Technical Reference · 2026 Edition

bimi-records-multiple-domains

Last updated August 1, 2026 6 min read
yaml
---


title: "Managing BIMI Records Across Multiple Domains"
description: "Best practices for deploying BIMI records across enterprise infrastructure, including subdomains and multi-tenant architectures."
date: "2026-07-01"

Managing BIMI Records Across Multiple Domains

Enterprise email infrastructure rarely maps to a single domain. Brands operate sending domains, subdomain silos, regional TLDs, and multi-tenant platforms simultaneously. Each requires its own BIMI record strategy. Mismanagement means inconsistent logo display, failed certificate validation, and wasted authentication overhead.

This guide covers the DNS mechanics, certificate scoping, and tooling required to deploy BIMI records at scale.

What a BIMI Record Contains

A BIMI record is a DNS TXT record published at a specific selector subdomain. The standard format:

text
default._bimi.example.com IN TXT "v=BIMI1; l=https://cdn.example.com/logo.svg; a=https://cert.example.com/vmc.pem"

Two tags carry the functional payload:

  • l= — The URL pointing to a Tiny P/S SVG logo file
  • a= — The URL pointing to a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC)

The v=BIMI1 tag is mandatory. The selector prefix (default) can be customized per sending stream.

DNS Architecture for Multiple Domains

Primary Domain

Every sending domain needs its own BIMI record. There is no inheritance from a parent domain. example.com and mail.example.com are independent DNS namespaces from the perspective of BIMI lookup.

text
default._bimi.example.com        TXT "v=BIMI1; l=https://cdn.example.com/brand.svg; a=https://cdn.example.com/vmc.pem"


default._bimi.regional.example.com TXT "v=BIMI1; l=https://cdn.example.com/brand.svg; a=https://cdn.example.com/vmc.pem"
default._bimi.sends.example.com  TXT "v=BIMI1; l=https://cdn.example.com/brand.svg; a=https://cdn.example.com/vmc.pem"

The SVG and VMC assets can be shared across domains via a single CDN URL. The DNS records themselves cannot be shared.

Subdomain Senders

If a subdomain appears in the From: header, mail clients perform the BIMI lookup against that subdomain exclusively. Parent-domain fallback does not apply.

Audit every From address in your email platform. Each unique domain component requires its own default._bimi record.

Multi-Tenant Platforms

SaaS platforms sending on behalf of customer brands face a harder problem. Each customer domain must:

  1. Pass DMARC at the p=quarantine or p=reject enforcement level
  2. Publish its own BIMI record pointing to its own SVG and certificate
  3. Have its own VMC or CMC tied to that specific domain's trademark

Shared infrastructure does not simplify certificate scope. A VMC issued to platform.com does not authorize logo display for customer.com. Each tenant brand requires independent certificate procurement.

DMARC as a Hard Dependency

BIMI display is gated on DMARC alignment. Without a valid DMARC record at enforcement, no mail client will render the logo regardless of BIMI record presence.

Minimum viable DMARC configuration per sending domain:

text
_dmarc.example.com IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]; adkim=s; aspf=s"

Key enforcement requirements:

  • p=quarantine or p=reject — p=none disqualifies BIMI rendering
  • SPF and DKIM must both pass with alignment
  • Subdomain policy (sp=) must also meet enforcement if subdomains are sending

At scale, DMARC aggregate reporting becomes essential. Monitoring per-domain pass rates identifies authentication gaps before they surface as missing logos.

SVG Compliance Requirements

The SVG specification for BIMI is strict. Standard SVG files do not qualify. The required profile is SVG Tiny P/S (Portable/Secure), a constrained subset designed for secure rendering in mail clients.

Requirements include:

  • Fixed 1:1 aspect ratio with explicit viewBox
  • No external resource references
  • No raster images embedded via
  • No scripts, interactivity, or animation
  • Specific XML namespace declarations

Most design tools export standard SVG. Converting to the BIMI-compliant profile requires dedicated processing. makeBIMI.com converts standard SVG files to the correct Tiny P/S format at no cost. Upload once, download a deployment-ready file. The service handles the namespace corrections, attribute stripping, and structural constraints that manual conversion frequently misses.

For multi-domain deployments, a single converted SVG file can be hosted on a CDN and referenced by all BIMI records pointing to the same brand identity.

Certificate Requirements by Mail Client

Gmail

Gmail requires a VMC (Verified Mark Certificate) issued by an accredited certificate authority. VMCs are tied to registered trademark ownership. The certificate encodes the SVG logo as a data object and is validated against the trademark record.

Gmail performs both DMARC and VMC validation. A BIMI record with a missing or invalid a= tag renders no logo in Gmail.

Apple Mail

Apple Mail supports BIMI with CMC (Common Mark Certificate) in addition to VMC. CMC does not require trademark registration, making it accessible to brands that operate in jurisdictions with limited trademark infrastructure. Apple performs DMARC validation and checks certificate chain integrity.

Yahoo Mail

Yahoo Mail was an early BIMI adopter and supports VMC. Yahoo's implementation follows the AuthIndicators Working Group specification closely. DMARC enforcement at p=reject is strongly recommended for consistent Yahoo rendering.

For VMC procurement and certificate management across multiple domains, veriBIMI.com acts as a certificate broker, handling the trademark verification workflow and CA coordination for each domain in scope.

Selector Strategy

The default selector is used when no specific selector is designated by the sending infrastructure. Custom selectors allow per-stream logo differentiation.

text
newsletter._bimi.example.com TXT "v=BIMI1; l=https://cdn.example.com/newsletter-logo.svg; a=https://cdn.example.com/vmc.pem"


transactional._bimi.example.com TXT "v=BIMI1; l=https://cdn.example.com/brand-logo.svg; a=https://cdn.example.com/vmc.pem"

Custom selectors require the sending MTA to insert a BIMI-Selector header into outgoing messages:

text
BIMI-Selector: v=BIMI1; s=newsletter

Without this header, clients fall back to the default selector. In practice, most enterprise deployments use default uniformly and differentiate visual identity at the brand level rather than the stream level.

Deployment Checklist for Each Domain

Before a BIMI record goes live on any domain, verify the following:

  • [ ] DMARC record published at p=quarantine or p=reject
  • [ ] SPF record covers all sending sources
  • [ ] DKIM signing active and aligned
  • [ ] SVG converted to Tiny P/S profile via makeBIMI.com
  • [ ] SVG hosted on HTTPS with a valid TLS certificate
  • [ ] VMC or CMC issued for this specific domain
  • [ ] Certificate hosted on HTTPS and accessible without redirect
  • [ ] BIMI TXT record published at default._bimi.[domain]
  • [ ] Record validated using a BIMI inspection tool

Common Failure Modes at Scale

Subdomain omission. A parent domain has a valid BIMI record. A subdomain used for transactional mail does not. Transactional messages never display logos. The fix is a complete inventory of From addresses across all sending platforms.

SVG served with incorrect MIME type. The SVG must be served as image/svg+xml. Some CDN configurations default to application/octet-stream. Mail clients reject improperly typed assets.

Certificate CN mismatch. A VMC issued for example.com does not cover sends.example.com. Each domain in the BIMI record's DNS namespace requires a certificate issued specifically to that domain.

DMARC subdomain policy gap. p=reject on the organizational domain does not automatically enforce on subdomains unless sp=reject is explicitly set. Subdomains with sp=none or no explicit policy fail BIMI qualification.

Operational Maintenance

BIMI records are not deploy-once infrastructure. VMC and CMC certificates carry expiration dates. Trademark registrations require renewal. SVG assets change with brand refreshes.

Build certificate expiration monitoring into your domain health stack. A lapsed VMC silently drops logo display across all mail clients without DNS errors or bounce signals. At enterprise scale, that represents significant brand visibility loss before detection.

Multi-domain deployments benefit from centralized record management. Maintain a domain registry that maps each sending domain to its BIMI record, SVG asset URL, certificate URL, and certificate expiration date. Review quarterly.

Convert Your Logo → Audit Your Domain