Technical Reference · 2026 Edition

BIMI with ESPs and Third-Party Senders: Alignment Requirements

Learn how BIMI works when ESPs like Mailchimp, HubSpot, Salesforce, and SendGrid send email on your behalf. Understand DMARC alignment, DKIM signing requirements, and how to verify your setup.

Last updated min read

BIMI with ESPs and Third-Party Senders: Alignment Requirements

When a third-party platform sends email on your behalf, your brand logo — and your BIMI record — depends entirely on how that platform handles email authentication. Most deliverability failures in BIMI deployments trace back to a single misunderstood detail: BIMI does not care about your SPF record when an ESP is sending your mail. It cares about DKIM alignment.

This article explains why, and what you must configure to make BIMI work reliably across every sending platform in your stack.

How BIMI Evaluates Sender Identity

BIMI is anchored to DMARC. Before a mailbox provider renders your logo, it checks that the message passes DMARC. DMARC, in turn, requires alignment — the domain in the RFC 5322 From header (the address your recipient sees) must align with the domain authenticated by either SPF or DKIM.

Authentication Method	Domain Evaluated for Alignment
SPF	RFC 5321 `MAIL FROM` (envelope sender / bounce domain)
DKIM	`d=` tag in the DKIM-Signature header
BIMI trigger	RFC 5322 `From:` header domain

The critical distinction: SPF aligns against the envelope sender. DKIM aligns against the d= tag.

Why SPF Alignment Fails with ESPs

When Mailchimp, HubSpot, SendGrid, or Salesforce Marketing Cloud sends a message on your behalf, the SMTP envelope sender (MAIL FROM) is set to a bounce-tracking domain controlled by the ESP — for example:

bounce.list-manage.com (Mailchimp)
bounce.hubspotemail.net (HubSpot)
em.sendgrid.net (SendGrid)
et.yourdomain.com or pub.s10.exacttarget.com (Salesforce Marketing Cloud)

SPF authenticates this envelope domain, not your From: header domain. Unless the ESP’s bounce domain matches your domain exactly, SPF alignment will fail.

This is expected behaviour. It is not a bug. It is how the protocol works.

Key point: A failed SPF alignment does not block BIMI — provided DKIM alignment passes. DMARC requires only one alignment mechanism to pass.

DKIM Alignment: The Only Reliable Path for ESP Senders

For BIMI to work when an ESP sends your mail, the ESP must sign outbound messages with a DKIM signature where the d= tag matches your From header domain.

What “matches” means

DMARC supports two alignment modes:

Relaxed alignment (default): The d= domain must share the same Organizational Domain as the From: header domain. For example, d=mail.yourdomain.com aligns with From: [email protected].
Strict alignment: The d= domain must be an exact match with the From: header domain.

Most DMARC policies use relaxed alignment. Confirm your policy’s adkim= tag — if absent, relaxed is assumed.

What a passing DKIM-aligned message looks like

text

From: [email protected]          ← RFC 5322 From
DKIM-Signature: v=1; a=rsa-sha256;
  d=yourdomain.com;                      ← matches From domain ✓
  s=esp-selector;
  ...

This message passes DMARC via DKIM alignment. BIMI can render.

What a failing configuration looks like

text

From: [email protected]          ← RFC 5322 From
DKIM-Signature: v=1; a=rsa-sha256;
  d=sendgrid.net;                        ← ESP's domain, not yours ✗
  ...

This message fails DMARC alignment. BIMI will not render, regardless of whether your BIMI DNS record is correctly published.

Configuring Custom DKIM Signing in Major ESPs

The following table summarises custom DKIM domain support across the most widely deployed ESPs. “Custom DKIM” means the ESP can sign with your domain in the d= tag, not their own.

ESP	Custom DKIM Domain Support	Configuration Path	Notes
Mailchimp	✅ Yes	Audience → Settings → Domains → Authenticate	Requires DNS CNAME records; Mailchimp manages keys
HubSpot	✅ Yes	Settings → Marketing → Email → Sending Domains	Adds DKIM TXT records to your DNS
Salesforce Marketing Cloud	✅ Yes	Admin → Domain Management → SAP / Private Domain	Requires Private Domain setup; SAP configuration recommended
SendGrid (Twilio)	✅ Yes	Settings → Sender Authentication → Domain Authentication	Publishes CNAME records; automated key rotation available
Klaviyo	✅ Yes	Account → Settings → Email → Sending Domains	CNAME-based; required for dedicated sending
ActiveCampaign	✅ Yes	Settings → Advanced → Email Domain Authentication	DKIM TXT record added to your DNS
Brevo (formerly Sendinblue)	✅ Yes	Senders & IP → Domains	DKIM and DMARC record guidance provided
Constant Contact	⚠️ Limited	Self-authenticate via DKIM in advanced settings	Custom domain DKIM available but setup is non-trivial
Campaign Monitor	✅ Yes	Account Settings → Authenticated Domains	DKIM and SPF alignment both supported
Postmark	✅ Yes	Sender Signatures → DKIM	Per-domain DKIM; strong deliverability focus
Amazon SES	✅ Yes	Configuration → Verified Identities → DKIM	Supports both Easy DKIM (AWS-managed) and BYODKIM

If your ESP is not listed or does not support custom DKIM domain signing, BIMI will not function for mail sent through that platform. Contact your ESP to request this capability or evaluate an alternative provider.

Step-by-Step: Verifying DKIM Alignment for BIMI

Follow these steps to confirm your ESP configuration supports BIMI before publishing your BIMI DNS record.

Send a test message from your ESP to a mailbox you control (Gmail, Yahoo, or a Microsoft 365 account).
Open the raw message headers. In Gmail: three-dot menu → Show original. In Outlook: File → Properties → Internet headers.
Locate the DKIM-Signature header. Find the d= tag value.
Compare the d= value to your From: header domain.
- If d=yourdomain.com and From: [email protected] → ✅ Aligned
- If d=esp-platform.com and From: [email protected] → ❌ Not aligned
Check the Authentication-Results header (

Third-party alignment is a deployment dependency, not a substitute for the full system. Read BIMI: how it works for the broader sequence.