# VerifiedInbox — full documentation All public VerifiedInbox pages in one file. Index: https://getverifiedinbox.com/llms.txt --- # Get started with VerifiedInbox (guide for AI assistants) > Everything an AI assistant needs to take a company's email domain from a first check to its logo, and Gmail's blue checkmark, shown in the inbox, using the VerifiedInbox MCP server or REST API. You are probably reading this because a person asked you something like: *"Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md"*. This page is written for you, the AI assistant. It contains everything you need to complete the job with the person, step by step, across as many conversations as it takes. ## The 60-second version 1. **Connect** to the MCP server at `https://api.getverifiedinbox.com/mcp` (no credentials needed to start). If you can't use MCP, use the REST API at `https://api.getverifiedinbox.com/v1` (see [REST API fallback](#rest-api-fallback)). 2. **Ask for the domain** if you don't know it (the part after the `@` in the person's work email, e.g. `acme.com`). Shared providers like gmail.com cannot be used. 3. Call `check_domain`, then `start_application`. **Save the `application_id` and `guest_token`** it returns, and tell the person to keep them (or create a resume link) so you can continue later. 4. Walk through the free steps: `set_email_usage` + `recheck_email_security` → `submit_logo` → `get_logo_status` → `get_trademark_status` → `get_eligibility` → `get_estimate`. **Steps only move forward when completed:** once a step's `status` is `ready`, confirm with the person and call `complete_step`. 5. Tell the person, in plain English, which outcome they qualify for: **logo + blue checkmark (VMC)**, **logo only (CMC)**, or **not currently eligible** (and what to do about it). 6. When they are ready to pay, they need an account. Create a checkout link with `create_checkout`; **only the person can pay**. 7. After payment: business details → logo approval (by the person) → DNS records (added by the person) → certificate → go live, completing each step with `complete_step`. Always follow the `next_actions` returned by every tool. ## What VerifiedInbox does VerifiedInbox gets a company's logo shown next to the emails it sends in Gmail and other inboxes that support the BIMI standard, and, with a registered trademark, Gmail's **blue verified checkmark**. It is a one-stop shop: it runs the checks, prepares the logo file, checks the US trademark register, verifies the business, orders the certificate from the certificate issuer (DigiCert), gives copy-paste DNS records, hosts the logo and certificate, monitors the setup and renews the certificate every year. The people you are helping are usually marketing, sales or company leaders, not engineers. Use plain English with them. Technical terms are fine with you, the agent, and in "advanced" details. ## Possible outcomes | Outcome | What the person gets | Requirements | Price | |---|---|---|---| | **VMC** (Verified Mark Certificate) | Logo **and** Gmail's blue checkmark | Registered trademark for the logo (USPTO in the first release), own domain, DMARC at enforcement | $1,499 per domain per year + issuer fee | | **CMC** (Common Mark Certificate) | Logo only, **no checkmark** | Logo used publicly for 12+ months (no trademark needed), own domain, DMARC at enforcement | $899 per domain per year + issuer fee | | **Not currently eligible** | Clear list of what's missing, evidence, a date when they may qualify, and a reminder | — | Free | For a CMC customer, success means **the logo is displayed**. Never promise a checkmark to a CMC customer. ### Separate outcomes (never collapse them into one "verified") An application tracks several independent outcomes. Report each one separately: | Outcome field | Meaning | Values | |---|---|---| | `eligibility` | Which route the domain qualifies for | `unknown`, `assessing`, `vmc_eligible`, `cmc_eligible`, `not_currently_eligible` | | `payment` | Plan payment | `unpaid`, `checkout_open`, `paid`, `refund_pending`, `refunded`, `canceled` | | `business` | Company verification | `not_started`, `verifying`, `verified`, `needs_info`, `rejected` | | `ownership` | Domain control (DNS TXT record) | `pending`, `verified`, `lost` | | `logo` | Logo file | `missing`, `processing`, `ready_for_review`, `approved`, `failed` | | `trademark` | USPTO match | `not_started`, `searching`, `match_found`, `no_match`, `needs_review`, `manually_verified`, `error` | | `certificate` | **Certificate issued** | `not_ordered`, `waiting_prerequisites`, `submitted`, `issuer_validation`, `awaiting_customer`, `issued`, `expiring`, `renewed`, `expired`, `rejected`, `revoked` | | `bimi` | **BIMI correctly published and reachable** | `not_published`, `invalid`, `published` | | `inbox_display` | **Display observed in a real mailbox** | `not_observed`, `observed` | | `dmarc_rollout` | Safe DMARC rollout stage | `missing`, `monitoring`, `quarantine_partial`, `quarantine`, `reject` | "Eligibility assessed", "certificate issued", "BIMI published" and "display observed" are four different milestones. Gmail decides when to show logos and checkmarks; even with everything correct, **display is never guaranteed**. ## Connect to the MCP server - **Endpoint:** `https://api.getverifiedinbox.com/mcp` - **Transport:** MCP Streamable HTTP (JSON responses). Protocol versions `2025-11-25`, `2025-06-18`, `2025-03-26`. - Every MCP tool wraps one or more REST API operations (listed below) and uses the same server logic. Tool arguments are generated from the OpenAPI schema, so MCP and REST never disagree. ### Three ways to connect | Mode | How | What you can do | |---|---|---| | **Anonymous** | Connect with no credentials | All free tools. `start_application` returns a `guest_token`; pass it as the `guest_token` argument on later calls (or send the `VI-Guest-Token` header). | | **OAuth (sign in)** | Clients that support MCP OAuth sign the person in automatically the first time an account tool is called (the server answers HTTP 401 with `WWW-Authenticate` resource metadata). | Everything the person's role allows. | | **API key** | Header `Authorization: Bearer vi_live_…` (real) or `vi_test_…` (test mode). The person creates keys in Dashboard → Settings → API keys. | Scoped to one organization and one environment (live or test). | Never ask the person to paste an API key into the chat unless your client has no safer way to configure headers; prefer OAuth. ### Client setup **Claude (claude.ai and Claude Desktop):** Settings → Connectors → *Add custom connector* → name `VerifiedInbox`, URL `https://api.getverifiedinbox.com/mcp`. Then enable it in the conversation. **Claude Desktop (config file, if custom connectors aren't available):** ```json { "mcpServers": { "verifiedinbox": { "command": "npx", "args": ["-y", "mcp-remote", "https://api.getverifiedinbox.com/mcp"] } } } ``` **Claude Code:** ```bash claude mcp add --transport http verifiedinbox https://api.getverifiedinbox.com/mcp # with an API key (test mode shown): claude mcp add --transport http verifiedinbox https://api.getverifiedinbox.com/mcp \ --header "Authorization: Bearer vi_test_…" ``` **Cursor** (`~/.cursor/mcp.json` or `.cursor/mcp.json` in a project): ```json { "mcpServers": { "verifiedinbox": { "url": "https://api.getverifiedinbox.com/mcp" } } } ``` With an API key: ```json { "mcpServers": { "verifiedinbox": { "url": "https://api.getverifiedinbox.com/mcp", "headers": { "Authorization": "Bearer vi_test_…" } } } } ``` **ChatGPT:** add a custom connector (Settings → Apps & Connectors; on some plans this requires developer mode) with the URL `https://api.getverifiedinbox.com/mcp`. If the person's plan doesn't allow custom connectors, use the [REST API](#rest-api-fallback) if you can make HTTP requests, or guide them through the website at `https://getverifiedinbox.com/verify/new?domain=`. **VS Code / other MCP clients:** add an HTTP MCP server with the URL above, e.g. `.vscode/mcp.json`: ```json { "servers": { "verifiedinbox": { "type": "http", "url": "https://api.getverifiedinbox.com/mcp" } } } ``` If you cannot add the server yourself, tell the person exactly which of the steps above to follow, then continue once the tools are available. ### MCP resources and prompts - Resource `verifiedinbox://get-started` — this guide. - Resource `verifiedinbox://glossary` — plain-English definitions of every term. - Prompt `verify_my_domain(domain)` — starts the guided flow. ## The process, step by step The website shows the same process as an 11-step wizard. Steps 1–5 are **free and anonymous**; steps 6–11 need an account and payment. **Only the person (or you, on their behalf) moves the wizard forward.** Background work changes outcomes but never completes a step. Every step in `steps` lists its `requirements` (required ones must be met; others are recommended). When a step's `status` is `ready`, call `complete_step` with the `application_id` and the step slug; a `409 step_not_ready` lists what's still missing. Statuses: `complete` (done), `attention` (done earlier, but something it relied on broke: fix it and call `complete_step` again), `ready`, `action_required`, `in_progress`, `blocked` (the current step) and `locked` (later steps). | # | Step (`slug`) | Phase | Free | What happens | |---|---|---|---|---| | 1 | `domain` | Check | ✓ | Domain accepted; blocked-provider and registration check | | 2 | `email-health` | Check | ✓ | SPF, DKIM and DMARC results with exact fixes; DMARC must be enforced (filter all or block all) | | 3 | `logo` | Check | ✓ | Logo uploaded or discovered; compliant version prepared; Gmail preview | | 4 | `trademark` | Check | ✓ | USPTO search (or a registration number is verified) | | 5 | `eligibility` | Check | ✓ | VMC, CMC or not currently eligible, with evidence, next steps and an estimate | | 6 | `checkout` | Setup | paid | Sign in and pay through Stripe's hosted checkout | | 7 | `business` | Setup | paid | Legal company details and the applicant | | 8 | `logo-approval` | Setup | paid | The person approves the exact final logo file | | 9 | `dns` | Setup | paid | Ownership and logo (BIMI) records; DMARC from step 2 shown as done | | 10 | `certificate` | Certificate | paid | Final re-check, order, issuer review (a few business days), issuance | | 11 | `go-live` | Live | paid | Logo published, test email, display confirmed; monitoring and renewals on | ### Free steps (anonymous) **Step 0 — explain (optional).** `get_started` returns the process, steps and pricing. Use it if the person asks "how does this work?". **Step 1 — check the domain.** `check_domain` with `{ "domain": "acme.com" }` (emails and URLs are accepted too). It returns a `verdict` (`ok`, `blocked_provider`, `invalid`, `not_registered`), the mailbox provider, whether DMARC and BIMI exist, and a plain-English `summary`. If the verdict is `blocked_provider`, explain why (see [Shared email providers](#shared-email-providers-cannot-be-used)) and ask for their company domain. If `not_registered`, tell them the domain must be registered first (with a registrar such as Cloudflare or GoDaddy). **Step 2 — start (or resume) the application.** `start_application` with `{ "domain": "acme.com" }` returns the `application_id`, a `guest_token` (only the first time), the wizard `steps`, `next_actions` and a `web_url`. It is idempotent: calling it again for the same domain returns the existing application. Background work (DNS scan, website logo discovery, web-archive history) starts immediately. **Step 3 — email security.** Ask the person how email is used on the domain and record it with `set_email_usage` (`none`: new domain or no email yet; `low`: little email; `active`: email every day). The answer decides the recommended path: `none`/`low` publish the blocking DMARC record straight away; `active` follows the staged rollout, though the person may skip ahead (explain the risk). After they change DNS, call `recheck_email_security`: it returns SPF, DKIM and DMARC status, `findings` with ready-made `fix` records, and `dmarc_rollout` with every stage's exact record, what to monitor and what happens to email. If no DKIM key was found, ask for their selector and call `verify_dkim_selectors`. Summarize the 1–3 things that matter. The step needs DMARC enforced (plus SPF and DKIM unless no email is sent); see [Safe DMARC rollout](#safe-dmarc-rollout). `check_email_security` runs the same inspection for any domain without an application. **Step 4 — logo.** `submit_logo` with the `application_id` and one of: SVG text (`svg`), a public URL (`url`), or `use_discovered: true` to use the logo found on their website. Max 512 KB. The original file is kept byte-for-byte; a compliant SVG Tiny P/S copy is produced. Then call `get_logo_status`: it returns the compliance analysis, the list of changes made during conversion (flagging any that change the look), a visual comparison score, and preview URLs. Share the preview with the person. If the logo can't be used (raster only, too complex), explain and ask for a better file (an SVG from their designer or brand guidelines). **Step 5 — trademark.** Submitting the logo starts a USPTO search automatically. `get_trademark_status` returns `match_found`, `no_match`, `needs_review` or `searching`, plus candidates. If the person knows their registration or serial number, call `search_trademark` with it to verify that exact record; you can also pass the owner name or mark text to refine the search. Searches are rate-limited for anonymous users; don't loop. **Step 6 — eligibility.** `get_eligibility` returns `vmc_eligible`, `cmc_eligible` or `not_currently_eligible`, the requirements for each route (met or not, with evidence), `next_steps`, and `estimated_eligible_on` when a date is known. Explain the result in one or two sentences. **Step 7 — estimate.** `get_estimate` with `product` (`vmc` or `cmc`) returns line items (our plan + the issuer's fee, marked as estimated), the total per year and the refund policy. Always show the total before suggesting payment. **If not currently eligible:** offer `watch_eligibility` (we email them when they qualify) and the paid trademark filing service (email `trademark@getverifiedinbox.com`). See [Trademark logic](#trademark-logic). ### Paid steps (account required) **Sign in and claim.** Account tools need the person to be signed in: - If your client supports MCP OAuth, call the account tool (for example `get_account`); the client will open a sign-in window. Then call `claim_application` with the `application_id` and the `guest_token` to move the anonymous draft into their account (atomic; if their organization already has an application for the domain, the more advanced one is kept and you're told which). - Otherwise call `create_resume_link` and give the person the link. They open it, sign in on the website, and the draft is claimed automatically. You can continue later with an API key or OAuth. **Checkout.** `create_checkout` with `{ "application_id", "product": "vmc" | "cmc" }` returns a Stripe `checkout_url` (expires). Give the link to the person; **you cannot pay, and you must never ask for card details**. After they pay, `get_application` shows `payment: "paid"` (confirmation comes from Stripe, usually within seconds). **Business details.** `submit_business_details` with the legal company name, jurisdiction (e.g. `us_de`), registration number, address, and the applicant (name, work email, title, phone), plus `authority_attested: true` only if the person confirms they are authorized to act for the company. Then `get_business_status`. If it returns `needs_info`, ask the person exactly what's requested. **Logo approval (the person decides).** Show the person the original and the converted logo side by side (URLs from `get_logo_status`). Only after they explicitly say it looks right, call `approve_logo` with the `converted_sha256` of the version they reviewed. **DNS records (the person, or their IT, adds them).** `get_dns_records` returns every record to add, each with `host`, `type`, `value`, `purpose` and live `status` (`ok`, `missing`, `mismatch`, `warning`): - Domain ownership: `TXT` at `_verifiedinbox.` - DMARC: `TXT` at `_dmarc.` (at the current safe rollout stage) - BIMI: `TXT` at `default._bimi.` pointing to the hosted logo and certificate - SPF/DKIM advice when needed Present them as a short copy-paste list and say where to paste them (their DNS host, which is detected and returned). After they've added them, call `verify_dns`: it checks the domain's **authoritative nameservers** directly, so correct changes show up within seconds. Never claim you changed DNS yourself; in this release DNS is never changed on the person's behalf. **DKIM and a real test email (optional but recommended).** `verify_dkim_selectors` checks selectors the person supplies. `create_test_message` returns an address; ask the person to send a normal email from their domain to it, then call `get_test_message_result` to see SPF, DKIM and DMARC alignment of that real message. **Certificate.** Ordering happens automatically once the DNS step is completed. Right before the order is sent, a **final re-check** verifies everything the issuer will look at, live (domain, email protection, approved logo, company, trademark, DNS records); it repeats daily while the issuer reviews. Anything that fails holds the order and marks its step `attention`: help the person fix it, then call `complete_step` for that step again. `run_final_check` re-runs it on demand. `get_certificate` returns the status, `final_check`, `customer_actions` (for example "approve the email from DigiCert" or a verification call) and, once issued, the expiry date. Issuer review usually takes a few business days. Relay customer actions clearly and promptly. **Go live.** When the certificate is issued, the BIMI record points to the hosted files. `get_application` shows `bimi: "published"` when everything is reachable and matches. Ask the person to send an email to a Gmail address and look at it; when they confirm they see the logo (and checkmark for VMC), call `confirm_inbox_display` with `{ "mailbox": "gmail", "observed": true }`. Monitoring and renewal start automatically. **After going live.** `get_account` lists every organization, application, status and pending action. `list_orders` shows payments. `renew_certificate` renews early, `reissue_certificate` gets a new certificate (e.g. after a logo change). `revoke_certificate` permanently cancels it and requires `confirm: "REVOKE "`; only do this after the person explicitly asks and confirms. Free tools that work on an application accept `guest_token`; account tools accept `environment` (`live` or `test`). The table below lists every argument. ### Complete tool reference Every MCP tool, what it does, its arguments (`*` = required), whether it needs an account, and the REST operation(s) it wraps. Generated from the OpenAPI schema and the server's tool list. | Tool | What it does | Arguments | Access | API operations | |---|---|---|---|---| | `get_started` | Explains the whole process (free checks, paid setup, certificate, go-live), pricing, what the user must do themselves, and how to continue later. Call this first if you're new to VerifiedInbox. | — | Free | `GET /v1/meta` | | `check_domain` | Free, instant check of an email domain: can it get a verified logo? Detects shared providers that can't be used (gmail.com, outlook.com…), unregistered domains, the mailbox provider and a DMARC/BIMI summary. Accepts a domain, URL or email address. | `domain`* | Free | `POST /v1/checks/domain` | | `check_email_security` | Free full inspection of SPF, DKIM, DMARC and BIMI with plain-English findings and exact fixes. Uses the domain's authoritative nameservers (sees changes within seconds). | `domain`*, `dkim_selectors` | Free | `POST /v1/checks/email-auth` | | `start_application` | Starts the verification for a domain, or returns the existing one. Anonymous callers receive a guest_token — tell the user to keep it (with the application_id) to continue in a later conversation. Background checks start immediately. Returns the full state and next_actions. | `domain`*, `environment`, `guest_token` | Free | `POST /v1/applications` | | `list_applications` | Lists the verifications visible to the caller (guest drafts for a guest_token, or the account's domains). | `environment`, `guest_token` | Free | `GET /v1/applications` | | `get_application` | Full current state: separate outcomes (eligibility, payment, business, ownership, logo, trademark, certificate, BIMI, inbox display), the 11 wizard steps with status, running background work, and next_actions (what to do next and which tool to use). Call this whenever you need to know where things stand. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}`
`GET /v1/applications/{application_id}/next-steps` | | `complete_step` | Moves the verification to the next step once the current step's required items are met (each step lists them in `requirements`; status `ready` means it can be completed). Background work never completes steps; this does, on the user's behalf. Also re-confirms an earlier step marked `attention` after it was fixed. Confirm with the user before completing a step they haven't reviewed. | `application_id`*, `step`*, `guest_token` | Free | `POST /v1/applications/{application_id}/steps/{step}/complete` | | `set_email_usage` | Ask the user how email is used on their domain and record the answer: none (new domain, no email yet), low (little email) or active (email sent every day). none/low can switch on full protection (block all) right away; active should follow the staged rollout, though the user may skip ahead. Returns the email security report with the recommended DMARC record. | `application_id`*, `email_usage`*, `guest_token` | Free | `PUT /v1/applications/{application_id}/email-usage` | | `recheck_email_security` | Re-checks SPF, DKIM and DMARC for the application right now (after the user published records) and returns the report plus the DMARC rollout plan: every stage's exact record, what to monitor and what happens to email at that stage. | `application_id`*, `guest_token` | Free | `POST /v1/applications/{application_id}/email-health/check` | | `submit_logo` | Provide the company logo: SVG text (preferred), a URL to an SVG, or use_discovered=true to use the logo found on the company website. The original is kept untouched; an inbox-ready SVG Tiny P/S version is produced automatically and a US trademark search starts. | `application_id`*, `guest_token`, `svg`, `url`, `use_discovered` | Free | `PUT /v1/applications/{application_id}/logo` | | `get_logo_status` | Logo processing status, compliance issues, the list of changes made for the inbox version (lossy ones flagged), visual difference, and preview URLs. Also lists logos discovered on the website. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}/logo`
`GET /v1/applications/{application_id}/logo-candidates` | | `search_trademark` | Starts (or re-runs) the USPTO trademark search, or verifies a specific US serial/registration number the user provides. A registered trademark matching the logo unlocks the blue checkmark (VMC). Rate-limited for anonymous users. | `application_id`*, `guest_token`, `mark_text`, `owner_name`, `serial_or_registration_number` | Free | `POST /v1/applications/{application_id}/trademark/search`
`POST /v1/applications/{application_id}/trademark/claim` | | `get_trademark_status` | Trademark search result: matched registration (with similarity to the logo), candidates, and what it means. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}/trademark` | | `get_eligibility` | Outcome: vmc_eligible (logo + blue checkmark), cmc_eligible (logo only, no checkmark), not_currently_eligible (with evidence, estimated date and next steps such as the trademark filing service at trademark@getverifiedinbox.com), or assessing. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}/eligibility` | | `get_estimate` | Itemized yearly price before payment: plan (CMC $899 or VMC $1,499 per domain) plus the certificate issuer's fee (pass-through, no markup, ~$750–$1,750). Full refund if issuance is rejected. | `application_id`*, `guest_token`, `product` | Free | `GET /v1/applications/{application_id}/estimate` | | `watch_eligibility` | Emails the user when the domain becomes eligible (we re-check daily). Use for not_currently_eligible outcomes. | `application_id`*, `email`*, `guest_token` | Free | `POST /v1/applications/{application_id}/eligibility/watch` | | `create_resume_link` | Creates a one-time link (valid 24h) that opens this verification in the web app — useful for visual steps like reviewing the logo or copying DNS records. Optionally emails it. | `application_id`*, `email`, `guest_token` | Free | `POST /v1/applications/{application_id}/resume-links` | | `explain_term` | Plain-English explanation of a term such as BIMI, VMC, CMC, DMARC, SPF, DKIM, selector, alignment, SVG Tiny P/S. | `term`* | Free | `GET /v1/glossary/{term}` | | `contact_support` | Sends a message to the VerifiedInbox team (a human replies by email within one business day). Include the user's email. | `message`*, `application_id`, `email`, `guest_token`, `kind`, `name` | Free | `POST /v1/support` | | `send_feedback` | Sends feedback or a feature request to the VerifiedInbox team. | `message`*, `email`, `guest_token`, `kind` | Free | `POST /v1/support` | | `get_account` | Organizations, environment (live/test), every domain with its status and pending actions, and recent orders. | `environment` | Account | `GET /v1/me`
`GET /v1/applications`
`GET /v1/orders` | | `claim_application` | Atomically moves a guest draft (application_id + guest_token) into the signed-in account. If the account already has the domain, keeps the more advanced one and reports which. | `application_id`*, `guest_token`*, `environment` | Account (`applications:write`) | `POST /v1/applications/{application_id}/claim` | | `create_checkout` | Creates a Stripe checkout link for the chosen plan. Only a human can pay: give the link to the user, and confirm the price first (see get_estimate). | `application_id`*, `product`*, `environment`, `idempotency_key` | Account (`billing:write`) | `POST /v1/applications/{application_id}/checkout` | | `submit_business_details` | Legal company details + the applicant (starts business registration verification). Requires payment. jurisdiction is the US state code like us_de. | `address`*, `applicant`*, `application_id`*, `jurisdiction`*, `legal_name`*, `authority_attested`, `environment`, `registration_number` | Account (`applications:write`) | `PUT /v1/applications/{application_id}/business` | | `get_business_status` | Business verification status, matched registry record and applicant authority. | `application_id`*, `environment` | Account | `GET /v1/applications/{application_id}/business` | | `approve_logo` | Approves the exact inbox-ready logo the user reviewed (pass converted_sha256 from get_logo_status). Ask the user to look at the preview first (create_resume_link helps). | `application_id`*, `converted_sha256`*, `environment` | Account (`applications:write`) | `POST /v1/applications/{application_id}/logo/approve` | | `get_dns_records` | Every DNS record the user must add (ownership TXT, DMARC at the right rollout stage, BIMI) with copy-paste values and live status from the authoritative nameservers. The user adds them at their DNS provider. | `application_id`*, `environment` | Account | `GET /v1/applications/{application_id}/dns` | | `verify_dns` | Re-checks the DNS records right now (and watches closely for the next minutes). | `application_id`*, `environment` | Account | `POST /v1/applications/{application_id}/dns/verify` | | `verify_dkim_selectors` | Checks DKIM selectors the user provides. Needed only when the common selectors we try automatically found no key; the user's email provider shows the selector in its DKIM settings. | `application_id`*, `selectors`*, `guest_token` | Free | `POST /v1/applications/{application_id}/dkim-selectors` | | `create_test_message` | Returns an address the user sends a real email to; we then report SPF/DKIM/DMARC alignment on that actual message. | `application_id`*, `environment` | Account | `POST /v1/applications/{application_id}/test-messages` | | `get_test_message_result` | Result of the test email: SPF, DKIM, DMARC alignment and findings. | `application_id`*, `test_message_id`*, `environment` | Account | `GET /v1/applications/{application_id}/test-messages/{test_message_id}` | | `get_certificate` | Certificate status timeline, prerequisites (with the step that fixes each), the latest final check, actions the issuer needs from the user, validity and renewal dates. | `application_id`*, `environment` | Account | `GET /v1/applications/{application_id}/certificate` | | `run_final_check` | Re-verifies live everything the certificate issuer checks (domain, email protection, logo, company, trademark, DNS records). Runs automatically before the order is submitted and daily during the issuer's review; anything that fails marks its step `attention` and holds the order. | `application_id`*, `environment` | Account | `POST /v1/applications/{application_id}/certificate/check` | | `order_certificate` | Submits the certificate order (normally automatic once prerequisites are met). Safe to call repeatedly. | `application_id`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/order` | | `reissue_certificate` | Requests a reissue (e.g. after a logo change). Re-checks domain ownership first. | `application_id`*, `reason`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/reissue` | | `renew_certificate` | Starts the renewal early (renewal is otherwise automatic 45 days before expiry). | `application_id`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/renew` | | `revoke_certificate` | PERMANENTLY revokes the certificate; the logo disappears from inboxes. Only with explicit user confirmation: confirm must be exactly "REVOKE ". | `application_id`*, `confirm`*, `reason`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/revoke` | | `confirm_inbox_display` | Records that the user saw their logo (and checkmark for VMC) in a mailbox such as Gmail — the final 'display observed' outcome. | `application_id`*, `environment`, `mailbox`, `observed` | Account (`applications:write`) | `POST /v1/applications/{application_id}/inbox-display` | | `list_orders` | Orders and payments for the account. | `environment` | Account | `GET /v1/orders`
`GET /v1/orders/{order_id}` | \* required. ## Continuing across conversations All state lives on the server. Nothing resets when a conversation ends. - **Save** the `application_id` and, while anonymous, the `guest_token` (valid 30 days, extended on use, 90 days maximum). Tell the person to keep them, or store them in your memory/notes if your client allows. - **New conversation:** call `list_applications` or `get_application` with the `guest_token`, then read `current_step` and `next_actions` and continue. - **Switch to the browser:** `create_resume_link` returns a one-time link valid for 24 hours. It opens the exact step in the web app. - **After sign-in:** once claimed, the person's account (OAuth or API key) is enough; the guest token is no longer needed. - **Edits are safe:** responses include a `version`. If you send `If-Match` and get `409 version_conflict`, re-read the application and try again. Omitting `If-Match` means "last write wins". ## What only the person can do You can do almost everything, but some actions are deliberately human-only. Guide the person through each: | Action | Why | How to guide them | |---|---|---| | **Pay** | Agents cannot spend money | Show the estimate, then share the Stripe checkout link from `create_checkout` | | **Add DNS records** | Only they (or their IT) can change the domain | Give the exact host/type/value list and where to paste it; then run `verify_dns` | | **Approve the final logo** | It's their brand | Show original vs. converted; call `approve_logo` only after an explicit yes | | **Confirm authority** | Legal attestation | Ask whether they may act for the company before `authority_attested: true` | | **Respond to the issuer** | DigiCert may email or call them | Relay `customer_actions` from `get_certificate` | | **Confirm display** | We can't see their inbox | Ask them to check Gmail, then call `confirm_inbox_display` | ## Shared email providers cannot be used Addresses at shared providers such as gmail.com, outlook.com, hotmail.com, yahoo.com, icloud.com, proton.me or aol.com cannot get a logo or checkmark. These domains belong to the provider and are shared by millions of people; the logo shown for them is the provider's own. The person needs their **own domain** (like `yourcompany.com`). The API returns `blocked_provider` (HTTP 422) with a plain-English reason; the full list is at `GET https://api.getverifiedinbox.com/v1/providers/blocked`. ## Trademark logic - **VMC requires a registered trademark** for the logo. The first release checks the **US Patent and Trademark Office (USPTO) only**. Other offices are not yet supported; a human at VerifiedInbox can review special cases (contact support). - We match the logo against USPTO records automatically (AI vision with a perceptual-hash fallback); a person at VerifiedInbox can verify a match manually when it's ambiguous (`needs_review`). - **No registered trademark?** - If the logo has been in **public use for 12+ months** (we check web archive history), offer a **CMC**: logo, no checkmark. - Offer the **trademark filing service**: the person emails `trademark@getverifiedinbox.com`. Registration usually takes several months; they can start with a CMC meanwhile, and move to a VMC later. - **Neither route yet** (new company, new logo, no trademark): the outcome is `not_currently_eligible`. Explain what's missing and when they may qualify (`estimated_eligible_on`), offer `watch_eligibility` (email reminder), and the trademark service. ## Safe DMARC rollout Logos only show when the domain's DMARC policy is at enforcement (`p=quarantine` or `p=reject`, 100% of mail). How fast to get there depends on how email is used on the domain (`set_email_usage`): - **No email yet (`none`)** or **little email (`low`):** publish the blocking record (`p=reject`) straight away. There is little or nothing to break; if a real email ever bounces, the reports show which service needs setting up. `dmarc_rollout.path` is `direct` and `recommended_record` is the blocking record. - **Email every day (`active`):** tightening too fast can send the company's own newsletters or invoices to spam if some sending service isn't set up yet. The staged plan (`dmarc_rollout.plan`, each stage with its exact record, what to monitor and what happens to email): 1. **Watch:** `p=none` with reporting (`rua=`), suggested 14 days, while every sending service is set up with SPF/DKIM. 2. **Filter some:** `p=quarantine; pct=25`, suggested 7 days. 3. **Filter all:** `p=quarantine` (100%). This meets the requirement. 4. **Block all (recommended):** `p=reject`. The waiting times are suggestions, never enforced: the person may skip ahead. If they want to, explain the risk plainly (real emails from a service that isn't set up yet could go to spam or bounce) and give them the record of the stage they choose. ## Pricing - **Free:** domain check, full email security report, logo preparation and preview, USPTO trademark lookup, eligibility result and price estimate. - **CMC plan:** $899 per domain per year. **VMC plan:** $1,499 per domain per year. Includes business verification, logo preparation, certificate ordering, hosting of the logo and certificate, monitoring, automatic renewals and reminders, and support. - **Certificate issuer fee:** charged by the issuer (DigiCert), passed through **without markup**, collected at the same checkout as a **separate line item**. About **$750–$1,750 per year**; current estimates: VMC ~$1,350, CMC ~$950. Example totals: VMC ≈ $2,849/year, CMC ≈ $1,849/year. - The **estimated total is always shown before payment** (`get_estimate`). - **Full refund** if the certificate issuer rejects the application. - Prices are per domain. Payment is by Stripe's hosted checkout. ## Test mode (sandbox) Signed-in users can switch between **live** and **test** environments (like Stripe). In test mode nothing is charged (Stripe test mode), certificates come from a simulated issuer, and data is kept separate. Use `vi_test_…` API keys or pass `environment: "test"` to account tools. Use test mode when the person wants to see the whole flow before paying, or when you are building an integration. ## REST API fallback Use this if MCP isn't available but you can make HTTP requests. Every tool above has an equivalent REST operation. - **OpenAPI 3.1 document (complete contract):** `https://getverifiedinbox.com/openapi.json` (also `https://api.getverifiedinbox.com/openapi.json`). Load it if you can; each operation lists who may call it (`x-access`), whether it needs an `Idempotency-Key` (`x-idempotency`) and the matching MCP tool (`x-mcp-tools`). - **Base URL:** `https://api.getverifiedinbox.com` (API paths start with `/v1`). JSON bodies, UTF-8. Money is in **cents** (USD). - **Auth headers:** none for public endpoints; `VI-Guest-Token: vi_guest_…` (or `Authorization: Bearer vi_guest_…`) to continue an anonymous application; `Authorization: Bearer vi_live_…` / `vi_test_…` for an account. A guest token can be combined with an account credential (send it in `VI-Guest-Token`) to claim. - **Idempotency:** send `Idempotency-Key: ` where an operation's `x-idempotency` says so: required for checkout and certificate operations, optional when starting an application. - Human-readable reference: [API docs](https://getverifiedinbox.com/docs/api.md). ### Meta Service metadata, health and this contract. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /health` | Liveness check | Public — no credentials needed | — | | `GET /openapi.json` | This OpenAPI document | Public — no credentials needed | — | | `GET /ready` | Readiness check | Public — no credentials needed | — | | `GET /v1/meta` | Pricing, steps and live/mocked integrations | Public — no credentials needed | `get_started` | ### Checks Free, repeatable public checks of any domain. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/checks/domain` | Quick domain eligibility check | Public — no credentials needed | `check_domain` | | `POST /v1/checks/email-auth` | Full SPF/DKIM/DMARC/BIMI inspection | Public — no credentials needed | `check_email_security` | | `GET /v1/providers/blocked` | Shared mailbox domains that can't be used | Public — no credentials needed | — | ### Glossary Plain-English definitions of every term we use. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/glossary` | All glossary terms | Public — no credentials needed | — | | `GET /v1/glossary/{term}` | One glossary term | Public — no credentials needed | `explain_term` | ### Guest sessions Anonymous credentials and resume links. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/guest-sessions` | Create a guest credential | Public — no credentials needed | — | | `DELETE /v1/guest-sessions/current` | Revoke the current guest session | Free — guest or account | — | | `POST /v1/resume` | Exchange a one-time resume token | Public — no credentials needed | — | ### Applications The server-side state of one domain's journey. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications` | List my verifications | Free — guest or account | `list_applications`, `get_account` | | `POST /v1/applications` | Start (or resume) a verification | Public — no credentials needed | `start_application` | | `GET /v1/applications/{application_id}` | Get a verification | Free — guest or account | `get_application` | | `PATCH /v1/applications/{application_id}` | Choose product / contact email | Free — guest or account | — | | `POST /v1/applications/{application_id}/archive` | Archive (unpaid only) | Free — guest or account | — | | `POST /v1/applications/{application_id}/claim` | Move a guest draft into the account | Account required | `claim_application` | | `GET /v1/applications/{application_id}/events` | Timeline of the verification | Free — guest or account | — | | `GET /v1/applications/{application_id}/next-steps` | Current step and next actions | Free — guest or account | `get_application` | | `POST /v1/applications/{application_id}/refresh` | Re-run checks now | Free — guest or account | — | | `POST /v1/applications/{application_id}/resume-links` | One-time link to continue in a browser | Free — guest or account | `create_resume_link` | | `POST /v1/applications/{application_id}/steps/{step}/complete` | Complete a wizard step and move on | Free — guest or account | `complete_step` | ### Email health SPF, DKIM, DMARC and BIMI for an application. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/applications/{application_id}/dkim-selectors` | Verify DKIM selectors you supply | Free — guest or account | `verify_dkim_selectors` | | `GET /v1/applications/{application_id}/email-health` | Latest email-security report + DMARC rollout plan | Free — guest or account | — | | `POST /v1/applications/{application_id}/email-health/check` | Re-check email security now | Free — guest or account | `recheck_email_security` | | `PUT /v1/applications/{application_id}/email-usage` | How email is used on the domain | Free — guest or account | `set_email_usage` | ### Logo Logo intake, SVG Tiny P/S conversion and approval. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/logo` | Logo status, analysis and changes | Free — guest or account | `get_logo_status` | | `PUT /v1/applications/{application_id}/logo` | Submit the logo | Free — guest or account | `submit_logo` | | `GET /v1/applications/{application_id}/logo-candidates` | Logos found on the website | Free — guest or account | `get_logo_status` | | `POST /v1/applications/{application_id}/logo/approve` | Approve the reviewed inbox-ready logo | Paid plan required | `approve_logo` | | `GET /v1/applications/{application_id}/logo/converted.svg` | Inbox-ready SVG Tiny P/S file | Free — guest or account | — | | `GET /v1/applications/{application_id}/logo/original.svg` | Original logo file | Free — guest or account | — | | `GET /v1/applications/{application_id}/logo/preview.png` | Rendered PNG preview | Free — guest or account | — | ### Trademark USPTO trademark search and verification. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/trademark` | Trademark result | Free — guest or account | `get_trademark_status` | | `POST /v1/applications/{application_id}/trademark/claim` | Verify a specific USPTO number | Free — guest or account | `search_trademark` | | `POST /v1/applications/{application_id}/trademark/search` | (Re)start the USPTO search | Free — guest or account | `search_trademark` | ### Eligibility VMC / CMC / not-yet-eligible outcome and price estimate. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/eligibility` | VMC / CMC / not-yet-eligible with evidence | Free — guest or account | `get_eligibility` | | `POST /v1/applications/{application_id}/eligibility/watch` | Email me when this domain qualifies | Free — guest or account | `watch_eligibility` | | `GET /v1/applications/{application_id}/estimate` | Itemized yearly price | Free — guest or account | `get_estimate` | ### Checkout Stripe hosted checkout (agents create links; people pay). | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/applications/{application_id}/checkout` | Create a Stripe checkout link | Account required | `create_checkout` | ### Business Legal company verification. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/business` | Company verification status | Free — guest or account | `get_business_status` | | `PUT /v1/applications/{application_id}/business` | Submit legal company details | Paid plan required | `submit_business_details` | ### DNS The DNS records to add, with live status. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/dns` | Every DNS record to add, with live status | Paid plan required | `get_dns_records` | | `POST /v1/applications/{application_id}/dns/verify` | Re-check DNS now | Paid plan required | `verify_dns` | ### Test messages Authentication results on a real email. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/applications/{application_id}/test-messages` | Get an address to send a real test email to | Account required | `create_test_message` | | `GET /v1/applications/{application_id}/test-messages/{test_message_id}` | Authentication results of the test email | Free — guest or account | `get_test_message_result` | ### Certificate Certificate order, status, reissue, renewal and revocation. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/certificate` | Certificate status, prerequisites, final check and history | Free — guest or account | `get_certificate` | | `POST /v1/applications/{application_id}/certificate/check` | Re-check everything the issuer will verify | Paid plan required | `run_final_check` | | `POST /v1/applications/{application_id}/certificate/order` | Submit the order (normally automatic) | Paid plan required | `order_certificate` | | `POST /v1/applications/{application_id}/certificate/reissue` | Reissue the certificate | Paid plan required | `reissue_certificate` | | `POST /v1/applications/{application_id}/certificate/renew` | Renew early | Paid plan required | `renew_certificate` | | `POST /v1/applications/{application_id}/certificate/revoke` | Revoke permanently | Paid plan required | `revoke_certificate` | ### Go live BIMI publication and display confirmation. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/go-live` | BIMI publication, test email, display, monitoring, renewal | Free — guest or account | — | | `POST /v1/applications/{application_id}/inbox-display` | Record that the logo was seen in a mailbox | Paid plan required | `confirm_inbox_display` | ### Account Profile, organizations, environment, API keys, orders. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/api-keys` | API keys | Account required | — | | `POST /v1/api-keys` | Create an API key (web session) | Account required | — | | `DELETE /v1/api-keys/{api_key_id}` | Revoke an API key | Account required | — | | `POST /v1/billing/portal` | Stripe billing portal link | Account required | — | | `GET /v1/me` | Who am I (works anonymously too) | Public — no credentials needed | `get_account` | | `POST /v1/me/environment` | Switch live/test mode (web session) | Account required | — | | `POST /v1/me/organization` | Switch organization (web session) | Account required | — | | `GET /v1/notifications` | Notification log | Account required | — | | `GET /v1/orders` | Orders and payments | Account required | `get_account`, `list_orders` | | `GET /v1/orders/{order_id}` | One order | Account required | `list_orders` | | `GET /v1/organizations` | My organizations | Account required | — | | `POST /v1/organizations` | Create an organization | Account required | — | | `GET /v1/organizations/{organization_id}` | One organization | Account required | — | | `PATCH /v1/organizations/{organization_id}` | Rename an organization | Account required | — | | `GET /v1/organizations/{organization_id}/members` | Organization members | Account required | — | ### Support Contact a human, feedback and feature requests. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/support` | Contact a human, feedback, feature request, partnership | Public — no credentials needed | `contact_support`, `send_feedback` | ### Hosting Public logo and certificate files referenced by BIMI records. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /bimi/test/{domain}/{file}` | Hosted BIMI assets (test mode) | Public — no credentials needed | — | | `GET /bimi/{domain}/{file}` | Hosted BIMI logo / certificate | Public — no credentials needed | — | ### MCP Model Context Protocol endpoint and OAuth discovery. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /.well-known/oauth-protected-resource` | OAuth protected-resource metadata (RFC 9728) | Public — no credentials needed | — | | `GET /.well-known/oauth-protected-resource/mcp` | OAuth protected-resource metadata for /mcp | Public — no credentials needed | — | | `POST /mcp` | MCP endpoint (Streamable HTTP, JSON responses) | Public — no credentials needed | — | ### Test mode Sandbox helpers (no real payments). | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/dev/mock-checkout/{order_id}/complete` | Simulate payment of a mock checkout | Account required | — | Example: ```bash # 1. Quick check (no credentials) curl -s https://api.getverifiedinbox.com/v1/checks/domain \ -H 'Content-Type: application/json' -d '{"domain":"acme.com"}' # 2. Start an application; save application.id and guest_token from the response curl -s https://api.getverifiedinbox.com/v1/applications \ -H 'Content-Type: application/json' -H 'Idempotency-Key: start-acme-1' \ -d '{"domain":"acme.com"}' # 3. Continue later with the guest token curl -s https://api.getverifiedinbox.com/v1/applications/APPLICATION_ID \ -H 'VI-Guest-Token: vi_guest_…' ``` ## Errors and limits Errors look like `{ "error": { "code", "message", "details"?, "next_action"? } }`. The `message` is plain English and safe to show the person. MCP tool failures return `isError: true` with the same message and `next_actions`. | Code (HTTP) | Meaning | What to do | |---|---|---| | `unauthenticated` (401) | This needs an account | Sign in via OAuth, use an API key, or give the person a resume link | | `payment_required` (402) | This step is paid | Show the estimate and create a checkout link | | `insufficient_scope` / `forbidden` (403) | The key lacks a scope | Ask the person for a key with the needed scope (`applications:read`, `applications:write`, `billing:write`, `certificates:write`, `support:write`) | | `not_found` (404) | Wrong id, or no access | Check the id and credentials (we never reveal whether someone else's application exists) | | `version_conflict` (409) | Someone else changed it | Re-read the application and retry | | `blocked_provider` (422) | Shared email domain | Ask for their own company domain | | `rate_limited` (429) | Too many requests | Wait `Retry-After` / `retry_after_seconds`, then retry once | | `upstream_unavailable` (503) | A provider is temporarily down | Retry later; long-running work continues in the background | Anonymous usage is rate-limited per IP and per guest, and expensive work (trademark searches, AI logo comparison) has a daily budget. Poll gently: when background work is running, check again after a minute or when the person comes back, not in a tight loop. ## Help, support and feedback - `contact_support` — message a human (use `kind: "contact_human"` when the person asks for a person, `support` for help with a step). Include the domain and `application_id`. A human replies by email, usually within one business day. - `send_feedback` — feedback or a feature request. - `explain_term` — plain-English definition of any term (DMARC, BIMI, VMC…). - Email: `support@getverifiedinbox.com` · trademark filing: `trademark@getverifiedinbox.com` · web: [getverifiedinbox.com/support](https://getverifiedinbox.com/support.md). Everything can be done self-service; humans are there if the person wants one. ## How to behave - **Plain language.** Say "fake-email protection" before "DMARC p=quarantine". Offer technical detail if they ask. - **Be honest about outcomes.** Never claim the checkmark or logo display is guaranteed; Gmail decides. Never promise a checkmark to someone on the CMC route. - **Never ask for passwords**, card numbers, DNS-provider logins or one-time codes. Payment happens only on Stripe's page; DNS changes happen in their DNS provider. - **Confirm before consequential actions:** creating a checkout (show the total first), attesting authority, approving the logo, and especially revoking a certificate. - **Use `next_actions`.** Every response tells you what's next, whether it needs sign-in or payment, and which tool to call. - **Keep continuity.** Save the `application_id` and `guest_token`; at the start of a new conversation, look up the existing application instead of starting over. - **Respect the person's time.** Batch what they need to do (e.g. all DNS records at once) and explain how long waits usually take. - If anything is unclear or stuck, use `contact_support`, and tell the person a human will follow up by email. --- # VerifiedInbox for AI agents and assistants > What VerifiedInbox is for, what an AI assistant can do with it, where the boundaries are, and how to connect over MCP or the REST API. **In one sentence:** VerifiedInbox lets an AI assistant take a company's email domain all the way to its logo, and Gmail's blue verified checkmark, shown next to the company's emails, while the person only steps in to pay, edit DNS records and approve their logo. If you are an agent about to do the work, read the complete guide: [get-started.md](https://getverifiedinbox.com/get-started.md) (also [as a web page](https://getverifiedinbox.com/get-started.md)). It contains every step, tool name, error and rule. ## Why this exists When a company sends email, most inboxes show a plain letter next to its name. With the right setup (a standard called [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi) plus a mark certificate), Gmail and other inboxes show the company's real logo instead, and with a [Verified Mark Certificate](https://getverifiedinbox.com/docs/glossary.md#vmc), Gmail adds a blue checkmark. Getting there normally takes weeks of back-and-forth: email security settings, a special logo file format, trademark evidence, business verification, a certificate order, DNS records, hosting, and a renewal every year. VerifiedInbox does all of it as a single service, and it was built **AI-first**: every operation in the web app is also an API call and an MCP tool, the server keeps all state, and every response tells the caller what to do next. ## Who you are helping Mostly non-technical people: marketing managers, sales leaders and founders who want their brand recognized in the inbox and want customers to trust their emails. Talk to them in plain English. Many will paste a single sentence into their assistant, for example: > Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md ## What you can do | Capability | Without an account | With an account | |---|---|---| | Check a domain (blocked providers, registration, mailbox provider, DMARC/BIMI summary) | ✓ | ✓ | | Full SPF, DKIM, DMARC and BIMI inspection with plain-English fixes | ✓ | ✓ | | Start and resume an application; read its full state and next steps | ✓ | ✓ | | Submit a logo; get compliance analysis, conversion changes and previews | ✓ | ✓ | | USPTO trademark search or verification of a registration number | ✓ (rate-limited) | ✓ | | Eligibility (VMC, CMC, not currently eligible) and a price estimate | ✓ | ✓ | | Get notified when the domain becomes eligible | ✓ | ✓ | | Hand off to the browser with a one-time resume link | ✓ | ✓ | | Contact a human, send feedback or a feature request | ✓ | ✓ | | Claim drafts into an organization; see all domains and orders | | ✓ | | Create a checkout link (the person pays) | | ✓ | | Submit business details; read verification status | | ✓ | | Approve the final logo (after the person says yes) | | ✓ | | Get DNS records and verify them against authoritative nameservers | | ✓ | | Send-a-test-email alignment check | | ✓ | | Certificate status, renew early, reissue, revoke (with confirmation) | | ✓ | | Record that the logo was seen in Gmail | | ✓ | Signed-in users can use **test mode** (sandbox): the whole flow without charges or real certificates. ## Boundaries (by design) - **Agents cannot pay.** You can create a Stripe checkout link; only the person can complete it. - **Agents do not change DNS.** You give exact records; the person or their IT adds them. We verify within seconds. - **The person approves the logo.** Approval is tied to the exact file they reviewed. - **Revocation needs an explicit confirmation string** (`REVOKE `) and the `certificates:write` scope. - **No access by guessing.** Knowing a domain or an application id grants nothing; inaccessible resources return 404. - **Shared email domains** (gmail.com, outlook.com, icloud.com, …) cannot be used; the person needs their own domain. ## Connect - **MCP server:** `https://api.getverifiedinbox.com/mcp` (Streamable HTTP). Connect anonymously to start; sign in with OAuth (WorkOS) or use an API key (`vi_live_…` / `vi_test_…`) for account tools. Setup for Claude, ChatGPT, Cursor and Claude Code: [get-started.md → Connect](https://getverifiedinbox.com/get-started.md#connect-to-the-mcp-server). - **REST API:** `https://api.getverifiedinbox.com/v1` — [API reference](https://getverifiedinbox.com/docs/api.md). - **OpenAPI 3.1 schema:** [`https://getverifiedinbox.com/openapi.json`](https://getverifiedinbox.com/openapi.json) (also at `https://api.getverifiedinbox.com/openapi.json`). The complete REST contract; the MCP tools' arguments are generated from it. Each operation says who may call it (`x-access`), whether it needs an `Idempotency-Key` (`x-idempotency`) and which MCP tool does the same thing (`x-mcp-tools`). - **MCP reference:** [all tools](https://getverifiedinbox.com/docs/mcp.md). - **Markdown everywhere:** every page on this site has a markdown version at the same URL plus `.md` (for example [/pricing.md](https://getverifiedinbox.com/pricing.md)), and requests with `Accept: text/markdown` get markdown too. Index: [/llms.txt](https://getverifiedinbox.com/llms.txt) · everything in one file: [/llms-full.txt](https://getverifiedinbox.com/llms-full.txt). ## The outcomes to report Keep these separate when you talk to the person; they are tracked separately by the API: 1. **Eligibility assessed** — VMC (logo + checkmark), CMC (logo only) or not currently eligible. 2. **Certificate issued** — by the certificate issuer (DigiCert). 3. **BIMI published** — the DNS record and hosted files are live and correct. 4. **Display observed** — the person saw the logo (and checkmark, for VMC) in a real Gmail inbox. ## Pricing, in brief Free checker. CMC $899 and VMC $1,499 per domain per year, including business verification, logo preparation, certificate ordering, hosting, monitoring, automatic renewals and support. The certificate issuer's own fee (about $750–$1,750 per year) is separate, passed through without markup and shown before payment. Full refund if the issuer rejects the application. Details: [pricing](https://getverifiedinbox.com/pricing.md). ## Guidelines for assistants 1. Use plain language; offer technical detail only when asked. 2. Never say the checkmark or logo display is guaranteed; Gmail decides what to show. 3. Never ask for passwords, card numbers or DNS-provider logins. 4. Confirm with the person before creating a checkout, attesting authority, approving a logo or revoking a certificate. 5. Save the `application_id` and `guest_token` so you can continue in a later conversation. 6. Follow `next_actions` in every response. 7. If the person wants a human, use `contact_support` with `kind: "contact_human"`. --- # VerifiedInbox — your logo and blue checkmark in your customers' inboxes > Enter your company domain. We check it for free, then handle the certificate, the setup and every renewal, so your logo, and Gmail's blue checkmark, show up next to your emails. Most inboxes show a plain grey letter next to your company's name. With VerifiedInbox, Gmail shows **your logo**, and with a registered trademark, **Gmail's blue verified checkmark**. Other inboxes that support the same standard (BIMI), such as Apple Mail and Yahoo Mail, can show your logo too. **Start:** enter your domain at [getverifiedinbox.com](https://getverifiedinbox.com/index.md) — free, no account needed. Or ask your AI assistant: *"Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md"*. ## Why it matters - **Be recognized.** Your logo stands out in a list of grey letters, so people spot your emails at a glance. - **Be trusted.** The blue checkmark tells readers Gmail has verified that the email really comes from you. - **Be harder to fake.** Getting there requires strong anti-impersonation settings on your domain, which makes it harder for scammers to send email in your name. ## How it works 1. **Check your domain — free.** We look at your email settings and explain, in plain English, what's ready and what needs attention. 2. **Add your logo — free.** Upload it or use the one on your website. We prepare the special file format inboxes need, keep your original untouched, and check the US trademark office. 3. **See if you qualify — free.** You'll know whether you can get the logo with the blue checkmark, the logo only, or what's missing, and see the full price before paying. 4. **We set it up and keep it live.** When you're ready, pay once a year. We verify your business, order the certificate, give you copy-paste settings, host everything and renew it every year. ## We take care of everything Certificates expire about every 13 months. If one lapses, your logo quietly disappears. We make sure that doesn't happen: - **Automatic renewals** before your certificate expires. - **Reminders** 60, 30, 14, 7 and 1 day before anything is due. - **Hosting** of your logo and certificate on fast, secure servers. - **Monitoring** of your settings, with an alert if something breaks. - **Business and logo checks** prepared for the certificate issuer. - **Real people** if you want one. ## Checkmark or logo only? - **Logo + blue checkmark (VMC)** — needs a registered trademark for your logo (we check the US Patent and Trademark Office). $1,499 per domain per year, plus the issuer's fee. - **Logo only (CMC)** — no trademark needed; your logo must have been in public use for at least 12 months. $899 per domain per year, plus the issuer's fee. - **Neither yet?** New logo and no trademark? We tell you exactly what's missing, notify you when you qualify, and can help you file a trademark: email [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com). ## Use it from your AI assistant Copy this prompt into Claude, ChatGPT or Cursor: > Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md Your assistant connects to our MCP server (`https://api.getverifiedinbox.com/mcp`), runs the checks, prepares your logo and tracks progress across conversations. You only step in to pay, add the settings to your domain and approve your logo. Details for assistants: [For AI](https://getverifiedinbox.com/ai.md). ## Pricing | | Price | |---|---| | Checker | Free | | Logo (CMC) | $899 per domain per year | | Logo + blue checkmark (VMC) | $1,499 per domain per year | | Certificate issuer fee (DigiCert) | About $750–$1,750 per year, separate, no markup | You see the estimated total before you pay, and get a full refund if the issuer rejects your application. Details: [pricing](https://getverifiedinbox.com/pricing.md). ## Frequently asked questions **Do I need to be technical?** No. We explain every step in plain English and give you exact settings to copy and paste. You can share the setup page with whoever manages your domain, or talk to a human. **What do I need for the blue checkmark?** Your own company domain, a registered trademark for your logo, and a few email security settings we walk you through. The free check tells you which you already have. **My logo isn't trademarked. Can I still show it?** Usually yes: with a CMC, if your logo has been public for at least 12 months. Gmail shows the logo without the checkmark. We can also help you file a trademark. **How long does it take?** The free checks take about a minute. After payment, the certificate issuer verifies your business and logo, which usually takes from a few days to a few weeks. **Is the checkmark guaranteed?** No one can guarantee it; Gmail decides what to show. We make sure everything on your side is set up correctly and stays that way. If the issuer rejects your application, you get a full refund. **What happens when the certificate expires?** It won't lapse while your plan is active: we remind you early and renew automatically. **Can I try it without paying?** Yes. All checks are free and need no account. Signed-in users also get a test mode that runs every step without charges or real certificates. **Why can't I use my @gmail.com address?** Shared addresses like gmail.com, outlook.com or icloud.com belong to the provider, so the logo shown is theirs. You need your own domain. **Which inboxes show my logo?** Gmail shows your logo, plus the blue checkmark with a VMC. Other inboxes that support BIMI, including Apple Mail and Yahoo Mail, can show your logo too; each provider sets its own rules. ## Talk to a human Everything can be done self-service; humans are here if you want one: [contact us](https://getverifiedinbox.com/support?kind=contact_human) or email [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com). --- # Pricing > Free checks. One yearly price per domain when you're ready. The certificate issuer's fee is separate, passed through without markup, and shown before you pay. ## Plans (per domain, per year) | Plan | Price | What you get | |---|---|---| | **Checker** | Free | Domain check, email security report in plain English, logo preparation and Gmail preview, US trademark lookup, eligibility result, full price estimate. No account needed. | | **Logo — CMC** (Common Mark Certificate) | $899 / domain / year | Your logo in the inbox, **no checkmark**. No trademark needed; your logo must have been in public use for 12+ months. | | **Logo + blue checkmark — VMC** (Verified Mark Certificate) | $1,499 / domain / year | Your logo **and** Gmail's blue verified checkmark. Requires a registered trademark for your logo (US Patent and Trademark Office). | ### Included in both paid plans - Business verification - Logo preparation (we convert your logo to the required format and keep your original) - Certificate ordering from the certificate issuer - Hosting of your logo and certificate - Monitoring of your settings, with alerts - Automatic renewals and reminders (60, 30, 14, 7 and 1 day before) - Support from real people, by email ## The certificate issuer's fee is separate Your certificate is issued by an independent certificate issuer, **DigiCert**, which verifies your business and logo. DigiCert charges its own yearly fee. - We collect it **at the same checkout**, shown as a **separate line**, with **no markup**. - It is about **$750–$1,750 per year**, depending on the certificate type. - You always see the **estimated total before you pay**. ## Estimated yearly total | | Our plan | Est. issuer fee | Est. total / year | |---|---|---|---| | Logo + blue checkmark (VMC) | $1,499 | $1,350 | **$2,849** | | Logo only (CMC) | $899 | $950 | **$1,849** | Estimates use current issuer pricing; your exact amount is shown at checkout. ## Our promises - **Refund if rejected.** If the certificate issuer rejects your application, you get a full refund. - **Estimate first.** The total is shown before you pay, on the website, in the API and through your AI assistant. - **Try it in test mode.** Signed-in users can run every step without charges or real certificates. - **Cancel anytime.** Your plan simply doesn't renew; everything stays live until the end of the year you paid for. ## Pricing questions **Why is the issuer's fee separate?** The certificate comes from an independent company that does its own checks. Their fee is theirs; we pass it through at cost so you pay once, in one place. **What if my application is rejected?** You get a full refund of the plan and the issuer fee. **Is the price per domain?** Yes. Each domain that should show your logo has its own plan. Most companies need one. **Does the price include a trademark?** No. Trademark filing is a separate service: email [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com). Meanwhile, you may qualify for the logo-only plan. **Can I move from logo-only to the checkmark later?** Yes. Once your trademark is registered, contact us and we'll move you to the checkmark plan. **How do I pay?** By card, through Stripe's secure checkout. Your AI assistant can prepare the checkout link, but only you can pay. Prices are in US dollars. **Can I try it without paying?** Yes. All checks are free and need no account; test mode lets signed-in users walk through every step without charges. Questions about larger rollouts or many domains? [Talk to a human](https://getverifiedinbox.com/support?kind=contact_human). --- # Partners > VerifiedInbox turns "we want the blue checkmark" into prepared, pre-validated, DNS-ready applications, through a web app, a REST API and an MCP server that AI assistants use. Partner with us. Companies want their logo, and Gmail's blue checkmark, next to their emails. Most give up somewhere between DMARC settings, logo file formats, trademark evidence and certificate paperwork. VerifiedInbox removes that friction: we prepare every applicant end to end, and we keep them live and renewed year after year. ## Who we work with ### Certificate issuers We bring you **prepared, pre-validated applicants**: - Domain control already proven (DNS TXT), and DMARC at enforcement or on a tracked rollout plan. - Logo converted to SVG Tiny P/S with a visual comparison against the original, and approved by the customer. - Trademark matched against USPTO records (AI vision plus manual review), or prior-use evidence for CMC. - Legal entity checked against company registries; applicant authority confirmed. - BIMI records prepared and verified against authoritative nameservers. The result: fewer back-and-forths, fewer abandoned orders, lower validation cost per certificate, and renewals that happen on time. Our pipeline is API- and MCP-driven, so demand also arrives from AI assistants acting for their users. ### Registrars and DNS hosts Offer "your logo in the inbox" to the domains you already manage. We generate the exact records for each domain and verify them in seconds; our API lets you show status inside your own dashboard. ### Email service providers and marketing platforms Your customers already care about open rates, brand and deliverability. Embed our free eligibility check and setup flow in your product; we handle certificates, hosting, monitoring and renewals. ### Agencies and resellers Manage many client domains from one account with multiple organizations. We do the paperwork; you own the relationship. ### Trust-framework and identity partners Domain control, business identity, trademark evidence and logo provenance in one auditable pipeline. We're interested in verified-organization data, KYB providers and mark-certificate standards work. ## What partners get - **Prepared applicants** — validated data and documents, not raw leads. - **API-first pipeline** — every step is an API call and an MCP tool, with explicit state machines and separate outcomes (eligibility, certificate issued, BIMI published, display observed). - **Retention built in** — automatic renewals with reminders at 60, 30, 14, 7 and 1 day. - **Clear responsibilities** — the issuer validates and issues; we prepare, host, monitor and renew. - **Sandbox** — a full test environment with a simulated issuer and test payments. ## How integration works 1. **REST API** — `https://api.getverifiedinbox.com/v1`. Start with `POST /v1/checks/domain` and `POST /v1/applications`; read state from `GET /v1/applications/{id}`. Every response includes `next_actions`. [API reference](https://getverifiedinbox.com/docs/api.md). 2. **Events and webhooks** — every application has a timeline at `GET /v1/applications/{id}/events`. Partner webhooks for status changes (for example "certificate issued" or "renewal due") are set up with you during onboarding. 3. **MCP** — `https://api.getverifiedinbox.com/mcp`, the same capabilities for AI assistants. [MCP reference](https://getverifiedinbox.com/docs/mcp.md). 4. **Issuer operations** — for certificate issuers, orders, validation status, customer actions, issuance and revocation are mapped to our certificate state machine, via your API where available and an operator back office where not. ## Get in touch Tell us who you are and what you'd like to build: [partnership inquiry](https://getverifiedinbox.com/support?kind=partnership). --- # About VerifiedInbox > VerifiedInbox is on a mission to make email trustworthy again: a verified logo next to real senders, real protection against fakes, and reliable signals for the AI agents that will read email for us. Email is how the world signs in, pays bills, does business and keeps in touch. It is also the easiest place to pretend to be someone else. We want every person and every business to know who an email really comes from. ## Our mission Real senders should look real, fakes should have nowhere to hide, and the AI tools we rely on should know the difference. - **Real senders, easy to spot.** A verified logo and checkmark next to real senders, so anyone can tell a real email from a fake at a glance. - **Fewer fakes in every inbox.** Most scams work because anyone can pretend to send email from someone else's address. We help every domain switch on the protection that stops this ([DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc)) and prove who is behind it. - **Ready for AI that reads your email.** AI agents will soon read, sort, answer and act on email for people. They need a reliable way to know who a sender really is. Verified domains give them one. ## How we work We do the hard parts: - **We run the checks.** Your email settings, logo, trademark and business, checked for you. - **We get the certificate.** We prepare everything the certificate issuer needs and order it for you. - **We host and watch.** Your logo and certificate stay online, and we alert you if anything breaks. - **We renew every year.** No expired certificates, no logo quietly disappearing. Use VerifiedInbox on the web, from your own software with our [API](https://getverifiedinbox.com/docs/api.md), or let an AI assistant do it through our [MCP server](https://getverifiedinbox.com/docs/mcp.md). ## Company VerifiedInbox is a product of Email Intelligence LLC. Email Intelligence LLC 123 Placeholder Avenue, Suite 100 Chicago, IL 60601 United States [Talk to a human](https://getverifiedinbox.com/support?kind=contact_human). ## Made by thinking machines in Illinois Most of VerifiedInbox is built and run by AI agents, with a few humans keeping an eye on them. They read the fine print, double check every record and never forget a renewal. They still can't make coffee. We're working on it. --- # Support > Talk to a human, get help with a step, send feedback or a feature request, or start a partnership conversation. Everything can be done self-service; humans are here if you want one. ## How to reach us - **Web form:** [getverifiedinbox.com/support](https://getverifiedinbox.com/support.md). Choose a topic: talk to a human, get help, feedback, feature request or partnership. - **Email:** [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com). - **Trademark filing service:** [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com). - **From your AI assistant:** the MCP tools `contact_support` (kinds `contact_human`, `support`) and `send_feedback` (feedback or feature request). - **API:** `POST https://api.getverifiedinbox.com/v1/support` with `{ "kind": "contact_human" | "support" | "feedback" | "feature_request" | "partnership", "message", "email", "name"?, "company"?, "application_id"? }`. Works without an account (email required). A human replies by email, usually within one business day. If your question is about a specific domain, include the domain (and your application id if you have it). ## Before you write Many answers are in the docs: [how it works](https://getverifiedinbox.com/docs/how-it-works.md), [eligibility](https://getverifiedinbox.com/docs/eligibility.md), [DNS records](https://getverifiedinbox.com/docs/dns-records.md), [certificates and renewals](https://getverifiedinbox.com/docs/certificates-and-renewals.md) and the [FAQ](https://getverifiedinbox.com/docs/faq.md). --- # VerifiedInbox documentation > How to get your logo, and Gmail's blue checkmark, next to your company's emails, and how we keep it there. VerifiedInbox gets your company's logo shown next to the emails you send, and, if your logo is a registered trademark, adds Gmail's [blue checkmark](https://getverifiedinbox.com/docs/glossary.md#blue-checkmark). You enter your domain; we take care of the checks, the logo file, the certificate, the setup and every renewal. You can do everything three ways: - **On the website** — a step-by-step wizard. Start on the [home page](https://getverifiedinbox.com/index.md). - **With your AI assistant** — paste *"Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md"* into Claude, ChatGPT or Cursor. See [MCP](https://getverifiedinbox.com/docs/mcp.md). - **With the API** — for developers and platforms. See [API](https://getverifiedinbox.com/docs/api.md) and the [OpenAPI schema](https://getverifiedinbox.com/docs/openapi.md). ## The short version 1. **Free checks.** Enter your domain. We check your email settings, prepare your logo, look up your trademark and tell you which option you qualify for, with the full price. No account needed. 2. **Pay when ready.** Create an account and pay once a year per domain. 3. **Setup.** Confirm your business details, approve your logo and copy a few settings into your domain. 4. **Certificate.** The certificate issuer (DigiCert) verifies everything and issues your certificate. 5. **Live.** Your logo appears in Gmail and other supporting inboxes. We monitor it and renew every year. ## Two options - **Logo + blue checkmark** with a [VMC](https://getverifiedinbox.com/docs/glossary.md#vmc). Needs a registered trademark. - **Logo only** with a [CMC](https://getverifiedinbox.com/docs/glossary.md#cmc). No trademark needed; your logo must have been public for at least 12 months. Not sure? The free check tells you. Read more in [VMC vs CMC](https://getverifiedinbox.com/docs/vmc-vs-cmc.md) and [Eligibility](https://getverifiedinbox.com/docs/eligibility.md). ## Need a human? Everything can be done self-service; humans are here if you want one: [contact support](https://getverifiedinbox.com/support?kind=contact_human). --- # How it works > The 11 steps from your domain to your logo in the inbox. The first five are free and need no account. The process is a wizard with 11 steps in four phases. We start with the quick, free steps so you know where you stand within minutes. Slow work (like the trademark search) starts in the background as soon as it can, so you rarely wait. You can go back to any completed step at any time. Every step has its own link, so you can bookmark it or share it with a colleague. ## Phase 1 — Check (free, no account) | # | Step | What happens | |---|---|---| | 1 | **Your domain** | We confirm it's your own [domain](https://getverifiedinbox.com/docs/glossary.md#domain) (not a shared one like gmail.com) and that it's registered, and show a preview of your emails in Gmail. | | 2 | **Email health** | We check your email security settings ([SPF](https://getverifiedinbox.com/docs/glossary.md#spf), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim), [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi)) and explain in plain English what's ready and what to fix. | | 3 | **Your logo** | Upload your logo, give us a link, or use the one we found on your website. We prepare the special file inboxes need and show it in a Gmail preview. | | 4 | **Trademark** | We search the US trademark office ([USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto)) for your logo, or check a registration number you give us. | | 5 | **Eligibility** | You see which option you qualify for (logo + checkmark, logo only, or not yet), the evidence, the next steps and the estimated total price. | ## Phase 2 — Setup (account and payment) | # | Step | What happens | |---|---|---| | 6 | **Checkout** | Sign in (your free-step progress moves into your account) and pay through Stripe's secure checkout. | | 7 | **Business** | Enter your company's legal details and who is applying. We verify them ([business verification](https://getverifiedinbox.com/docs/glossary.md#business-verification)). | | 8 | **Logo approval** | Compare your original logo with the inbox-ready version side by side, and approve it. | | 9 | **DNS** | All the settings to add to your domain, on one page, with copy buttons. We confirm them within seconds. See [DNS records](https://getverifiedinbox.com/docs/dns-records.md). | ## Phase 3 — Certificate | # | Step | What happens | |---|---|---| | 10 | **Certificate** | We order your certificate from the [certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer). They verify your business and logo; if they need anything from you (for example an email confirmation), we tell you. | ## Phase 4 — Live | # | Step | What happens | |---|---|---| | 11 | **Go live** | Your logo and certificate are published. You send a test email and confirm you see your logo in Gmail. Monitoring and automatic renewals switch on. | ## How long it takes - **Free checks:** about a minute. The trademark search may take a few minutes in the background. - **Setup:** as fast as you can enter your details and add the DNS settings. - **Certificate:** the issuer's checks usually take from a few days to a few weeks. ## What "done" means We track four results separately, because they happen at different times: 1. **Eligibility assessed** — you know which option you qualify for. 2. **Certificate issued** — the issuer has issued your certificate. 3. **Published** — your settings and hosted files are live and correct. 4. **Seen in the inbox** — you've seen your logo in a real Gmail inbox. Gmail decides when to show logos and checkmarks, so display can't be guaranteed, but we make sure everything on your side is right. For a logo-only (CMC) plan, success is your logo showing; no checkmark is expected. ## Your progress is saved Your progress lives on our servers, not just in your browser: - Without an account, it's tied to your browser (and to a private guest token if you use the API or an AI assistant). - You can move to another device with a one-time **resume link**. - When you sign in, your progress moves into your account automatically. --- # VMC vs CMC > The two certificates that put your logo in the inbox, what each shows in Gmail, and what each requires. Inboxes only show your logo if it's backed by a mark certificate. There are two kinds. | | Logo + blue checkmark | Logo only | |---|---|---| | Certificate | [VMC](https://getverifiedinbox.com/docs/glossary.md#vmc) (Verified Mark Certificate) | [CMC](https://getverifiedinbox.com/docs/glossary.md#cmc) (Common Mark Certificate) | | Your logo in Gmail | ✓ | ✓ | | Gmail's blue checkmark | ✓ | — | | Registered trademark needed | Yes (USPTO in our first release) | No | | Logo in public use | — | At least 12 months | | Email security settings | Same for both | Same for both | | Our plan | $1,499 / domain / year | $899 / domain / year | | Issuer fee (separate) | est. ~$1,350 / year | est. ~$950 / year | ## Logo + blue checkmark (VMC) A VMC proves your logo is a [registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark) owned by your company. Gmail shows your logo and a blue checkmark next to your name; tapping it explains that the sender has verified they own the domain and the logo. You need: - Your own domain. - A registered trademark for the logo you want to show. We check the US trademark office ([USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto)); see [Trademarks](https://getverifiedinbox.com/docs/trademarks.md). - Email security settings at "enforcement" (we guide you through a [safe rollout](https://getverifiedinbox.com/docs/glossary.md#dmarc-rollout)). ## Logo only (CMC) A CMC is for companies whose logo isn't a registered trademark yet. Gmail shows your logo, but **no checkmark**. You need: - Your own domain. - Proof your logo has been used publicly for at least 12 months ([prior use](https://getverifiedinbox.com/docs/glossary.md#prior-use)). We check public web archives of your website for you. - The same email security settings as a VMC. ## Which should I choose? - **You have a registered trademark:** VMC. The checkmark is the strongest trust signal. - **No trademark, but your logo has been public for a year:** CMC now. You can [file a trademark](https://getverifiedinbox.com/docs/trademarks.md#trademark-filing-service) and move to a VMC once it's registered. - **New logo, no trademark:** you're not eligible yet. See [Eligibility](https://getverifiedinbox.com/docs/eligibility.md) for what to do meanwhile. The free check makes this decision for you and explains why. --- # Eligibility > How we decide whether your domain qualifies for the logo with the checkmark, the logo only, or neither yet, and what to do next in each case. After the free checks, you get one of three results, with the evidence behind it and your next steps. You see this before you pay anything. ## The three results ### Eligible for logo + blue checkmark Your logo matches a registered US trademark owned by your company (or one you've told us about and we've verified). Next: review the estimate and continue to checkout. ### Eligible for logo only We didn't find a registered trademark, but your logo has been in public use for at least 12 months. Next: continue with a [CMC](https://getverifiedinbox.com/docs/glossary.md#cmc), and optionally file a trademark to upgrade later. ### Not currently eligible Neither route works yet, usually because the company or logo is new and there's no registered trademark. This is common for young companies, and it's temporary. We show you: - **What's missing**, requirement by requirement, with the evidence we found. For example: *"No matching USPTO registration found"* or *"Earliest web archive capture: March 2, 2026 (7 months ago)."* - **When you may qualify**, if we can tell (for example the date your logo reaches 12 months of public use). - **Next steps:** - **Get notified.** Leave your email and we'll tell you when you qualify. Creating an account is optional. - **File a trademark.** Our [trademark filing service](https://getverifiedinbox.com/docs/glossary.md#trademark-service) can help: email [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com). - **Prepare meanwhile.** You can already fix your email security settings, so you're ready when the time comes. ## What we check | Requirement | Logo + checkmark (VMC) | Logo only (CMC) | |---|---|---| | Your own, registered domain | ✓ | ✓ | | Registered trademark matching your logo | ✓ | — | | Logo publicly used for 12+ months | — | ✓ | | A logo we can convert to the inbox format | ✓ | ✓ | | Email security at enforcement | needed before going live | needed before going live | Email security settings don't block eligibility: you can fix them during setup. The certificate issuer makes the final decision during its own checks; if it rejects your application, you get a full refund. ## Evidence we use - **Trademarks:** US Patent and Trademark Office records, matched against your logo automatically, with a manual review when it's unclear. See [Trademarks](https://getverifiedinbox.com/docs/trademarks.md). - **Public use:** public web archive captures of your website showing your logo ([prior use](https://getverifiedinbox.com/docs/glossary.md#prior-use)). - **Domain:** registration and DNS lookups. ## The estimate With an eligible result, you see the estimated yearly total: our plan plus the certificate issuer's fee, as separate lines. See [Pricing](https://getverifiedinbox.com/pricing.md). --- # Trademarks > Why the blue checkmark needs a registered trademark, how we find and verify yours, and what to do if you don't have one. Gmail's blue checkmark (a [VMC](https://getverifiedinbox.com/docs/glossary.md#vmc)) is only available for logos that are [registered trademarks](https://getverifiedinbox.com/docs/glossary.md#trademark) owned by your company. This is how the certificate issuer knows the logo is really yours. ## Which trademark offices we support Our first release supports the **United States Patent and Trademark Office** ([USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto)). If your trademark is registered elsewhere, [contact us](https://getverifiedinbox.com/support?kind=support) and we'll tell you what's possible. The trademark must be **registered** (not just applied for), and it should be a design mark, or a design plus words, that matches the logo you want to show. ## How we find your trademark 1. When you add your logo, we automatically search the USPTO register for your company and your logo. 2. We compare your logo with the images of matching registrations, using AI image comparison with a backup visual-matching method. 3. You see the result: **match found**, **no match**, or **needs review**. If you already know your registration or serial number, enter it and we'll check that exact record. ### Manual review Sometimes a match isn't clear-cut (for example, a slightly different version of the logo, or the trademark is held by a parent company). A person at VerifiedInbox reviews these cases and records the decision. You'll see the outcome on your trademark step. ## The logo must match The logo you show in the inbox should be the same as the registered design. Small differences (colors, a missing tagline) may be accepted or not; the certificate issuer has the final say. If yours differs, we'll tell you before you pay. ## No trademark yet? You have two options, and you can do both: - **Logo only, now.** If your logo has been in public use for at least 12 months, you can get a [CMC](https://getverifiedinbox.com/docs/glossary.md#cmc): your logo in Gmail, without the checkmark. See [VMC vs CMC](https://getverifiedinbox.com/docs/vmc-vs-cmc.md). - **File a trademark.** See below. ## Trademark filing service We can help you register your logo as a trademark. Email [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com) with your company name and logo, and we'll explain the options, timing and cost. Registration usually takes several months. When it's registered, we can move you from a CMC to a VMC. ## For developers - `GET /v1/applications/{id}/trademark` returns `status` (`not_started`, `searching`, `match_found`, `no_match`, `needs_review`, `manually_verified`, `error`), the chosen `match` (serial and registration numbers, owner, status, similarity, method) and `candidates`. - `POST /v1/applications/{id}/trademark/search` restarts the search (optional `owner_name`, `mark_text`). - `POST /v1/applications/{id}/trademark/claim` with `serial_or_registration_number` verifies a specific record. - MCP: `search_trademark`, `get_trademark_status`. --- # Logo requirements > What makes a logo work in the inbox, how we convert yours to the required format, and how you approve the result. Inboxes show your logo as a small circle next to your name. They need it in a very specific file format, [SVG Tiny P/S](https://getverifiedinbox.com/docs/glossary.md#svg-tiny-ps). You don't need to create that file: give us your logo and we prepare it. ## What to give us Any of these works: - **An SVG file** of your logo (best). Ask your designer or check your brand guidelines. - **A link** to your logo file online. - **The logo on your website.** We look for it automatically; you just confirm. The file can be up to 512 KB. If you only have a PNG or JPG, we'll tell you; a vector version (SVG, or a PDF/EPS from your designer) gives the best result. ## What makes a logo look good in the inbox - **Square.** The logo is shown in a circle, so a square layout with some breathing room around the mark works best. - **A solid background.** Use your brand color or white behind the mark, rather than a transparent background. - **Simple and bold.** It's shown small. A symbol or monogram often reads better than a long wordmark. - **The same as your trademark** if you want the blue checkmark. See [Trademarks](https://getverifiedinbox.com/docs/trademarks.md). ## What we do to your logo 1. **We keep your original** file exactly as you gave it, separately. 2. **We create an inbox-ready copy** in SVG Tiny P/S: a square canvas, a title with your company name, and without the features the format doesn't allow (scripts, embedded images, animations, external links, some effects). 3. **We compare the two visually** and list every change we made, flagging any that alter how the logo looks. 4. **You review them side by side** and approve the version that will be used. Some advanced design effects can't be carried over exactly. When that happens, we tell you, and you can provide a simpler version. ## Approval In the setup phase, you approve the exact inbox-ready file. Nothing is sent to the certificate issuer until you do. If you change your logo later, we can prepare a new version and [reissue](https://getverifiedinbox.com/docs/glossary.md#reissue) your certificate. ## For developers - `PUT /v1/applications/{id}/logo` with `{ "svg": "…" }`, `{ "url": "https://…" }` or `{ "use_discovered": true }`. - `GET /v1/applications/{id}/logo` returns `status`, `analysis` (compliance issues), `changes` (with a `lossy` flag), `visual_diff` (`identical`, `minor`, `significant`) and URLs for the original, converted and PNG previews. - `POST /v1/applications/{id}/logo/approve` with `converted_sha256` approves exactly the reviewed file (paid step). - Uploaded SVGs are size-limited, never rendered inline, and served with a restrictive content security policy; links are fetched through a protected fetcher. --- # DNS records > Every setting to add to your domain, on one page, with copy buttons, and a safe plan for tightening email protection without breaking your email. Your logo depends on a few public settings on your domain, called [DNS records](https://getverifiedinbox.com/docs/glossary.md#dns-record). You add them where you manage your domain (for example Cloudflare, GoDaddy, Google Domains/Squarespace, Namecheap or Route 53). In the setup phase, the **DNS** step shows every record you need on one page, each with a copy button and a live status. If someone else manages your domain, send them the link to the DNS step. ## The records | Purpose | Type | Host (name) | Value | |---|---|---|---| | Prove you control the domain ([ownership check](https://getverifiedinbox.com/docs/glossary.md#domain-ownership)) | TXT | `_verifiedinbox` | `verifiedinbox-verification=…` (your unique code) | | Tell inboxes to block fakes ([DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc)) | TXT | `_dmarc` | for example `v=DMARC1; p=quarantine; rua=mailto:…` | | Point inboxes to your logo and certificate ([BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi)) | TXT | `default._bimi` | `v=BIMI1; l=https://bimi.getverifiedinbox.com/yourdomain.com/logo.svg; a=https://bimi.getverifiedinbox.com/yourdomain.com/certificate.pem` | | Allowed senders ([SPF](https://getverifiedinbox.com/docs/glossary.md#spf)) | TXT | `@` (your domain) | usually already present; we advise changes if needed | | Email signatures ([DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim)) | TXT or CNAME | `._domainkey` | set up in each service that sends email for you | Your DNS step shows the exact values for your domain. Some DNS hosts want the full host name (`_dmarc.yourdomain.com`), others only the part before your domain (`_dmarc`); we show both. ## How to add a record 1. Sign in where you manage your domain and open its DNS settings. 2. Choose **Add record**, pick the type (usually **TXT**). 3. Paste the **host** and the **value** from the DNS step. Leave the time-to-live ([TTL](https://getverifiedinbox.com/docs/glossary.md#ttl)) at its default. 4. Save, then press **Check now** on the DNS step. ## Changes show up in seconds Most tools wait for DNS changes to spread around the internet, which can take hours. We ask your domain's own servers directly ([authoritative nameservers](https://getverifiedinbox.com/docs/glossary.md#authoritative-dns)), so a correct record usually shows as done within seconds of saving it. ## Safe DMARC rollout Logos only show when your DMARC policy tells inboxes to quarantine or reject fake email. How quickly you get there depends on how you use email on the domain; the email security step asks you. **New domain, or little email sent:** publish the blocking record (`v=DMARC1; p=reject; rua=mailto:…`) straight away. There's little or nothing to break. **Email sent every day:** switching protection on too fast can send your own newsletters, invoices or sales emails to spam, if one of the services sending email for you isn't set up yet. So we suggest four steps ([safe DMARC rollout](https://getverifiedinbox.com/docs/glossary.md#dmarc-rollout)): | Stage | Record value (example) | Suggested time | What it does | |---|---|---|---| | 1. Watch | `v=DMARC1; p=none; rua=mailto:…` | 14 days | Watches only. Reports show every service sending as you. | | 2. Filter some | `v=DMARC1; p=quarantine; pct=25; rua=mailto:…` | about a week | A quarter of failing mail goes to spam. | | 3. Filter all | `v=DMARC1; p=quarantine; rua=mailto:…` | about a week | Failing mail goes to spam. **Enough for your logo.** | | 4. Block all (recommended) | `v=DMARC1; p=reject; rua=mailto:…` | ongoing | Failing mail is refused. | The times are suggestions: you can move ahead sooner if you accept the risk. The email security step shows the exact record for each stage, what to watch and what happens to your email. ## Checking your email setup We keep four checks separate, so you always know what's done: 1. **Settings inspection** — your public records (free, any time). 2. **DKIM selectors** — signature keys for the services you name. Selectors can't be discovered automatically, so tell us yours (for example `google` or `selector1`) ([DKIM selector](https://getverifiedinbox.com/docs/glossary.md#dkim-selector)). 3. **A real test email** — send an email to the address we give you; we check that it passes and is [aligned](https://getverifiedinbox.com/docs/glossary.md#alignment) with your domain. 4. **Ongoing monitoring** — after you go live, we keep checking and alert you if something breaks. ## Common issues - **Two SPF records.** Only one is allowed; merge them. - **Too many SPF lookups.** SPF allows at most 10; remove services you no longer use. - **DMARC on a subdomain only.** BIMI checks your main domain's policy too ([organizational domain](https://getverifiedinbox.com/docs/glossary.md#organizational-domain)). - **Quotes or line breaks** pasted into the value. Paste the value exactly as shown. ## One-click DNS Automatic DNS setup (for example with Cloudflare) isn't available yet. Copy-paste takes a few minutes, and we never ask for your DNS login. ## For developers - `POST /v1/checks/email-auth` — free inspection with plain-English findings and `fix` suggestions. - `GET /v1/applications/{id}/dns` — every record with `host`, `host_relative`, `type`, `value`, `current`, `status` (`ok`, `missing`, `mismatch`, `warning`), plus `nameservers` and `dns_host`. - `POST /v1/applications/{id}/dns/verify` — re-check now against authoritative nameservers. - `GET /v1/applications/{id}/email-health` — includes `dmarc_rollout` with the current stage, `next_stage`, `ready_to_advance` and the full plan. - MCP: `check_email_security`, `get_dns_records`, `verify_dns`, `verify_dkim_selectors`, `create_test_message`, `get_test_message_result`. --- # Certificates and renewals > How your certificate is ordered and issued, and how we renew, reissue or revoke it so your logo never disappears. Your logo is backed by a mark certificate ([VMC](https://getverifiedinbox.com/docs/glossary.md#vmc) or [CMC](https://getverifiedinbox.com/docs/glossary.md#cmc)) issued by an independent [certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer), currently DigiCert. We order it, track it and keep it renewed. ## Ordering We order your certificate automatically as soon as everything is ready: - payment received, - business details verified, - logo approved, - domain ownership confirmed. You don't have to press anything. The certificate step shows each prerequisite and whether it's met. ## Issuer validation The issuer does its own checks of your business, your authority to apply and your logo. They may: - email the applicant to confirm the request, - call the phone number you gave, or - ask for a document. When they need something from you, the certificate step (and an email from us) tells you exactly what to do. Validation usually takes from a few days to a few weeks. If the issuer rejects the application, you get a **full refund**. ## Statuses | Status | Meaning | |---|---| | Not ordered | Waiting for the prerequisites above | | Submitted | Sent to the issuer | | Issuer validation | The issuer is checking | | Waiting for you | The issuer needs an action from you | | Issued | Your certificate is ready and published | | Expiring | Renewal is under way | | Renewed | A new certificate replaced the old one | | Rejected / Revoked / Expired | See below | ## Renewals Mark certificates are valid for about **13 months** (at most 398 days). If one expires, your logo stops showing. We prevent that: - We **start the renewal automatically** about 45 days before expiry, as long as your plan is active. - We send **reminders 60, 30, 14, 7 and 1 day** before anything is due, so nothing surprises you. - If something needs your attention (for example the issuer re-confirming your details), we tell you early. - Renewal also renews your plan for another year; the estimated total, including the issuer's fee, is shown before it's charged. You can also renew early from the certificate step. ## Reissue A [reissue](https://getverifiedinbox.com/docs/glossary.md#reissue) gets you a fresh certificate within the same paid year, for example after you update your logo or your company details change. Start it from the certificate step and we handle the rest. ## Revocation [Revocation](https://getverifiedinbox.com/docs/glossary.md#revocation) cancels a certificate permanently, and your logo stops showing. Only do this if something is wrong (for example the certificate shows an outdated legal name, or you no longer use the domain). Because it can't be undone, it requires an explicit confirmation. ## Hosting Your certificate file ([PEM](https://getverifiedinbox.com/docs/glossary.md#pem)) and logo are hosted by us. See [Hosting](https://getverifiedinbox.com/docs/hosting.md). ## For developers - `GET /v1/applications/{id}/certificate` — `status`, `issuer_order_id`, `serial`, `not_before`, `not_after`, `days_remaining`, `prerequisites`, `customer_actions`, `timeline`, plus `history`. - `POST /v1/applications/{id}/certificate/order` — normally automatic; idempotent. - `POST /v1/applications/{id}/certificate/renew` — early renewal. - `POST /v1/applications/{id}/certificate/reissue` — `{ "reason" }`. - `POST /v1/applications/{id}/certificate/revoke` — `{ "reason", "confirm": "REVOKE yourdomain.com" }`. - Mutations need the `certificates:write` scope and an `Idempotency-Key` header. - MCP: `get_certificate`, `order_certificate`, `renew_certificate`, `reissue_certificate`, `revoke_certificate`. --- # Hosting > We host your inbox-ready logo and your certificate, so inboxes can always find them. Inboxes don't receive your logo with each email. They look it up: your [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi) record points to a logo file and a certificate file on the internet, and the inbox downloads them. Those files must always be online, fast and correct. We take care of that ([logo and certificate hosting](https://getverifiedinbox.com/docs/glossary.md#logo-hosting)). ## Where your files live ```text https://bimi.getverifiedinbox.com/yourdomain.com/logo.svg https://bimi.getverifiedinbox.com/yourdomain.com/certificate.pem ``` Your BIMI record points to these addresses. You don't have to upload anything or change anything when we renew: the addresses stay the same, and we swap in the new certificate. ## What we take care of - **Correct formats** — the inbox-ready logo ([SVG Tiny P/S](https://getverifiedinbox.com/docs/glossary.md#svg-tiny-ps)) and the full certificate chain ([PEM](https://getverifiedinbox.com/docs/glossary.md#pem)), with the right content types. - **Matching files** — the hosted logo always matches the one inside your certificate. - **Availability** — files are served over HTTPS and cached for speed. - **Monitoring** — we regularly check that your record, logo and certificate are reachable and consistent, and alert you if not. ## Can I host the files myself? You can, but you'd have to update them at every renewal and keep them in sync with your certificate. Hosting is included in your plan, so most customers let us do it. ## Before you go live The addresses return "not found" until your certificate is issued. That's expected. --- # Test mode > Try every step, including checkout and certificate issuance, without paying or ordering a real certificate. Test mode ([sandbox](https://getverifiedinbox.com/docs/glossary.md#sandbox)) is a separate practice environment. It works like Stripe's test mode: you switch between **Live** and **Test** with one toggle, and the two never mix. ## What's different in test mode | | Live | Test | |---|---|---| | Payments | Real (Stripe) | Stripe test mode: nothing is charged; use Stripe's test cards | | Certificates | Issued by DigiCert | Simulated issuer; certificates aren't trusted by any inbox | | Data | Your real domains and orders | Kept completely separate | | API keys | `vi_live_…` | `vi_test_…` | | Banner | — | An orange "Test mode" bar across the top | The free checks (domain, email health, logo, trademark, eligibility) are real in both modes, because they only read public information. ## How to switch - **Website:** sign in, then use the Live/Test switch in your dashboard. An orange banner shows whenever you're in test mode. - **API:** use a `vi_test_…` key (keys are tied to one environment), or send `VI-Environment: test` with an OAuth token. - **MCP / AI assistants:** connect with a test key, or pass `environment: "test"` to account tools. ## Good uses for test mode - Showing your team the whole process before buying. - Letting your AI assistant rehearse the flow. - Building and testing an integration against our API. Test data may be reset from time to time. --- # Accounts and organizations > Sign in only when you need to, manage several companies and domains, invite your team and create API keys. You don't need an account for the free checks. You create one when you're ready to pay, and everything you did before moves into it automatically. ## Signing in We use secure single sign-on (through WorkOS): sign in with your work email, or your company's identity provider if it's set up. When you sign in, any domains you checked in that browser (or through a resume link) are **claimed** into your current organization in one step. If your organization already has an application for the same domain, we keep the more advanced one (a paid one wins over an unpaid one) and archive the other, so you never end up with duplicates. ## Organizations An organization is a company (or a client, if you're an agency). You can: - belong to **several organizations** and switch between them, - add **several domains** to each organization, each with its own plan and certificate, - invite teammates with a role (owner, admin or member). Each organization has its own billing, domains, API keys and history, and separate **live** and **test** data. See [Test mode](https://getverifiedinbox.com/docs/test-mode.md). ## Domains Each domain has its own application: its steps, statuses, certificate, renewal date and full history of events. Your dashboard shows what needs your attention across all of them. ## API keys Create [API keys](https://getverifiedinbox.com/docs/glossary.md#api-key) in **Dashboard → Settings → API keys** for your tools or AI assistant. - A key belongs to one organization and one environment: `vi_live_…` or `vi_test_…`. - Give each key only the permissions it needs (scopes): | Scope | Allows | |---|---| | `applications:read` | Reading applications, DNS records, certificates, orders | | `applications:write` | Starting and updating applications, business details, logo approval, claiming drafts | | `billing:write` | Creating checkout links (a person still has to pay) | | `certificates:write` | Ordering, renewing, reissuing and revoking certificates | | `support:write` | Contacting support | - The full key is shown **once**, when you create it. Store it safely, and revoke keys you no longer use. ## Continuing on another device Without an account, your progress is tied to your browser. To continue elsewhere, create a **resume link** from the wizard (or ask your AI assistant): it's single-use and valid for 24 hours. After you sign in, your account is all you need. ## Billing Plans are billed per domain, per year, through Stripe. Invoices and payment methods are available from the billing portal in your dashboard. See [Pricing](https://getverifiedinbox.com/pricing.md). --- # Security > How we protect your domain, your data and your certificate, and the limits we put on what software and AI agents can do. A mark certificate represents your brand in millions of inboxes. We treat every step that could affect it with care. ## Proving it's really you - **Domain control.** Before we order, reissue or revoke a certificate, you prove you control the domain by adding a unique [ownership record](https://getverifiedinbox.com/docs/glossary.md#domain-ownership). If that record disappears later, we notice. - **Authority.** The applicant must be allowed to act for the company: confirmed by an email address at your domain, or by your attestation, and then verified by the certificate issuer. - **Business verification.** We check your company against official registries before the issuer does its own checks. ## Private by default - Knowing a domain gives no one access to its application. Only the person who started it (in their browser or with their private guest token), members of the owning organization and our operators can see it. Anyone else gets "not found", so we never even confirm an application exists. - Free checks only read public information and never reveal anything about existing applications. - Links you share point to steps, never to credentials. One-time resume links keep their secret in the part of the URL that browsers don't send to servers, expire after 24 hours and work once. ## Organizations stay separate Every query is scoped to your organization and environment (live or test). API keys and AI-assistant sessions carry explicit permissions (scopes), so a read-only key can't change anything. ## Limits on software and AI agents - **Agents can't pay.** They can create a checkout link; only a person can complete payment on Stripe's page. - **No DNS changes on your behalf** in this release; you add records yourself, and we never ask for your DNS login. - **Revocation requires an explicit confirmation** and a dedicated permission. - **Idempotency.** Payments, certificate orders and retries are protected against accidental duplicates. ## Safe handling of files and links - Uploaded SVG logos are size-limited, checked, never rendered directly inside our pages and served with strict security headers. - Links you give us are fetched through a protected fetcher that only reaches public internet addresses, with size and time limits. ## Abuse protection Anonymous use is rate-limited, and expensive work (trademark searches, AI image comparison, automated browsing) has budgets, so the free tools stay fast for everyone. ## Secrets Our own credentials are kept out of code and stored as protected configuration. We don't store your DNS provider credentials. ## Reporting a problem If you think you've found a security issue, email [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com) with the details. We'll respond quickly. --- # API reference > The VerifiedInbox REST API (v1). Every step of the process is an API call; free steps work without an account. Everything you can do on the website, you can do with the API. The same operations are also available to AI assistants through [MCP](https://getverifiedinbox.com/docs/mcp.md). ## Basics - **Base URL:** `https://api.getverifiedinbox.com`. All endpoints are under `/v1`. - **Format:** JSON bodies (`Content-Type: application/json`), UTF-8. Timestamps are RFC 3339 (UTC). Money is in integer **cents** (USD). - **Versioning:** v1 only changes in backward-compatible ways (new fields may appear). - **Pagination:** list responses look like `{ "data": [...], "next_cursor": null }`. ## Authentication | Credential | How to send it | For | |---|---|---| | None | — | Public checks | | Guest token | `VI-Guest-Token: vi_guest_…` or `Authorization: Bearer vi_guest_…` | Continuing an anonymous application | | API key | `Authorization: Bearer vi_live_…` or `vi_test_…` | Servers, scripts, AI agents ([API keys](https://getverifiedinbox.com/docs/glossary.md#api-key)) | | OAuth token | `Authorization: Bearer ` (WorkOS) | MCP clients signed in as a person | You can send a guest token together with an account credential (guest token in `VI-Guest-Token`): that's how anonymous drafts are claimed. OAuth callers can add `VI-Environment: live|test` and `VI-Organization: `. API keys are bound to one organization and environment. Scopes: `applications:read`, `applications:write`, `billing:write`, `certificates:write`, `support:write`. ## Conventions - **Errors** return `{ "error": { "code", "message", "details"?, "next_action"? } }`. The `message` is plain English. Common codes: `invalid_request` (400), `unauthenticated` (401), `payment_required` (402), `forbidden`/`insufficient_scope` (403), `not_found` (404), `version_conflict`/`conflict` (409), `unprocessable`/`blocked_provider` (422), `rate_limited` (429, with `Retry-After`), `upstream_unavailable` (503). Resources you can't access return 404, never 403. - **Idempotency:** checkout and certificate operations require an `Idempotency-Key` header (up to 255 characters); starting an application accepts one. Same key and body → the original response is replayed; same key with a different body → 409. The `x-idempotency` field of each operation in the OpenAPI document says which. - **Concurrency:** applications have a `version`. Send `If-Match: ""` on user-driven changes to avoid overwriting someone else's edit (409 `version_conflict` returns the current application). - **Next actions:** application responses include `next_actions`, each with a title, the step, whether it needs sign-in or payment, and the matching API call and MCP tool. ## OpenAPI The complete, machine-readable contract is an **OpenAPI 3.1** document: - [`https://getverifiedinbox.com/openapi.json`](https://getverifiedinbox.com/openapi.json) (also served by the API at `https://api.getverifiedinbox.com/openapi.json`) Import it into Postman, Insomnia or an SDK generator, or hand it to an AI assistant. Each operation lists who may call it (`x-access`), whether it needs an `Idempotency-Key` (`x-idempotency`), and the MCP tool that does the same thing (`x-mcp-tools`). The tables below are generated from that document, so they always match the live API. More: [OpenAPI schema](https://getverifiedinbox.com/docs/openapi.md). ## Endpoints ### Meta Service metadata, health and this contract. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /health` | Liveness check | Public — no credentials needed | — | | `GET /openapi.json` | This OpenAPI document | Public — no credentials needed | — | | `GET /ready` | Readiness check | Public — no credentials needed | — | | `GET /v1/meta` | Pricing, steps and live/mocked integrations | Public — no credentials needed | `get_started` | ### Checks Free, repeatable public checks of any domain. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/checks/domain` | Quick domain eligibility check | Public — no credentials needed | `check_domain` | | `POST /v1/checks/email-auth` | Full SPF/DKIM/DMARC/BIMI inspection | Public — no credentials needed | `check_email_security` | | `GET /v1/providers/blocked` | Shared mailbox domains that can't be used | Public — no credentials needed | — | ### Glossary Plain-English definitions of every term we use. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/glossary` | All glossary terms | Public — no credentials needed | — | | `GET /v1/glossary/{term}` | One glossary term | Public — no credentials needed | `explain_term` | ### Guest sessions Anonymous credentials and resume links. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/guest-sessions` | Create a guest credential | Public — no credentials needed | — | | `DELETE /v1/guest-sessions/current` | Revoke the current guest session | Free — guest or account | — | | `POST /v1/resume` | Exchange a one-time resume token | Public — no credentials needed | — | ### Applications The server-side state of one domain's journey. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications` | List my verifications | Free — guest or account | `list_applications`, `get_account` | | `POST /v1/applications` | Start (or resume) a verification | Public — no credentials needed | `start_application` | | `GET /v1/applications/{application_id}` | Get a verification | Free — guest or account | `get_application` | | `PATCH /v1/applications/{application_id}` | Choose product / contact email | Free — guest or account | — | | `POST /v1/applications/{application_id}/archive` | Archive (unpaid only) | Free — guest or account | — | | `POST /v1/applications/{application_id}/claim` | Move a guest draft into the account | Account required | `claim_application` | | `GET /v1/applications/{application_id}/events` | Timeline of the verification | Free — guest or account | — | | `GET /v1/applications/{application_id}/next-steps` | Current step and next actions | Free — guest or account | `get_application` | | `POST /v1/applications/{application_id}/refresh` | Re-run checks now | Free — guest or account | — | | `POST /v1/applications/{application_id}/resume-links` | One-time link to continue in a browser | Free — guest or account | `create_resume_link` | | `POST /v1/applications/{application_id}/steps/{step}/complete` | Complete a wizard step and move on | Free — guest or account | `complete_step` | ### Email health SPF, DKIM, DMARC and BIMI for an application. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/applications/{application_id}/dkim-selectors` | Verify DKIM selectors you supply | Free — guest or account | `verify_dkim_selectors` | | `GET /v1/applications/{application_id}/email-health` | Latest email-security report + DMARC rollout plan | Free — guest or account | — | | `POST /v1/applications/{application_id}/email-health/check` | Re-check email security now | Free — guest or account | `recheck_email_security` | | `PUT /v1/applications/{application_id}/email-usage` | How email is used on the domain | Free — guest or account | `set_email_usage` | ### Logo Logo intake, SVG Tiny P/S conversion and approval. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/logo` | Logo status, analysis and changes | Free — guest or account | `get_logo_status` | | `PUT /v1/applications/{application_id}/logo` | Submit the logo | Free — guest or account | `submit_logo` | | `GET /v1/applications/{application_id}/logo-candidates` | Logos found on the website | Free — guest or account | `get_logo_status` | | `POST /v1/applications/{application_id}/logo/approve` | Approve the reviewed inbox-ready logo | Paid plan required | `approve_logo` | | `GET /v1/applications/{application_id}/logo/converted.svg` | Inbox-ready SVG Tiny P/S file | Free — guest or account | — | | `GET /v1/applications/{application_id}/logo/original.svg` | Original logo file | Free — guest or account | — | | `GET /v1/applications/{application_id}/logo/preview.png` | Rendered PNG preview | Free — guest or account | — | ### Trademark USPTO trademark search and verification. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/trademark` | Trademark result | Free — guest or account | `get_trademark_status` | | `POST /v1/applications/{application_id}/trademark/claim` | Verify a specific USPTO number | Free — guest or account | `search_trademark` | | `POST /v1/applications/{application_id}/trademark/search` | (Re)start the USPTO search | Free — guest or account | `search_trademark` | ### Eligibility VMC / CMC / not-yet-eligible outcome and price estimate. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/eligibility` | VMC / CMC / not-yet-eligible with evidence | Free — guest or account | `get_eligibility` | | `POST /v1/applications/{application_id}/eligibility/watch` | Email me when this domain qualifies | Free — guest or account | `watch_eligibility` | | `GET /v1/applications/{application_id}/estimate` | Itemized yearly price | Free — guest or account | `get_estimate` | ### Checkout Stripe hosted checkout (agents create links; people pay). | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/applications/{application_id}/checkout` | Create a Stripe checkout link | Account required | `create_checkout` | ### Business Legal company verification. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/business` | Company verification status | Free — guest or account | `get_business_status` | | `PUT /v1/applications/{application_id}/business` | Submit legal company details | Paid plan required | `submit_business_details` | ### DNS The DNS records to add, with live status. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/dns` | Every DNS record to add, with live status | Paid plan required | `get_dns_records` | | `POST /v1/applications/{application_id}/dns/verify` | Re-check DNS now | Paid plan required | `verify_dns` | ### Test messages Authentication results on a real email. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/applications/{application_id}/test-messages` | Get an address to send a real test email to | Account required | `create_test_message` | | `GET /v1/applications/{application_id}/test-messages/{test_message_id}` | Authentication results of the test email | Free — guest or account | `get_test_message_result` | ### Certificate Certificate order, status, reissue, renewal and revocation. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/certificate` | Certificate status, prerequisites, final check and history | Free — guest or account | `get_certificate` | | `POST /v1/applications/{application_id}/certificate/check` | Re-check everything the issuer will verify | Paid plan required | `run_final_check` | | `POST /v1/applications/{application_id}/certificate/order` | Submit the order (normally automatic) | Paid plan required | `order_certificate` | | `POST /v1/applications/{application_id}/certificate/reissue` | Reissue the certificate | Paid plan required | `reissue_certificate` | | `POST /v1/applications/{application_id}/certificate/renew` | Renew early | Paid plan required | `renew_certificate` | | `POST /v1/applications/{application_id}/certificate/revoke` | Revoke permanently | Paid plan required | `revoke_certificate` | ### Go live BIMI publication and display confirmation. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/applications/{application_id}/go-live` | BIMI publication, test email, display, monitoring, renewal | Free — guest or account | — | | `POST /v1/applications/{application_id}/inbox-display` | Record that the logo was seen in a mailbox | Paid plan required | `confirm_inbox_display` | ### Account Profile, organizations, environment, API keys, orders. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /v1/api-keys` | API keys | Account required | — | | `POST /v1/api-keys` | Create an API key (web session) | Account required | — | | `DELETE /v1/api-keys/{api_key_id}` | Revoke an API key | Account required | — | | `POST /v1/billing/portal` | Stripe billing portal link | Account required | — | | `GET /v1/me` | Who am I (works anonymously too) | Public — no credentials needed | `get_account` | | `POST /v1/me/environment` | Switch live/test mode (web session) | Account required | — | | `POST /v1/me/organization` | Switch organization (web session) | Account required | — | | `GET /v1/notifications` | Notification log | Account required | — | | `GET /v1/orders` | Orders and payments | Account required | `get_account`, `list_orders` | | `GET /v1/orders/{order_id}` | One order | Account required | `list_orders` | | `GET /v1/organizations` | My organizations | Account required | — | | `POST /v1/organizations` | Create an organization | Account required | — | | `GET /v1/organizations/{organization_id}` | One organization | Account required | — | | `PATCH /v1/organizations/{organization_id}` | Rename an organization | Account required | — | | `GET /v1/organizations/{organization_id}/members` | Organization members | Account required | — | ### Support Contact a human, feedback and feature requests. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/support` | Contact a human, feedback, feature request, partnership | Public — no credentials needed | `contact_support`, `send_feedback` | ### Hosting Public logo and certificate files referenced by BIMI records. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /bimi/test/{domain}/{file}` | Hosted BIMI assets (test mode) | Public — no credentials needed | — | | `GET /bimi/{domain}/{file}` | Hosted BIMI logo / certificate | Public — no credentials needed | — | ### MCP Model Context Protocol endpoint and OAuth discovery. | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `GET /.well-known/oauth-protected-resource` | OAuth protected-resource metadata (RFC 9728) | Public — no credentials needed | — | | `GET /.well-known/oauth-protected-resource/mcp` | OAuth protected-resource metadata for /mcp | Public — no credentials needed | — | | `POST /mcp` | MCP endpoint (Streamable HTTP, JSON responses) | Public — no credentials needed | — | ### Test mode Sandbox helpers (no real payments). | Method & path | Summary | Access | MCP tool | |---|---|---|---| | `POST /v1/dev/mock-checkout/{order_id}/complete` | Simulate payment of a mock checkout | Account required | — | ## Example ```bash # Check a domain curl -s https://api.getverifiedinbox.com/v1/checks/domain \ -H 'Content-Type: application/json' \ -d '{"domain":"acme.com"}' # Start an application (save the guest_token from the response) curl -s https://api.getverifiedinbox.com/v1/applications \ -H 'Content-Type: application/json' \ -H 'Idempotency-Key: start-acme-1' \ -d '{"domain":"acme.com"}' # Read it later curl -s https://api.getverifiedinbox.com/v1/applications/APPLICATION_ID \ -H 'VI-Guest-Token: vi_guest_…' ``` ## Rate limits Anonymous requests are limited per IP address and per guest token, and expensive work has daily budgets. When you hit a limit you get 429 with `Retry-After` (seconds). Poll background work gently. --- # OpenAPI schema > The complete, machine-readable VerifiedInbox API contract (OpenAPI 3.1), for code generators, API clients and AI agents. The whole VerifiedInbox REST API is described in one **OpenAPI 3.1** document. It is the only API contract: everything else follows it. - **[`https://getverifiedinbox.com/openapi.json`](https://getverifiedinbox.com/openapi.json)** - The API serves the same document at `https://api.getverifiedinbox.com/openapi.json`. Use it to generate a client (openapi-generator, openapi-typescript, oapi-codegen, …), import the API into Postman or Insomnia, or give it to an AI agent so it knows every operation and payload. Its description also contains the API guide: authentication, conventions, core concepts and test mode. ## Everything follows the schema The document is built from the same code that routes requests, so an endpoint can't exist without being in it. Everything else is generated from the document: - the endpoint tables in the [API reference](https://getverifiedinbox.com/docs/api.md) and [get-started.md](https://getverifiedinbox.com/get-started.md), - the [MCP tools](https://getverifiedinbox.com/docs/mcp.md): each tool's arguments (types, allowed values, which are required, descriptions) are taken from the API operations it wraps, - the TypeScript types our own web app uses. The build fails if any of these is out of date, and our end-to-end tests check real API responses against the schema. If the document says a field exists, the API returns it. ## VerifiedInbox extensions Each operation carries a few extra fields beyond standard OpenAPI: | Field | Meaning | |---|---| | `x-access` | Who may call it: `public`, `guest` (works anonymously with a guest token), `account` (signed in or API key), `paid`, `admin` or `webhook`. | | `x-required-scope` | The API key scope needed, e.g. `applications:write`. | | `x-idempotency` | `required`, `optional` or `none`: send an `Idempotency-Key` header so retries never charge or order twice. | | `x-mcp-tools` | The MCP tool(s) that do the same thing, so agents can switch between REST and MCP freely. | | `x-mcp-note` | Why an operation has no MCP tool (for example, file downloads). | Errors use one shape everywhere (`Error` in the schema): a stable `code`, a plain-English `message` and, when there is something to do, a `next_action` such as signing in or paying. ## Authentication The document declares the schemes the API accepts: bearer tokens (API keys `vi_live_…` / `vi_test_…`, or an OAuth access token from an MCP client), the guest token header (`VI-Guest-Token`) for anonymous drafts, and the browser cookies the web app uses. Each operation's `security` lists which ones work for it. See [API reference → Authentication](https://getverifiedinbox.com/docs/api.md#authentication). ## Versioning Paths start with `/v1`. Within v1 we only add things (new operations, new optional fields, new enum values), so generated clients should tolerate unknown enum values. Breaking changes would ship as `/v2`. --- # MCP server > Let Claude, ChatGPT, Cursor and other AI assistants check your domain and move your verification forward, step by step. [MCP](https://getverifiedinbox.com/docs/glossary.md#mcp) (Model Context Protocol) is how AI assistants use tools. Our MCP server gives your assistant every VerifiedInbox capability, from the first free check to certificate renewals. The easiest way to start: paste this into your assistant. > Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md The [get-started guide](https://getverifiedinbox.com/get-started.md) tells your assistant everything else. ## Endpoint - **URL:** `https://api.getverifiedinbox.com/mcp` - **Transport:** Streamable HTTP, JSON responses. Protocol versions `2025-11-25`, `2025-06-18`, `2025-03-26`. - Every tool wraps one or more [API](https://getverifiedinbox.com/docs/api.md) operations, and its arguments are generated from the [OpenAPI schema](https://getverifiedinbox.com/docs/openapi.md), so they always match the API. ## Connecting | Mode | How | Can do | |---|---|---| | Anonymous | Connect with no credentials | All free tools. `start_application` returns a `guest_token` to pass to later calls. | | OAuth | Clients that support MCP sign-in open a sign-in window when an account tool is first used | Everything your role allows | | API key | `Authorization: Bearer vi_live_…` or `vi_test_…` ([API keys](https://getverifiedinbox.com/docs/accounts.md#api-keys)) | One organization and environment | ### Claude claude.ai and Claude Desktop: **Settings → Connectors → Add custom connector**, URL `https://api.getverifiedinbox.com/mcp`. Claude Code: ```bash claude mcp add --transport http verifiedinbox https://api.getverifiedinbox.com/mcp ``` ### Cursor `~/.cursor/mcp.json` (or `.cursor/mcp.json` in a project): ```json { "mcpServers": { "verifiedinbox": { "url": "https://api.getverifiedinbox.com/mcp" } } } ``` With an API key, add `"headers": { "Authorization": "Bearer vi_test_…" }`. ### ChatGPT Add a custom connector with the URL `https://api.getverifiedinbox.com/mcp` (Settings → Apps & Connectors; some plans require developer mode). More clients and details: [get-started.md](https://getverifiedinbox.com/get-started.md#connect-to-the-mcp-server). ## Your progress never resets - Everything is saved on our servers under a stable `application_id`. - Without an account, your assistant keeps the `guest_token` (valid 30 days from last use). In a new conversation it calls `list_applications` or `get_application` and continues. - `create_resume_link` gives you a one-time link (24 hours) to continue in your browser. - After you sign in, `claim_application` moves the draft into your account. - Every response includes `next_actions`, so your assistant always knows what's next. ## Tools Each tool does the same thing as one or more [API](https://getverifiedinbox.com/docs/api.md) operations. The table is generated from the [OpenAPI schema](https://getverifiedinbox.com/docs/openapi.md) and the server's tool list, so it always matches what your assistant sees. Free tools accept `guest_token` (to continue an anonymous draft); account tools accept `environment` (`live` or `test`). | Tool | What it does | Arguments | Access | API operations | |---|---|---|---|---| | `get_started` | Explains the whole process (free checks, paid setup, certificate, go-live), pricing, what the user must do themselves, and how to continue later. Call this first if you're new to VerifiedInbox. | — | Free | `GET /v1/meta` | | `check_domain` | Free, instant check of an email domain: can it get a verified logo? Detects shared providers that can't be used (gmail.com, outlook.com…), unregistered domains, the mailbox provider and a DMARC/BIMI summary. Accepts a domain, URL or email address. | `domain`* | Free | `POST /v1/checks/domain` | | `check_email_security` | Free full inspection of SPF, DKIM, DMARC and BIMI with plain-English findings and exact fixes. Uses the domain's authoritative nameservers (sees changes within seconds). | `domain`*, `dkim_selectors` | Free | `POST /v1/checks/email-auth` | | `start_application` | Starts the verification for a domain, or returns the existing one. Anonymous callers receive a guest_token — tell the user to keep it (with the application_id) to continue in a later conversation. Background checks start immediately. Returns the full state and next_actions. | `domain`*, `environment`, `guest_token` | Free | `POST /v1/applications` | | `list_applications` | Lists the verifications visible to the caller (guest drafts for a guest_token, or the account's domains). | `environment`, `guest_token` | Free | `GET /v1/applications` | | `get_application` | Full current state: separate outcomes (eligibility, payment, business, ownership, logo, trademark, certificate, BIMI, inbox display), the 11 wizard steps with status, running background work, and next_actions (what to do next and which tool to use). Call this whenever you need to know where things stand. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}`
`GET /v1/applications/{application_id}/next-steps` | | `complete_step` | Moves the verification to the next step once the current step's required items are met (each step lists them in `requirements`; status `ready` means it can be completed). Background work never completes steps; this does, on the user's behalf. Also re-confirms an earlier step marked `attention` after it was fixed. Confirm with the user before completing a step they haven't reviewed. | `application_id`*, `step`*, `guest_token` | Free | `POST /v1/applications/{application_id}/steps/{step}/complete` | | `set_email_usage` | Ask the user how email is used on their domain and record the answer: none (new domain, no email yet), low (little email) or active (email sent every day). none/low can switch on full protection (block all) right away; active should follow the staged rollout, though the user may skip ahead. Returns the email security report with the recommended DMARC record. | `application_id`*, `email_usage`*, `guest_token` | Free | `PUT /v1/applications/{application_id}/email-usage` | | `recheck_email_security` | Re-checks SPF, DKIM and DMARC for the application right now (after the user published records) and returns the report plus the DMARC rollout plan: every stage's exact record, what to monitor and what happens to email at that stage. | `application_id`*, `guest_token` | Free | `POST /v1/applications/{application_id}/email-health/check` | | `submit_logo` | Provide the company logo: SVG text (preferred), a URL to an SVG, or use_discovered=true to use the logo found on the company website. The original is kept untouched; an inbox-ready SVG Tiny P/S version is produced automatically and a US trademark search starts. | `application_id`*, `guest_token`, `svg`, `url`, `use_discovered` | Free | `PUT /v1/applications/{application_id}/logo` | | `get_logo_status` | Logo processing status, compliance issues, the list of changes made for the inbox version (lossy ones flagged), visual difference, and preview URLs. Also lists logos discovered on the website. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}/logo`
`GET /v1/applications/{application_id}/logo-candidates` | | `search_trademark` | Starts (or re-runs) the USPTO trademark search, or verifies a specific US serial/registration number the user provides. A registered trademark matching the logo unlocks the blue checkmark (VMC). Rate-limited for anonymous users. | `application_id`*, `guest_token`, `mark_text`, `owner_name`, `serial_or_registration_number` | Free | `POST /v1/applications/{application_id}/trademark/search`
`POST /v1/applications/{application_id}/trademark/claim` | | `get_trademark_status` | Trademark search result: matched registration (with similarity to the logo), candidates, and what it means. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}/trademark` | | `get_eligibility` | Outcome: vmc_eligible (logo + blue checkmark), cmc_eligible (logo only, no checkmark), not_currently_eligible (with evidence, estimated date and next steps such as the trademark filing service at trademark@getverifiedinbox.com), or assessing. | `application_id`*, `guest_token` | Free | `GET /v1/applications/{application_id}/eligibility` | | `get_estimate` | Itemized yearly price before payment: plan (CMC $899 or VMC $1,499 per domain) plus the certificate issuer's fee (pass-through, no markup, ~$750–$1,750). Full refund if issuance is rejected. | `application_id`*, `guest_token`, `product` | Free | `GET /v1/applications/{application_id}/estimate` | | `watch_eligibility` | Emails the user when the domain becomes eligible (we re-check daily). Use for not_currently_eligible outcomes. | `application_id`*, `email`*, `guest_token` | Free | `POST /v1/applications/{application_id}/eligibility/watch` | | `create_resume_link` | Creates a one-time link (valid 24h) that opens this verification in the web app — useful for visual steps like reviewing the logo or copying DNS records. Optionally emails it. | `application_id`*, `email`, `guest_token` | Free | `POST /v1/applications/{application_id}/resume-links` | | `explain_term` | Plain-English explanation of a term such as BIMI, VMC, CMC, DMARC, SPF, DKIM, selector, alignment, SVG Tiny P/S. | `term`* | Free | `GET /v1/glossary/{term}` | | `contact_support` | Sends a message to the VerifiedInbox team (a human replies by email within one business day). Include the user's email. | `message`*, `application_id`, `email`, `guest_token`, `kind`, `name` | Free | `POST /v1/support` | | `send_feedback` | Sends feedback or a feature request to the VerifiedInbox team. | `message`*, `email`, `guest_token`, `kind` | Free | `POST /v1/support` | | `get_account` | Organizations, environment (live/test), every domain with its status and pending actions, and recent orders. | `environment` | Account | `GET /v1/me`
`GET /v1/applications`
`GET /v1/orders` | | `claim_application` | Atomically moves a guest draft (application_id + guest_token) into the signed-in account. If the account already has the domain, keeps the more advanced one and reports which. | `application_id`*, `guest_token`*, `environment` | Account (`applications:write`) | `POST /v1/applications/{application_id}/claim` | | `create_checkout` | Creates a Stripe checkout link for the chosen plan. Only a human can pay: give the link to the user, and confirm the price first (see get_estimate). | `application_id`*, `product`*, `environment`, `idempotency_key` | Account (`billing:write`) | `POST /v1/applications/{application_id}/checkout` | | `submit_business_details` | Legal company details + the applicant (starts business registration verification). Requires payment. jurisdiction is the US state code like us_de. | `address`*, `applicant`*, `application_id`*, `jurisdiction`*, `legal_name`*, `authority_attested`, `environment`, `registration_number` | Account (`applications:write`) | `PUT /v1/applications/{application_id}/business` | | `get_business_status` | Business verification status, matched registry record and applicant authority. | `application_id`*, `environment` | Account | `GET /v1/applications/{application_id}/business` | | `approve_logo` | Approves the exact inbox-ready logo the user reviewed (pass converted_sha256 from get_logo_status). Ask the user to look at the preview first (create_resume_link helps). | `application_id`*, `converted_sha256`*, `environment` | Account (`applications:write`) | `POST /v1/applications/{application_id}/logo/approve` | | `get_dns_records` | Every DNS record the user must add (ownership TXT, DMARC at the right rollout stage, BIMI) with copy-paste values and live status from the authoritative nameservers. The user adds them at their DNS provider. | `application_id`*, `environment` | Account | `GET /v1/applications/{application_id}/dns` | | `verify_dns` | Re-checks the DNS records right now (and watches closely for the next minutes). | `application_id`*, `environment` | Account | `POST /v1/applications/{application_id}/dns/verify` | | `verify_dkim_selectors` | Checks DKIM selectors the user provides. Needed only when the common selectors we try automatically found no key; the user's email provider shows the selector in its DKIM settings. | `application_id`*, `selectors`*, `guest_token` | Free | `POST /v1/applications/{application_id}/dkim-selectors` | | `create_test_message` | Returns an address the user sends a real email to; we then report SPF/DKIM/DMARC alignment on that actual message. | `application_id`*, `environment` | Account | `POST /v1/applications/{application_id}/test-messages` | | `get_test_message_result` | Result of the test email: SPF, DKIM, DMARC alignment and findings. | `application_id`*, `test_message_id`*, `environment` | Account | `GET /v1/applications/{application_id}/test-messages/{test_message_id}` | | `get_certificate` | Certificate status timeline, prerequisites (with the step that fixes each), the latest final check, actions the issuer needs from the user, validity and renewal dates. | `application_id`*, `environment` | Account | `GET /v1/applications/{application_id}/certificate` | | `run_final_check` | Re-verifies live everything the certificate issuer checks (domain, email protection, logo, company, trademark, DNS records). Runs automatically before the order is submitted and daily during the issuer's review; anything that fails marks its step `attention` and holds the order. | `application_id`*, `environment` | Account | `POST /v1/applications/{application_id}/certificate/check` | | `order_certificate` | Submits the certificate order (normally automatic once prerequisites are met). Safe to call repeatedly. | `application_id`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/order` | | `reissue_certificate` | Requests a reissue (e.g. after a logo change). Re-checks domain ownership first. | `application_id`*, `reason`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/reissue` | | `renew_certificate` | Starts the renewal early (renewal is otherwise automatic 45 days before expiry). | `application_id`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/renew` | | `revoke_certificate` | PERMANENTLY revokes the certificate; the logo disappears from inboxes. Only with explicit user confirmation: confirm must be exactly "REVOKE ". | `application_id`*, `confirm`*, `reason`*, `environment`, `idempotency_key` | Account (`certificates:write`) | `POST /v1/applications/{application_id}/certificate/revoke` | | `confirm_inbox_display` | Records that the user saw their logo (and checkmark for VMC) in a mailbox such as Gmail — the final 'display observed' outcome. | `application_id`*, `environment`, `mailbox`, `observed` | Account (`applications:write`) | `POST /v1/applications/{application_id}/inbox-display` | | `list_orders` | Orders and payments for the account. | `environment` | Account | `GET /v1/orders`
`GET /v1/orders/{order_id}` | \* required. ## Resources and prompts - `verifiedinbox://get-started` — the full get-started guide. - `verifiedinbox://glossary` — the glossary. - Prompt `verify_my_domain(domain)` — starts the guided flow. ## Errors Tool failures return `isError: true` with a plain-English message and `next_actions` (for example: sign in, pay, add a DNS record). Rate limits include `retry_after_seconds`. ## What your assistant won't do By design, assistants can't pay, can't change your DNS, and need your explicit confirmation to revoke a certificate. You approve your logo yourself. See [Security](https://getverifiedinbox.com/docs/security.md). --- # Glossary > Every term we use, explained in plain English, with the technical detail for those who want it. You'll find a small book icon next to technical terms across VerifiedInbox. Click it to open the definition in a side panel without leaving the page. Here are all the terms in one place. ### Blue checkmark **The verified badge Gmail shows next to a sender's name.** When a company proves who it is, Gmail shows its logo and a small blue checkmark next to its name. It tells readers the email really comes from that company. *Technical:* Gmail displays the checkmark when a message passes DMARC at enforcement and the sender publishes a BIMI record backed by a Verified Mark Certificate (VMC). *Related:* [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi), [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc) ### BIMI **The standard that lets inboxes show your logo.** BIMI stands for Brand Indicators for Message Identification. It is a small public setting on your domain that tells inboxes where to find your official logo. *Technical:* A TXT record at default._bimi. (v=BIMI1; l=; a=). Requires DMARC at p=quarantine or p=reject. *Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc), [SVG Tiny P/S](https://getverifiedinbox.com/docs/glossary.md#svg-tiny-ps) ### VMC (Verified Mark Certificate) **The certificate that unlocks your logo and the blue checkmark.** A digital certificate that proves your logo is a registered trademark owned by your company. With it, Gmail shows your logo and the blue checkmark. *Technical:* An X.509 certificate with the BIMI extended key usage and the logo embedded (RFC 3709 logotype). Requires a registered trademark. Valid for about 398 days. *Related:* [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc), [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark), [Certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer) ### CMC (Common Mark Certificate) **A certificate for your logo without the checkmark.** A digital certificate for companies whose logo is not a registered trademark yet. Gmail shows your logo, but not the blue checkmark. You need to show the logo has been in public use for at least 12 months. *Technical:* A mark certificate validated on prior use (≥ 12 months, e.g. archived web captures) instead of trademark registration. Same DNS/BIMI requirements as a VMC. *Related:* [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [Prior use (12 months)](https://getverifiedinbox.com/docs/glossary.md#prior-use) ### DMARC **Your domain's instructions for handling fake emails.** DMARC is a public setting that tells inboxes what to do with emails that pretend to come from your domain but don't. To show your logo, it must tell inboxes to block or quarantine fakes. *Technical:* A TXT record at _dmarc. (v=DMARC1; p=none|quarantine|reject; pct; rua; sp; adkim; aspf). BIMI requires p=quarantine or p=reject with pct=100. *Related:* [Safe DMARC rollout](https://getverifiedinbox.com/docs/glossary.md#dmarc-rollout), [SPF](https://getverifiedinbox.com/docs/glossary.md#spf), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim), [Alignment](https://getverifiedinbox.com/docs/glossary.md#alignment) ### Safe DMARC rollout **Tightening email protection in steps so real emails keep arriving.** If you send email every day, turning on strict protection too quickly can block your own newsletters or invoices. A safe rollout starts by only watching, then tightens over a few weeks once every service that sends email for you is set up. New domains and domains that send little email can switch on full protection straight away. *Technical:* p=none with rua reporting (suggested 14 days) → p=quarantine; pct=25 → p=quarantine (pct=100) → p=reject (recommended). Waiting times are suggestions; advance when aggregate reports show all legitimate sources pass SPF or DKIM with alignment. *Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [Alignment](https://getverifiedinbox.com/docs/glossary.md#alignment) ### SPF **The list of services allowed to send email for your domain.** SPF is a public list of the services (like Google Workspace or your newsletter tool) that are allowed to send email using your domain name. *Technical:* A TXT record beginning with v=spf1 at the domain apex. Limited to 10 DNS-querying mechanisms; only one SPF record is allowed. *Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim) ### DKIM **A digital signature that proves an email wasn't altered.** DKIM adds an invisible signature to every email you send. Inboxes check the signature to make sure the email really came from you and wasn't changed on the way. *Technical:* Public keys published as TXT (or CNAME) records at ._domainkey.. Messages carry a DKIM-Signature header with d= and s= tags. *Related:* [DKIM selector](https://getverifiedinbox.com/docs/glossary.md#dkim-selector), [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [Alignment](https://getverifiedinbox.com/docs/glossary.md#alignment) ### DKIM selector **The name of a specific DKIM signature key.** Each service that sends email for you uses its own signature key, and each key has a short name called a selector (for example “google” or “selector1”). We can't list them automatically, so you may need to tell us yours. *Technical:* The s= tag of the DKIM-Signature header; the key lives at ._domainkey.. Selectors cannot be enumerated via DNS. *Related:* [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim) ### Alignment **Making sure the 'from' domain matches the domain that passed the checks.** It's not enough for an email to pass a check — it has to pass it for the same domain your readers see in the 'From' line. That match is called alignment. *Technical:* DMARC passes when SPF (MAIL FROM / Return-Path) or DKIM (d=) passes and the authenticated domain aligns with the RFC5322.From domain (relaxed: same organizational domain; strict: exact match). *Related:* [DMARC](https://getverifiedinbox.com/docs/glossary.md#dmarc), [SPF](https://getverifiedinbox.com/docs/glossary.md#spf), [DKIM](https://getverifiedinbox.com/docs/glossary.md#dkim) ### DNS **The internet's public address book for your domain.** DNS is where your domain's public settings live — where your website is, which service handles your email, and the settings needed for your logo. You change them at your domain provider (like Cloudflare or GoDaddy). *Technical:* The Domain Name System. Records are served by your domain's authoritative nameservers and cached by resolvers for their TTL. *Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record), [Authoritative nameserver](https://getverifiedinbox.com/docs/glossary.md#authoritative-dns) ### DNS record **One setting in your domain's public address book.** A single entry in your domain settings. We'll tell you exactly what to copy and paste, and where. *Technical:* A resource record with a name (host), type (TXT, CNAME, MX, …), value and TTL. *Related:* [DNS](https://getverifiedinbox.com/docs/glossary.md#dns), [TXT record](https://getverifiedinbox.com/docs/glossary.md#txt-record) ### TXT record **A DNS record that holds a line of text.** A type of domain setting that simply holds text. Email security settings use this type. *Technical:* A DNS record of type TXT. Values longer than 255 characters are split into multiple strings that are concatenated. *Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record) ### MX record **Tells the internet which service receives your email.** This setting points to the service that receives email for your domain, such as Google Workspace or Microsoft 365. *Technical:* Mail exchanger records listing the hosts (with preference) that accept SMTP for the domain. *Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record), [Mailbox provider](https://getverifiedinbox.com/docs/glossary.md#mailbox-provider) ### Mailbox provider **The service that hosts your company's email.** The company that runs your email, for example Google Workspace, Microsoft 365 or Zoho. *Related:* [MX record](https://getverifiedinbox.com/docs/glossary.md#mx-record) ### Authoritative nameserver **The original source of your domain's settings.** The server that holds the original copy of your domain settings. We check it directly, so we see your changes within seconds instead of waiting for copies around the internet to refresh. *Technical:* The nameservers listed in the NS records of your zone. We query them directly with recursion disabled and no caching, falling back to DNS-over-HTTPS. *Related:* [DNS](https://getverifiedinbox.com/docs/glossary.md#dns), [TTL](https://getverifiedinbox.com/docs/glossary.md#ttl) ### TTL **How long other servers remember a domain setting.** Short for “time to live”. It's how long copies of your domain settings are kept around the internet before they refresh. *Technical:* Time-to-live in seconds on a DNS record; caching resolvers keep answers up to this long. *Related:* [Authoritative nameserver](https://getverifiedinbox.com/docs/glossary.md#authoritative-dns) ### Domain **Your company's internet name, like yourcompany.com.** The name after the @ in your email address. To show your logo, you need your own domain — shared ones like gmail.com belong to someone else. *Related:* [Subdomain](https://getverifiedinbox.com/docs/glossary.md#subdomain), [Organizational domain](https://getverifiedinbox.com/docs/glossary.md#organizational-domain) ### Subdomain **A name under your domain, like news.yourcompany.com.** A name that lives under your main domain. Some companies send newsletters from a subdomain. *Related:* [Domain](https://getverifiedinbox.com/docs/glossary.md#domain), [Organizational domain](https://getverifiedinbox.com/docs/glossary.md#organizational-domain) ### Organizational domain **Your main registered domain.** Your main domain — the one you registered, without any prefixes. Settings here also protect your subdomains. *Technical:* The registrable domain (public suffix + one label). DMARC and BIMI fall back to it for subdomains. *Related:* [Domain](https://getverifiedinbox.com/docs/glossary.md#domain), [Subdomain](https://getverifiedinbox.com/docs/glossary.md#subdomain) ### SVG Tiny P/S **The special logo file format inboxes require.** Inboxes need your logo in a very specific, simplified format. We convert your logo automatically, keep your original file untouched, and show you a side-by-side preview to approve. *Technical:* SVG Tiny 1.2 Portable/Secure profile: version="1.2" baseProfile="tiny-ps", a , square viewBox, no scripts, external references, raster images or animation; ≤ 32 KB recommended. *Related:* [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi), [Logo & certificate hosting](https://getverifiedinbox.com/docs/glossary.md#logo-hosting) ### Registered trademark **Legal registration of your logo with a trademark office.** An official registration that says your logo belongs to your company. A blue checkmark (VMC) requires one. We check the US Trademark Office (USPTO) for you. *Technical:* A design mark (or design-plus-words mark) registered with an accepted intellectual property office; the first release supports USPTO only. *Related:* [USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto), [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [Trademark filing service](https://getverifiedinbox.com/docs/glossary.md#trademark-service) ### USPTO **The United States Patent and Trademark Office.** The US government office that registers trademarks. We look up your logo there. *Related:* [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark) ### Trademark filing service **Help registering your logo as a trademark.** If your logo isn't registered yet, we can help you file it. Email trademark@getverifiedinbox.com. Registration usually takes several months; meanwhile you may qualify for a CMC. *Related:* [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc) ### Prior use (12 months) **Proof your logo has been public for at least a year.** For a CMC, you need to show your logo has been used publicly for at least 12 months — for example on your website. We check public web archives to help. *Technical:* Evidence such as Internet Archive (Wayback Machine) captures showing the mark on the domain ≥ 12 months ago. *Related:* [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc) ### Certificate issuer **The trusted company that checks your details and issues the certificate.** An independent, trusted company (we work with DigiCert) that double-checks your business and logo before issuing your certificate. Their fee is shown separately. *Technical:* A certificate authority accredited for mark certificates under the AuthIndicators Working Group requirements. *Related:* [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc), [Issuer fee](https://getverifiedinbox.com/docs/glossary.md#issuer-fee) ### Issuer fee **The certificate issuer's own yearly charge.** The issuer charges its own yearly fee for checking your business and issuing the certificate. We collect it at checkout without markup and show it as a separate line. If issuance is rejected, you get a refund. *Related:* [Certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer) ### Business verification **Confirming your company is real and registered.** We confirm that your company is officially registered and that you're allowed to act for it. The certificate issuer does a final check too. *Technical:* Legal entity lookup against an official/aggregated company registry (first release: OpenCorporates), followed by the issuer's organization and verified-contact validation. *Related:* [Certificate issuer](https://getverifiedinbox.com/docs/glossary.md#certificate-issuer) ### Domain ownership check **Proving you control the domain.** You add one small setting we give you to your domain. It proves you control it, so nobody else can order a certificate for it. *Technical:* A TXT record at _verifiedinbox. containing verifiedinbox-verification=. *Related:* [DNS record](https://getverifiedinbox.com/docs/glossary.md#dns-record) ### Logo & certificate hosting **We keep your logo and certificate online for inboxes to fetch.** Inboxes download your logo and certificate from the internet. We host both on fast, secure servers, so you never have to manage files. *Technical:* Served over HTTPS from https://bimi.getverifiedinbox.com with correct content types; referenced by the l= and a= tags of your BIMI record. *Related:* [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi) ### Renewal **Certificates last about a year; we renew them for you.** Certificates expire after about 13 months. We track the date, remind you well ahead, and renew automatically so your logo never disappears. *Technical:* Mark certificates are valid for at most 398 days. Renewal orders start 45 days before expiry; reminders at 60/30/14/7/1 days. *Related:* [VMC (Verified Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#vmc), [CMC (Common Mark Certificate)](https://getverifiedinbox.com/docs/glossary.md#cmc) ### Reissue **Getting a new copy of your certificate, e.g. after a logo change.** If you update your logo or something changes, we can request a fresh copy of the certificate within the same paid year. *Related:* [Renewal](https://getverifiedinbox.com/docs/glossary.md#renewal), [Revocation](https://getverifiedinbox.com/docs/glossary.md#revocation) ### Revocation **Permanently cancelling a certificate.** Cancels the certificate for good. Your logo will stop showing in inboxes. Only do this if something is wrong. *Related:* [Reissue](https://getverifiedinbox.com/docs/glossary.md#reissue) ### PEM file **The file format of your certificate.** A standard text file that contains your certificate. We host it for you. *Technical:* Base64 DER certificates between -----BEGIN CERTIFICATE----- markers; the BIMI a= tag points to the full chain. *Related:* [Logo & certificate hosting](https://getverifiedinbox.com/docs/glossary.md#logo-hosting) ### Test mode (sandbox) **A safe practice area where nothing is charged or issued.** Test mode lets you try every step without paying or ordering a real certificate. Switch it on from your dashboard; everything you do there is kept separate. *Technical:* Environment `test`: Stripe test mode, simulated issuer, separate data and vi_test_ API keys. *Related:* [API key](https://getverifiedinbox.com/docs/glossary.md#api-key) ### API key **A password for software to use your account.** A secret key that lets your tools or AI assistant work with your account. Keep it private. *Technical:* Bearer token (vi_live_… or vi_test_…), scoped to one organization and environment. *Related:* [MCP](https://getverifiedinbox.com/docs/glossary.md#mcp), [Test mode (sandbox)](https://getverifiedinbox.com/docs/glossary.md#sandbox) ### MCP **A way for AI assistants to use VerifiedInbox for you.** MCP (Model Context Protocol) lets AI assistants like Claude, ChatGPT or Cursor check your domain and move your verification forward, step by step. *Technical:* Streamable HTTP MCP server at https://api.getverifiedinbox.com/mcp with OAuth (WorkOS) or API-key auth; anonymous tools use a guest token. *Related:* [API key](https://getverifiedinbox.com/docs/glossary.md#api-key) ### Looks identical **How we confirm the inbox-ready logo looks the same as your original.** We draw your original file and the inbox-ready copy at the same size on a white background and compare them pixel by pixel. If less than half a percent of the logo changed visibly, they look identical. Up to 3% counts as small differences; more than that is flagged so you can check carefully. *Technical:* Both SVGs are rendered at 256×256 px on white. A pixel counts as changed when any colour channel differs by more than 32/255. score = changed pixels ÷ logo area; identical < 0.005, minor < 0.03, otherwise significant. *Related:* [SVG Tiny P/S](https://getverifiedinbox.com/docs/glossary.md#svg-tiny-ps) ### Matches your logo **How we decide a registered trademark shows your logo.** For each registered mark we find, we download its image from the US trademark office and compare it with your logo. An AI image check does the comparison, with a visual fingerprint as a backup. A score of 80% or more counts as a match; lower scores are shown as similar so you or our team can confirm. *Technical:* The mark image is compared with a 256 px rendering of your logo by a vision model, or by perceptual-hash similarity when the model isn't available. similarity ≥ 0.80 → match_found; 0.60–0.80 → similar. *Related:* [Registered trademark](https://getverifiedinbox.com/docs/glossary.md#trademark), [USPTO](https://getverifiedinbox.com/docs/glossary.md#uspto) --- # Frequently asked questions > Short answers to the questions we hear most. ## The basics ### What does VerifiedInbox do? We get your company's logo shown next to your emails in Gmail and other inboxes that support [BIMI](https://getverifiedinbox.com/docs/glossary.md#bimi), and, with a registered trademark, Gmail's blue checkmark. We handle the checks, the logo file, the certificate, the setup, hosting, monitoring and renewals. ### Do I need to be technical? No. Every step is explained in plain English, and the settings you add to your domain are copy-and-paste. You can share the DNS step with whoever manages your domain. ### Which inboxes show my logo? Gmail shows your logo, plus the blue checkmark with a [VMC](https://getverifiedinbox.com/docs/glossary.md#vmc). Other inboxes that support BIMI, including Apple Mail and Yahoo Mail, can show your logo too; each provider sets its own rules. ### Is the checkmark guaranteed? No one can guarantee it: Gmail decides what to show. We make sure everything on your side is correct and stays that way. ### Can I use my @gmail.com (or Outlook, iCloud…) address? No. Shared email domains belong to the provider, and the logo shown for them is the provider's. You need your own domain, like yourcompany.com. ## Eligibility and trademarks ### What do I need for the blue checkmark? Your own domain, a registered trademark for your logo (US Patent and Trademark Office in our first release) and email security settings at enforcement. See [VMC vs CMC](https://getverifiedinbox.com/docs/vmc-vs-cmc.md). ### My logo isn't trademarked. What can I do? If your logo has been public for at least 12 months, you can get the logo without the checkmark ([CMC](https://getverifiedinbox.com/docs/glossary.md#cmc)). You can also file a trademark through our service: email [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com). ### We're a new company with a new logo. You may not be eligible yet. We'll show you what's missing, tell you when you're likely to qualify and email you when you do. See [Eligibility](https://getverifiedinbox.com/docs/eligibility.md). ## Setup ### How long does it take? The free checks take about a minute. After payment, the certificate issuer's checks usually take from a few days to a few weeks. ### Will this break my email? Not if you follow our [safe DMARC rollout](https://getverifiedinbox.com/docs/dns-records.md#safe-dmarc-rollout). We tighten protection in steps, only when your real email is passing. ### Can you change our DNS for us? Not yet. You copy and paste a few records; we check them within seconds. We never ask for your DNS login. ### Do I have to upload files every year? No. We host your logo and certificate and swap in the renewed certificate automatically. ## Pricing and billing ### How much does it cost? Checks are free. The logo-only plan is $899 and the logo + checkmark plan is $1,499, per domain per year, plus the certificate issuer's fee (about $750–$1,750 per year), shown separately before you pay. See [Pricing](https://getverifiedinbox.com/pricing.md). ### What if I'm rejected? If the certificate issuer rejects your application, you get a full refund. ### Can I try it first? Yes. All checks are free and need no account. Signed-in users can use [test mode](https://getverifiedinbox.com/docs/test-mode.md) to go through every step without paying. ## AI assistants ### Can my AI assistant do this for me? Yes. Paste *"Add a verified VMC mark to my email domain using getverifiedinbox.com/get-started.md"* into Claude, ChatGPT or Cursor. It can run checks, prepare your logo and track progress. You step in to pay, add DNS records and approve your logo. See [MCP](https://getverifiedinbox.com/docs/mcp.md). ### Is it safe to let an assistant do this? Assistants can't pay, can't change your DNS and need your confirmation for anything irreversible. See [Security](https://getverifiedinbox.com/docs/security.md). --- # Support > Everything can be done self-service; humans are here if you want one. ## Talk to a human Use the [contact form](https://getverifiedinbox.com/support?kind=contact_human) or email [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com). A person replies by email, usually within one business day. Include your domain, and your application id if you have one (it's in the wizard's address bar: `/verify//…`). ## Get help with a step [Ask for help](https://getverifiedinbox.com/support?kind=support) and tell us which step you're on and what you see. Screenshots help. ## Feedback and feature requests We read everything: [send feedback](https://getverifiedinbox.com/support?kind=feedback) or [request a feature](https://getverifiedinbox.com/support?kind=feature_request). ## Partnerships Certificate issuers, registrars, email platforms and agencies: see [Partners](https://getverifiedinbox.com/partners.md) or [get in touch](https://getverifiedinbox.com/support?kind=partnership). ## Trademark filing Email [trademark@getverifiedinbox.com](mailto:trademark@getverifiedinbox.com). ## From your AI assistant Your assistant can contact us for you with the `contact_support` and `send_feedback` MCP tools. --- # Terms of Service > The agreement between your company and VerifiedInbox, in plain English. *Last updated: October 19, 2026* These terms are an agreement between VerifiedInbox ("we", "us") and the company or person using our website, API or MCP server ("you"). By using VerifiedInbox, you agree to them. If you use VerifiedInbox for a company, you confirm you're allowed to accept these terms for it. ## 1. What we do VerifiedInbox helps companies show their logo, and where eligible Gmail's blue verified checkmark, next to the emails they send. We check domains and email settings, prepare logo files, look up trademarks, verify businesses, order mark certificates from a certificate issuer, provide DNS settings, host logos and certificates, monitor the setup and renew certificates. The free checks are available without an account. Paid services require an account and an active plan. ## 2. Accounts - Keep your login and API keys secure. You're responsible for activity under your account and keys. - Give us accurate information and keep it up to date. - You can belong to several organizations; organization owners and admins control who has access to its domains, keys and billing. ## 3. Payments, renewals and refunds - Plans are priced **per domain, per year**, and renew automatically each year until cancelled. - The **certificate issuer's fee** is charged by the issuer and collected by us at checkout as a separate line, without markup. Issuer pricing can change; we show the estimated total before you pay, and before each renewal. - Payments are processed by Stripe. - **If the certificate issuer rejects your application, we refund the plan and the issuer fee in full.** - **Cancellation:** you can cancel anytime. Your plan won't renew, and your hosted logo, certificate and monitoring stay active until the end of the period you paid for. Except as stated above, payments are non-refundable. ## 4. Your responsibilities - **Authority.** You confirm you are authorized to act for the company and the domain you submit. - **Accurate information.** Business details, applicant details and evidence you provide must be true and complete. - **Rights to your logo.** You confirm you own the logo or have the right to use it, including any trademark you rely on for a Verified Mark Certificate. - **Your domain and DNS.** You make DNS changes yourself (or through your IT). We give instructions but don't change your DNS in this release. - **Your email.** You remain responsible for the email you send and for complying with the laws that apply to it. ## 5. The certificate issuer Certificates are issued by an independent certificate issuer (currently DigiCert), under the issuer's own terms, policies and validation requirements. The issuer decides whether to issue, may contact you directly, and may revoke a certificate under its policies. We prepare and submit your application and manage it on your behalf, but we don't control the issuer's decisions. ## 6. What we can't promise Mailbox providers such as Gmail decide when and where to show logos and checkmarks. We make sure your setup is correct and keep it that way, but **we can't guarantee that a logo or checkmark will be displayed** in any particular inbox. Trademark searches and eligibility results are informational and are not legal advice. ## 7. Acceptable use Don't use VerifiedInbox to impersonate another company, submit a logo or trademark you don't have rights to, send spam or phishing, probe or overload our systems, get around rate limits, or access data that isn't yours. We may suspend accounts that do. ## 8. AI agents acting for you You may let AI assistants use VerifiedInbox for you, through the MCP server, the API or API keys. Actions an agent takes with your credentials or authorization are treated as your actions. By design, agents can't pay or change DNS for you, and sensitive actions (such as revoking a certificate) require explicit confirmation. Only give agents the access they need, and revoke keys you no longer use. ## 9. Test mode Test mode is for trying the service. Nothing is charged, certificates there are simulated and not trusted by any inbox, and test data may be reset. ## 10. Changes and termination We may update the service and these terms. If a change materially affects you, we'll tell you in advance by email or in the app. You can stop using VerifiedInbox anytime. We may suspend or end access for breach of these terms; if we end a paid plan without cause, we'll refund the unused part. ## 11. Liability The service is provided "as is". To the extent the law allows, we aren't liable for indirect or consequential losses (such as lost profits or lost email), and our total liability is limited to the amount you paid us in the 12 months before the claim. ## 12. Governing law These terms are governed by the laws of the State of Delaware, USA. Disputes will be handled by the state or federal courts in Delaware. ## 13. Contact Questions about these terms: [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com). --- # Privacy Policy > What we collect, why we collect it, who helps us process it, and how long we keep it. *Last updated: October 19, 2026* VerifiedInbox is a business service. This policy explains what information we handle when your company uses our website, API or MCP server, and why. ## What we collect - **Account information** — your name, work email, organization, role and sign-in details. - **Domain information** — the domains you check and their public DNS records (SPF, DKIM, DMARC, BIMI, MX, nameservers), website information, and public web-archive history. - **Logos** — files you upload or that we find on your website, the converted versions, and their analysis. - **Business details** — legal company name, registration number, address, and the applicant's name, title, email and phone, plus trademark records we look up. - **Payment information** — handled by Stripe. We see the payment status and basic billing details, not your full card number. - **Messages** — support requests, feedback, and test emails you send to our test address (headers and authentication results). - **Usage information** — logs of requests to our website, API and MCP server (IP address, browser or client, actions taken), used for security, rate limiting and improving the service. ## Why we use it - To provide the service: run checks, prepare your application, order and manage certificates, host your logo and certificate, monitor your setup and send renewal reminders. - To verify your business and your authority, as the certificate issuer requires. - To process payments and refunds. - To answer support requests and keep you informed about your domains. - To secure the service, prevent abuse and improve the product. We don't sell your information. ## Sub-processors We use these service providers to run VerifiedInbox: | Provider | Purpose | |---|---| | Railway | Hosting of our application, database and files | | WorkOS | Sign-in and organization management | | Stripe | Payments and billing | | DigiCert | Certificate validation and issuance | | Resend | Sending email (notifications and reminders) | | Postmark | Receiving test emails | | Browserbase | Automated browsing for public trademark and business-registry lookups | | Anthropic | AI analysis, such as comparing your logo with trademark records | | OpenCorporates | Company registry lookups | Public information about your domain, logo and trademarks is also checked against public sources such as DNS, the US Patent and Trademark Office and the Internet Archive. ## Certificates are public Mark certificates are public by design: they include your company name, domain and logo, and the certificate issuer may publish them in public certificate logs. Your BIMI DNS record and hosted logo are publicly accessible so that inboxes can display them. ## Retention - Account, application, certificate and billing records: for as long as your account is active, and afterwards as needed for legal, tax and audit purposes. - Anonymous drafts (no account): deleted after the guest session expires, at most about 90 days. - Logs: kept for a limited period for security and troubleshooting. You can ask us to delete your account and data; we'll do so unless we must keep certain records by law. ## Security We protect information with encryption in transit, access controls, tenant isolation between organizations, and scoped API keys. No system is perfectly secure; tell us right away if you suspect a problem. ## Your choices You can view and update your account information in the dashboard, revoke API keys at any time, and contact us to access, correct, export or delete your information. ## Contact Privacy questions: [support@getverifiedinbox.com](mailto:support@getverifiedinbox.com).