BIMI on Subdomains: How Inheritance Works

Publishing a BIMI record for your organizational domain automatically extends brand indicator display to every subdomain you send from — with no additional DNS records required. Understanding the inheritance model, its limits, and the DMARC alignment dependency will help you deploy BIMI correctly across a complex sending infrastructure.

How BIMI Inheritance Works

BIMI inheritance follows the same lookup hierarchy used by DMARC. When a receiving mail server evaluates a message sent from marketing.example.com, it looks for a BIMI record in this order:

1. default._bimi.marketing.example.com — subdomain-specific record
2. default._bimi.example.com — organizational domain fallback

If no record exists at the subdomain level, the receiver falls back to the organizational domain record. This means a single BIMI TXT record published at default._bimi.example.com covers all subdomains automatically.

What "Organizational Domain" Means

The organizational domain is the registered domain — the part immediately under a public suffix. For mail.example.com and marketing.example.com, the organizational domain is example.com. BIMI inheritance always resolves upward to this level, never to an intermediate subdomain.

Publishing a Single BIMI Record for All Subdomains

If all your sending subdomains use the same logo, one DNS record is sufficient.

Steps:

1. Confirm your organizational domain has a valid DMARC policy (see DMARC alignment requirements below).
2. Prepare a square SVG logo that conforms to the SVG Tiny P/S profile.
3. Host the SVG at a stable, publicly accessible HTTPS URL.
4. Publish a single BIMI TXT record at your organizational domain:

   default._bimi.example.com  TXT  "v=BIMI1; l=https://brand.example.com/logo.svg; a=https://brand.example.com/cert.pem"
   

1. Verify that no conflicting BIMI records exist at subdomain level.

All subdomains — mail.example.com, marketing.example.com, transactional.example.com — now inherit this record automatically.

Overriding BIMI Per Subdomain

You can override the inherited record for any individual subdomain by publishing a separate BIMI TXT record directly at that subdomain's _bimi label.

When to override:

• A subdomain sends under a different brand or product logo.
• A subdomain requires a different Verified Mark Certificate (VMC).
• You want to suppress BIMI display for a specific subdomain (publish a null record).

Steps to override:

1. Identify the subdomain that requires a different logo or certificate.
2. Publish a subdomain-specific BIMI record:

   default._bimi.marketing.example.com  TXT  "v=BIMI1; l=https://brand.example.com/marketing-logo.svg; a=https://brand.example.com/marketing-cert.pem"
   

1. The subdomain-specific record takes full precedence over the organizational domain record for messages sent from that subdomain.

To suppress BIMI on a subdomain, publish a record with an empty l= value:

default._bimi.noreply.example.com  TXT  "v=BIMI1; l=;"

VMC Coverage Across Subdomains

A Verified Mark Certificate (VMC) authenticates your logo and is required by major mailbox providers — including Gmail and Apple Mail — to display the brand indicator with a verified checkmark.

One VMC Covers All Subdomains Using the Same Logo

A VMC is issued against a specific logo file (the SVG), not against a specific domain or subdomain. Provided the same SVG is referenced across all your BIMI records, a single VMC covers your organizational domain and every subdomain that inherits or explicitly references that logo.

You do not need one VMC per subdomain.

Multiple Logos Require Multiple VMCs

If different subdomains display different logos — for example, a parent brand logo on mail.example.com and a product brand logo on app.example.com — each distinct logo requires its own VMC.

| Scenario | VMCs Required | |---|---| | One logo, one or many subdomains | 1 VMC | | Two logos across two subdomains | 2 VMCs | | Three logos across ten subdomains | 3 VMCs |

The determining factor is always the number of unique logos, not the number of domains or subdomains.

DMARC Alignment Requirements for Subdomains

BIMI will not display unless the sending message passes DMARC authentication. For subdomain senders, the critical DMARC configuration is the sp= tag — the subdomain policy.

The sp= Tag

The sp= tag in your organizational domain's DMARC record defines the policy applied to messages from subdomains. BIMI requires a policy of quarantine or reject — a policy of none is insufficient.

Example DMARC record with subdomain policy:

_dmarc.example.com  TXT  "v=DMARC1; p=reject; sp=reject; rua=mailto:[email protected]"

Policy Inheritance Rules

| DMARC Record | Subdomain Policy Applied | |---|---| | p=reject; sp=reject | Subdomains inherit reject ✅ | | p=reject; sp=quarantine | Subdomains use quarantine ✅ | | p=reject; sp=none | Subdomains use none — BIMI will not display ❌ | | p=reject (no sp= tag) | Subdomains inherit p=reject ✅ | | p=none (no sp= tag) | Subdomains inherit none — BIMI will not display ❌ |

Important: If sp= is omitted, subdomains inherit the value of p=. Ensure p= is set to quarantine or reject before relying on inheritance.

Subdomain-Specific DMARC Records

You can also publish a DMARC record directly at a subdomain to override the inherited policy:

_dmarc.marketing.example.com  TXT  "v=DMARC1; p=reject; rua=mailto:[email protected]"

A subdomain-level DMARC record takes full precedence over the organizational domain record for that subdomain — the same inheritance and override logic that applies to BIMI records.

Common Subdomain BIMI Mistakes

| Mistake | Result | Fix | |---|---|---| | sp=none in DMARC | BIMI suppressed on all subdomains | Set sp=quarantine or sp=reject | | Publishing a VMC per subdomain unnecessarily | Unnecessary cost and complexity | One VMC per unique logo is sufficient | | Forgetting to override a subdomain with a different logo | Wrong logo displayed | Publish a subdomain-specific BIMI record | | Hosting the SVG over HTTP | Record ignored | Serve the SVG over HTTPS only | | Using a non-compliant SVG profile | Logo rejected by mailbox providers | Convert to SVG Tiny P/S |

Quick Reference: Subdomain BIMI Checklist

• [ ] DMARC p=