-record)

### Authoritative nameserver

**The original source of your domain's settings.**

The server that holds the original copy of your domain settings. We check it directly, so we see your changes within seconds instead of waiting for copies around the internet to refresh.

*Technical:* The nameservers listed in the NS records of your zone. We query them directly with recursion disabled and no caching, falling back to DNS-over-HTTPS.

*Related:* [DNS](https://getverifiedinbox.com/docs/glossary.md#dns), [TTL](https://getverifiedinbox.com/docs/glossary.md#ttl)

### TTL

**How long other servers remember a domain setting.**

Short for “time to live”. It's how long copies of your domain settings are kept around the internet before they refresh.

*Technical:* Time-to-live in seconds on a DNS record; caching resolvers keep answers up to this long.

*Related:* [Authoritative nameserver](https://getverifiedinbox.com/docs/glossary.md#authoritative-dns)

### Domain

**Your company's internet name, like yourcompany.com.**

The name after the @ in your email address. To show your logo, you need your own domain — shared ones like gmail.com belong to someone else.

*Related:* [Subdomain](https://getverifiedinbox.com/docs/glossary.md#subdomain), [Organizational domain](https://getverifiedinbox.com/docs/glossary.md#organizational-domain)

### Subdomain

**A name under your domain, like news.yourcompany.com.**

A name that lives under your main domain. Some companies send newsletters from a subdomain.

*Related:* [Domain](https://getverifiedinbox.com/docs/glossary.md#domain), [Organizational domain](https://getverifiedinbox.com/docs/glossary.md#organizational-domain)

### Organizational domain

**Your main registered domain.**

Your main domain — the one you registered, without any prefixes. Settings here also protect your subdomains.

*Technical:* The registrable domain (public suffix + one label). DMARC and BIMI fall back to it for subdomains.

*Related:* [Domain](https://getverifiedinbox.com/docs/glossary.md#domain), [Subdomain](https://getverifiedinbox.com/docs/glossary.md#subdomain)

### SVG Tiny P/S

**The special logo file format inboxes require.**

Inboxes need your logo in a very specific, simplified format. We convert your logo automatically, keep your original file untouched, and show you a side-by-side preview to approve.

*Technical:* SVG Tiny 1.2 Portable/Secure profile: version="1.2" baseProfile="tiny-ps", a <title>, square viewBox, no scripts, external references, raster images or animation; ≤ 32 KB recommended.

*Related:* [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi), [Logo & certificate hosting](https://getverifiedinbox.com/docs/glossary.md#logo-hosting)

### Registered trademark

**Legal registration of your logo with a trademark office.**

An official registration that says your logo belongs to your company. A blue checkmark (VMC) requires one. We check the US Trademark Office (USPTO) for you.

*Technical:* A design mark (or design-plus-words mark) registered with an accepted intellectual property office; the first release supports USPTO only.

*Related:* [USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto), [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [Trademark filing service](https://getverifiedinbox.com/docs/glossary.md#trademark-service)

### USPTO

**The United States Patent and Trademark Office.**

The US government office that registers trademarks. We look up your logo there.

*Related:* [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark)

### Trademark filing service

**Help registering your logo as a trademark.**

If your logo isn't registered yet, we can help you file it. Email trademark@getverifiedinbox.com. Registration usually takes several months; meanwhile you may qualify for a CMC.

*Related:* [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc)

### Prior use (12 months)

**Proof your logo has been public for at least a year.**

For a CMC, you need to show your logo has been used publicly for at least 12 months — for example on your website. We check public web archives to help.

*Technical:* Evidence such as Internet Archive (Wayback Machine) captures showing the mark on the domain ≥ 12 months ago.

*Related:* [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc)

### Certificate issuer

**The trusted company that checks your details and issues the certificate.**

An independent, trusted company (we work with DigiCert) that double-checks your business and logo before issuing your certificate. Their fee is shown separately.

*Technical:* A certificate authority accredited for mark certificates under the AuthIndicators Working Group requirements.

*Related:* [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc), [Issuer fee](https://getverifiedinbox.com/docs/glossary.md#issuer-fee)

### Issuer fee

**The certificate issuer's own yearly charge.**

The issuer charges its own yearly fee for checking your business and issuing the certificate. We collect it at checkout without markup and show it as a separate line. If issuance is rejected, you get a refund.

*Related:* [Certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer)

### Business verification

**Confirming your company is real and registered.**

We confirm that your company is officially registered and that you're allowed to act for it. The certificate issuer does a final check too.

*Technical:* Legal entity lookup against an official/aggregated company registry (first release: OpenCorporates), followed by the issuer's organization and verified-contact validation.

*Related:* [Certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer)

### Domain ownership check

**Proving you control the domain.**

You add one small setting we give you to your domain. It proves you control it, so nobody else can order a certificate for it.

*Technical:* A TXT record at _verifiedinbox.<domain> containing verifiedinbox-verification=<token>.

*Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record)

### Logo & certificate hosting

**We keep your logo and certificate online for inboxes to fetch.**

Inboxes download your logo and certificate from the internet. We host both on fast, secure servers, so you never have to manage files.

*Technical:* Served over HTTPS from https://bimi.getverifiedinbox.com with correct content types; referenced by the l= and a= tags of your BIMI record.

*Related:* [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi)

### Renewal

**Certificates last about a year; we renew them for you.**

Certificates expire after about 13 months. We track the date, remind you well ahead, and renew automatically so your logo never disappears.

*Technical:* Mark certificates are valid for at most 398 days. Renewal orders start 45 days before expiry; reminders at 60/30/14/7/1 days.

*Related:* [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc)

### Reissue

**Getting a new copy of your certificate, e.g. after a logo change.**

If you update your logo or something changes, we can request a fresh copy of the certificate within the same paid year.

*Related:* [Renewal](https://getverifiedinbox.com/docs/glossary.md#renewal), [Revocation](https://getverifiedinbox.com/docs/glossary.md#revocation)

### Revocation

**Permanently cancelling a certificate.**

Cancels the certificate for good. Your logo will stop showing in inboxes. Only do this if something is wrong.

*Related:* [Reissue](https://getverifiedinbox.com/docs/glossary.md#reissue)

### PEM file

**The file format of your certificate.**

A standard text file that contains your certificate. We host it for you.

*Technical:* Base64 DER certificates between -----BEGIN CERTIFICATE----- markers; the BIMI a= tag points to the full chain.

*Related:* [Logo & certificate hosting](https://getverifiedinbox.com/docs/glossary.md#logo-hosting)

### Test mode (sandbox)

**A safe practice area where nothing is charged or issued.**

Test mode lets you try every step without paying or ordering a real certificate. Switch it on from your dashboard; everything you do there is kept separate.

*Technical:* Environment `test`: Stripe test mode, simulated issuer, separate data and vi_test_ API keys.

*Related:* [API key](https://getverifiedinbox.com/docs/glossary.md#api-key)

### API key

**A password for software to use your account.**

A secret key that lets your tools or AI assistant work with your account. Keep it private.

*Technical:* Bearer token (vi_live_… or vi_test_…), scoped to one organization and environment.

*Related:* [MCP](https://getverifiedinbox.com/docs/glossary.md#mcp), [Test mode (sandbox)](https://getverifiedinbox.com/docs/glossary.md#sandbox)

### MCP

**A way for AI assistants to use VerifiedInbox for you.**

MCP (Model Context Protocol) lets AI assistants like Claude, ChatGPT or Cursor check your domain and move your verification forward, step by step.

*Technical:* Streamable HTTP MCP server at https://api.getverifiedinbox.com/mcp with OAuth (WorkOS) or API-key auth; anonymous tools use a guest token.

*Related:* [API key](https://getverifiedinbox.com/docs/glossary.md#api-key)

### Looks identical

**How we confirm the inbox-ready logo looks the same as your original.**

We draw your original file and the inbox-ready copy at the same size on a white background and compare them pixel by pixel. If less than half a percent of the logo changed visibly, they look identical. Up to 3% counts as small differences; more than that is flagged so you can check carefully.

*Technical:* Both SVGs are rendered at 256×256 px on white. A pixel counts as changed when any colour channel differs by more than 32/255. score = changed pixels ÷ logo area; identical < 0.005, minor < 0.03, otherwise significant.

*Related:* [SVG Tiny P/S](https://getverifiedinbox.com/docs/glossary.md#svg-tiny-ps)

### Matches your logo

**How we decide a registered trademark shows your logo.**

For each registered mark we find, we download its image from the US trademark office and compare it with your logo. An AI image check does the comparison, with a visual fingerprint as a backup. A score of 80% or more counts as a match; lower scores are shown as similar so you or our team can confirm.

*Technical:* The mark image is compared with a 256 px rendering of your logo by a vision model, or by perceptual-hash similarity when the model isn't available. similarity ≥ 0.80 → match_found; 0.60–0.80 → similar.

*Related:* [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark), [USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto)