Have you noticed that some senders in Gmail have a blue checkmark next to their name and logo when you open a message from them? Much like the verification badges you see on many social media platforms, these blue ticks mean that Google has verified the senderβs identity, which helps prevent spam, phishing scams, and email spoofing . Itβs also a great way to establish trust with recipients and customers. In this article, weβll tell you more about what these checkmarks mean and how to get one.
Things You Should Know
- Gmailβs blue checkmarks are mainly for businesses and organizations rather than individuals.
- These checks indicate that the email is from a verified sender.
- To get a checkmark, youβll need to set up BIMI (Brand Indicators for Message Identification) with your organizationβs domain provider.
Steps
Why do some senders have blue checks in Gmail?
-
The blue tick means the senderβs identity is verified. Google uses these blue ticks the same way a lot of social media platforms do: it means theyβve confirmed the identity of the organization or person that sent the message.
- The blue verified checkmark is a great way to prevent phishing, spoofing, and other scams where senders pretend to be someone else (like a bank or social media support account) to trick people into giving them sensitive information.
-
These checks are mostly for businesses rather than individuals. While some public figures or celebrities may be able to get blue checks, Google mostly uses them to identify organizations and companies. For example, emails from a major retailer, bank, hospital, or social media platform might feature a blue check next to the senderβs logo.
How to Get a Blue Checkmark in Gmail
-
Set up SPF, DKIM, and DMARC for your web domain. If you run a business or other organization and you want to get a blue verified checkmark from Google, there are several steps involved. First, youβll need to set up a few security features for your organizationβs web domain. To do this, youβll need to: [1] X Research source
- Get administrator login information for your domain provider. For example, if your businessβs domain is hosted by a company like Squarespace or IONOS, youβll need to sign in at their website to turn on these security features for your domain.
- Create an SPF (Sender Policy Framework) record for your domain. This will help recipients verify that emails sent from your specified domains and servers really come from your organization. For detailed instructions, check out this page from Google Support .
- Add an encrypted digital signature to your emails with DKIM. For detailed instructions, check out this guide from Google .
- Turn on DMARC to catch messages from spoofers pretending to be your organization. DMARC works with SPF and DKIM to help screen out messages that donβt pass those verification checks. Get the full breakdown from Google .
-
Upload a brand logo file for outgoing messages. This logo will appear on all outgoing messages from your organization in the place where youβd normally see a Gmail profile picture or sender initials. Youβll need to format the image as an SVG (Scalable Vector Graphic) and upload it to a public web server that shares the same domain as your outgoing email server. For full instructions on how to format and upload your SVG logo file correctly, see this document from Google .
- Make sure to read the instructions from Google carefully. Youβll need to use a text editor to add some special attributes to your SVG file so it meets Gmailβs requirements.
- Copy and save the URL for this file once you upload it to your domain.
-
Get a VMC to verify your logo ownership. Once youβve created your brand logo, youβll need to register it as a trademark and get a VMC (Verified Mark Certificate). After you secure the trademark, contact either Digicert or Entrust to request your VMC. [2] X Research source
- Whichever organization you use to get your VMC will send you a PEM (Privacy Enhanced Mail) file, which youβll need to use along with your logo to verify outgoing emails. Upload the PEM to your public server.
- You might also receive other certificate files, which youβll need to append to the PEM.
- Copy and save the URL for the PEM and any appended files once youβve uploaded it.
- For more detailed information, check out this guide from Google .
- Whichever organization you use to get your VMC will send you a PEM (Privacy Enhanced Mail) file, which youβll need to use along with your logo to verify outgoing emails. Upload the PEM to your public server.
-
Set up a BIMI TXT record with your domain provider. Setting up BIMI (Brand Indicators for Message Identification) is the last step in attaching your verified logo to your emails and getting a Google checkmark. Use the instructions and template here and plug in the URLs you saved for the SVG and PEM files on your server.
- It may take up to 48 hours for BIMI to start working. Once it does, emails from your organization should display both your logo and a blue checkmark.
- If your logo and blue checkmark still arenβt showing up after 48 hours, or if your organizationβs messages are getting marked as spam, try some of these troubleshooting steps .
Expert Q&A
-
QuestionHow to determine email scams?Naveh Ben Dror is a Social Media Security Expert and the CEO of Spikerz based in Tel Aviv, Israel. Naveh and his team provide social media protection for content creators, businesses, and enterprises. His professional background is in international brand marketing and e-commerce. Naveh received both his Bachelor of Law and MBA from Reichman University.To identify email scams, watch out for several telltale signs. Firstly, scrutinize the sender's email address carefully, as scammers often use addresses that mimic legitimate organizations but contain subtle variations or misspellings. Secondly, be wary of unsolicited emails requesting personal or financial information, especially if they claim urgency or threaten consequences for non-compliance. Thirdly, examine the email for grammatical errors, inconsistencies, or unusual formatting, as these can indicate a fraudulent message. Additionally, refrain from clicking on suspicious links or downloading attachments from unknown senders, as they may contain malware or lead to phishing websites. Finally, verify the legitimacy of the email by contacting the sender through official channels or by visiting their website directly. By remaining vigilant and exercising caution, you can protect yourself from falling victim to email scams.
Tips
Expert Interview

Thanks for reading our article! If youβd like to learn more about using social media, check out our in-depth interview with Naveh Ben Dror .