BIMI with ESPs and Third-Party Senders: Alignment Requirements

When a third-party platform sends email on your behalf, your brand logo — and your BIMI record — depends entirely on how that platform handles email authentication. Most deliverability failures in BIMI deployments trace back to a single misunderstood detail: BIMI does not care about your SPF record when an ESP is sending your mail. It cares about DKIM alignment.

This article explains why, and what you must configure to make BIMI work reliably across every sending platform in your stack.

How BIMI Evaluates Sender Identity

BIMI is anchored to DMARC. Before a mailbox provider renders your logo, it checks that the message passes DMARC. DMARC, in turn, requires alignment — the domain in the RFC 5322 From header (the address your recipient sees) must align with the domain authenticated by either SPF or DKIM.

| Authentication Method | Domain Evaluated for Alignment | |---|---| | SPF | RFC 5321 MAIL FROM (envelope sender / bounce domain) | | DKIM | d= tag in the DKIM-Signature header | | BIMI trigger | RFC 5322 From: header domain |

The critical distinction: SPF aligns against the envelope sender. DKIM aligns against the d= tag.

Why SPF Alignment Fails with ESPs

When Mailchimp, HubSpot, SendGrid, or Salesforce Marketing Cloud sends a message on your behalf, the SMTP envelope sender (MAIL FROM) is set to a bounce-tracking domain controlled by the ESP — for example:

• bounce.list-manage.com (Mailchimp)
• bounce.hubspotemail.net (HubSpot)
• em.sendgrid.net (SendGrid)
• et.yourdomain.com or pub.s10.exacttarget.com (Salesforce Marketing Cloud)

SPF authenticates this envelope domain, not your From: header domain. Unless the ESP's bounce domain matches your domain exactly, SPF alignment will fail.

This is expected behaviour. It is not a bug. It is how the protocol works.

Key point: A failed SPF alignment does not block BIMI — provided DKIM alignment passes. DMARC requires only one alignment mechanism to pass.

DKIM Alignment: The Only Reliable Path for ESP Senders

For BIMI to work when an ESP sends your mail, the ESP must sign outbound messages with a DKIM signature where the d= tag matches your From header domain.

What "matches" means

DMARC supports two alignment modes:

• Relaxed alignment (default): The d= domain must share the same Organizational Domain as the From: header domain. For example, d=mail.yourdomain.com aligns with From: [email protected].
• Strict alignment: The d= domain must be an exact match with the From: header domain.

Most DMARC policies use relaxed alignment. Confirm your policy's adkim= tag — if absent, relaxed is assumed.

What a passing DKIM-aligned message looks like

From: [email protected]          ← RFC 5322 From

DKIM-Signature: v=1; a=rsa-sha256;
d=yourdomain.com;                      ← matches From domain ✓
s=esp-selector;
...

This message passes DMARC via DKIM alignment. BIMI can render.

What a failing configuration looks like

From: [email protected]          ← RFC 5322 From

DKIM-Signature: v=1; a=rsa-sha256;
d=sendgrid.net;                        ← ESP's domain, not yours ✗
...

This message fails DMARC alignment. BIMI will not render, regardless of whether your BIMI DNS record is correctly published.

Configuring Custom DKIM Signing in Major ESPs

The following table summarises custom DKIM domain support across the most widely deployed ESPs. "Custom DKIM" means the ESP can sign with your domain in the d= tag, not their own.

| ESP | Custom DKIM Domain Support | Configuration Path | Notes | |---|---|---|---| | Mailchimp | ✅ Yes | Audience → Settings → Domains → Authenticate | Requires DNS CNAME records; Mailchimp manages keys | | HubSpot | ✅ Yes | Settings → Marketing → Email → Sending Domains | Adds DKIM TXT records to your DNS | | Salesforce Marketing Cloud | ✅ Yes | Admin → Domain Management → SAP / Private Domain | Requires Private Domain setup; SAP configuration recommended | | SendGrid (Twilio) | ✅ Yes | Settings → Sender Authentication → Domain Authentication | Publishes CNAME records; automated key rotation available | | Klaviyo | ✅ Yes | Account → Settings → Email → Sending Domains | CNAME-based; required for dedicated sending | | ActiveCampaign | ✅ Yes | Settings → Advanced → Email Domain Authentication | DKIM TXT record added to your DNS | | Brevo (formerly Sendinblue) | ✅ Yes | Senders & IP → Domains | DKIM and DMARC record guidance provided | | Constant Contact | ⚠️ Limited | Self-authenticate via DKIM in advanced settings | Custom domain DKIM available but setup is non-trivial | | Campaign Monitor | ✅ Yes | Account Settings → Authenticated Domains | DKIM and SPF alignment both supported | | Postmark | ✅ Yes | Sender Signatures → DKIM | Per-domain DKIM; strong deliverability focus | | Amazon SES | ✅ Yes | Configuration → Verified Identities → DKIM | Supports both Easy DKIM (AWS-managed) and BYODKIM |

If your ESP is not listed or does not support custom DKIM domain signing, BIMI will not function for mail sent through that platform. Contact your ESP to request this capability or evaluate an alternative provider.

Step-by-Step: Verifying DKIM Alignment for BIMI

Follow these steps to confirm your ESP configuration supports BIMI before publishing your BIMI DNS record.

1. Send a test message from your ESP to a mailbox you control (Gmail, Yahoo, or a Microsoft 365 account).

1. Open the raw message headers. In Gmail: three-dot menu → Show original. In Outlook: File → Properties → Internet headers.

1. Locate the DKIM-Signature header. Find the d= tag value.

1. Compare the d= value to your From: header domain.

- If d=esp-platform.com and From: [email protected] → ❌ Not aligned

1. Check the Authentication-Results header (