Does BIMI trickle down to subdomains and how to control subdomain BIMI display?
Published 11 Jul 2025
Updated 16 Oct 2026
14 min read
Summarize with
Updated on 16 Oct 2026: We clarified how to inherit or suppress subdomain BIMI logos under current authentication requirements.
Yes, BIMI can apply to subdomains when the receiver falls back to the organizational domain, but that answer needs two important caveats. The visible From domain still has to satisfy BIMI's authentication and DMARC enforcement requirements, and you can stop a specific subdomain from displaying the inherited logo by publishing an explicit declination-to-publish assertion at that subdomain.
The practical version is simple. If example.com has a valid BIMI record, a valid logo, a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC) where required by the mailbox provider, and an enforced DMARC policy that covers mail.example.com, then mail sent from the subdomain can qualify for BIMI display. But if the parent domain says p=reject while sp=none, BIMI processing stops under the BIMI draft's authentication rules. A separate enforced subdomain DMARC record does not override this BIMI eligibility check.
The control point is DNS. Publish a normal BIMI TXT record where you want the logo to appear. Publish v=BIMI1; l=; a=; at a subdomain where you want to block inherited BIMI display. The empty location and evidence tags make this an explicit declination, so the receiver does not continue to the parent assertion for that selector.
When subdomains inherit a BIMI logo
Short answer
BIMI lookup can fall back from a subdomain to the organizational domain. A parent-domain BIMI record can be used for subdomain mail, provided the visible From domain passes DMARC and both the author-domain and organizational-domain policies meet BIMI enforcement requirements.
- Inheritance: A subdomain can use the organizational domain's BIMI assertion when no BIMI1 assertion record exists at the subdomain for the selected selector.
- Requirement: The visible From domain must pass DMARC and be covered by enforcement through its own record or the inherited parent policy.
- Override: A subdomain can publish its own BIMI record to use a different logo or an explicit declination record to suppress display.
BIMI does not work like a browser favicon, where one icon can be assumed across a web property. It is tied to authenticated mail and receiver-side policy decisions. The receiving mailbox provider evaluates the visible From domain, DMARC domain matching, the BIMI DNS record, the SVG logo file, and any certificate requirement it enforces for that sender.
That matters because subdomain BIMI is not only a DNS lookup question. A parent BIMI record can be found, but display still depends on whether the subdomain is allowed to use it. If news.example.com sends mail but the effective DMARC policy for that subdomain is p=none, the logo is not eligible just because example.com has an enforced parent policy.
BIMI works best as the final layer on top of DMARC monitoring. The visible logo depends on having the authentication chain under control. Suped's DMARC monitoring shows aggregate authentication results by sending source and subdomain, so teams can investigate legitimate failures before enforcing DMARC.
Subdomain BIMI lookup with organizational-domain fallback, declination, and DMARC enforcement checks.
How BIMI lookup works for subdomains
BIMI records live in DNS at a selector under the domain being checked. Without a usable BIMI-Selector header, the receiver uses the selector default. For a message using email.example.com in the visible From address, the receiver first checks the BIMI record at the subdomain. If no BIMI1 assertion record is found there, the receiver checks the same selector at the organizational domain.
Subdomain BIMI lookup pathtext
default._bimi.email.example.com TXT fallback to: default._bimi.example.com TXT
This is why people describe BIMI as trickling down. The parent record can be used when the subdomain does not publish a BIMI1 assertion record. But the subdomain can take control by publishing its own record at the more specific DNS name. A valid subdomain assertion, including an explicit declination, stops the fallback lookup for that selector.
For a nested From domain such as eu.news.example.com, fallback goes directly to example.com; it does not check news.example.com as an intermediate parent. An override or declination at news.example.com therefore does not automatically cover eu.news.example.com.
A record beginning v=BIMI1 with an invalid l= value can stop display instead of falling back. Do not use a broken record as an opt-out. The BIMI lookup draft defines the discovery rules.
A normal BIMI record points to the SVG logo with the l= tag and, where used, points to a certificate with the a= tag. If you want a subdomain to use the parent logo, leave the subdomain without a BIMI assertion for that selector. If you want a subdomain to use a different logo, publish a complete record at that subdomain. If you want no BIMI logo, publish an explicit declination with empty l= and a= tags at that subdomain.
|
|
|
|---|---|---|
Parent logo | Organizational domain | Can apply to subdomains |
Different logo | Subdomain | Overrides parent BIMI |
No BIMI logo | Subdomain | Explicit declination stops BIMI for that selector |
Typical BIMI records by intent
DMARC requirements for subdomain BIMI
BIMI requires a strong DMARC policy on both the organizational domain and the visible From domain. The applicable policy must be quarantine or reject, and a quarantine policy must apply to 100% of mail. The message also needs to pass DMARC through SPF or DKIM domain matching. For subdomains, the sp tag sets the policy for covered subdomains that use that DMARC record rather than their own.
Eligible pattern
- Policy: The parent domain uses p=reject or p=quarantine.
- Subdomains: The organizational-domain record does not use sp=none, and any DMARC record published at the subdomain is also enforced.
- Authentication: SPF or DKIM passes with a domain match to the visible From domain.
Display blockers
- Policy gap: The parent domain is enforced, but sp=none fails BIMI's subdomain-policy check.
- No domain match: SPF and DKIM fail DMARC domain matching for the subdomain sender.
- Receiver choice: The mailbox provider can still decline to show BIMI even when records are valid.
RFC 9989 removed the pct tag; omit it from new DMARC records. The BIMI draft still describes the older percentage check for quarantine policies. If a legacy record includes pct, use pct=100 for BIMI. Remove any t=y test flag before relying on the policy for enforcement.
DMARC record that covers subdomainsdns
_dmarc.example.com TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.com"
The example above puts the parent domain and subdomains under the same enforced posture. That does not mean every sender is ready for it. It means the policy shape is compatible with BIMI. Before using this in production, review aggregate reports for every source sending as the parent domain and every known subdomain.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Use Suped's domain health check to review authentication DNS findings before changing policy. Check the actual DKIM selector used by the sending service and validate the BIMI TXT record at its full DNS name.
How to block BIMI on one subdomain
The cleanest way to stop inherited BIMI display on one subdomain is to publish an explicit declination-to-publish record at that subdomain. This gives the receiver a direct BIMI response for the subdomain, with empty logo and evidence locations.
BIMI declination to suppress inherited displaydns
default._bimi.email.example.com TXT "v=BIMI1; l=; a=;"
This record controls default-selector BIMI requests. If messages use custom selectors, publish matching declinations for those selectors too. A BIMI declination does not remove profile photos or other logos the mailbox provider displays independently. The BIMI Group's sender FAQ explains the distinction between BIMI and personal avatars.
This is useful when one subdomain sends operational mail where a brand logo is unwanted, when a business unit is not ready for brand display, or when a subdomain uses a sender setup that passes DMARC but has not completed logo and certificate approvals. It also helps during staged rollouts, because you can keep the parent domain BIMI-ready while excluding individual subdomains.
Do not use DMARC relaxation as a BIMI off switch
Do not set sp=none just to stop BIMI on subdomains. That weakens authentication policy for every subdomain that relies on the parent record. Use an explicit BIMI declination for the specific subdomain instead.
If the subdomain already has a BIMI record with an l= URL, replace the existing assertion with v=BIMI1; l=; a=;. Keep one BIMI1 TXT record at each selector name. Multiple BIMI1 records stop assertion discovery and BIMI processing for the message.
For a deeper subdomain strategy, the more specific guide on excluding the parent is useful when BIMI needs to exist only on selected subdomains.
How to use a different BIMI logo on a subdomain
To show a different logo for a subdomain, publish a complete BIMI record at that subdomain. The subdomain record points to its own SVG file and, when required, its own certificate URL. This is common for separate brands, regional programs, product lines, or mail streams where the visual identity should not match the corporate parent.
Subdomain BIMI record with its own logodns
default._bimi.news.example.com TXT "v=BIMI1; l=https://assets.example.com/bimi/news.svg; a=https://assets.example.com/bimi/news.pem"
Use a square SVG Tiny Portable/Secure (SVG Tiny-PS) file served as image/svg+xml over public HTTPS. The logo and PEM files can be hosted on a different domain from the From address; the hosting domain does not determine BIMI inheritance.
An evidence document can cover several domains but validates one logo. When a subdomain uses organizational-domain fallback, the certificate can cover that organizational domain without listing every sending subdomain separately. Check the certificate's Subject Alternative Name (SAN) entries against the assertion being used, rather than its common name or the hostname serving the PEM file. Confirm the provider's rules before reusing it for a subdomain-specific assertion. The VMC validation draft describes the domain checks.
Subdomain BIMI setup with the visible From domain, enforced DMARC, a BIMI TXT record, and logo certificate.
The subdomain-specific record gives you precise control, but it also adds operational work. Additional records need DNS maintenance, but records that share a logo and suitable certificate can reuse the same hosted files. A different certified logo needs matching certificate evidence. For small teams, parent fallback for ordinary subdomains and explicit records only for special cases is usually easier to manage.
How selectors control logos within one subdomain
A subdomain-specific record separates logos by visible From domain. BIMI selectors add control within that domain, so different mail streams can request different assertions without changing their From addresses. The sender adds a BIMI-Selector header, and the receiver looks up that selector instead of default.
Custom selector for a subdomain mail streamtext
From: offers@news.example.com BIMI-Selector: v=BIMI1; s=offers; DNS lookup: offers._bimi.news.example.com TXT Record: "v=BIMI1; l=https://assets.example.com/bimi/news.svg; a=https://assets.example.com/bimi/news.pem;"
- Sign the header: Include the BIMI-Selector header in the DMARC-matched DKIM signature. A receiver can ignore an unsigned selector header.
- Match the fallback: If the custom selector is absent at the subdomain, lookup falls back to the same selector at the organizational domain, not to the parent's default selector.
- Plan for support differences: Mailbox providers decide whether to honor custom selectors, so test each target provider before relying on selector-specific display.
Use subdomain records when the visible From domains need different default logos. Use selectors when several streams share one From domain but need different logo choices. A selector can also point to an explicit declination record when one signed stream should request no BIMI indicator.
A practical rollout plan
The safest rollout starts with authentication visibility, followed by policy enforcement and BIMI publication. Starting with the logo hides the real dependency because BIMI problems are often DMARC problems with a visible symptom. If reporting shows that one sending platform still fails domain matching, a BIMI record will not fix it.
- Inventory: List every parent domain and subdomain that appears in visible From addresses.
- Authenticate: Confirm each sender passes SPF or DKIM domain matching for the domain it uses.
- Enforce: Move DMARC to quarantine or reject with enforcement enabled, including the subdomain policy BIMI will rely on.
- Publish: Add the parent BIMI record first if most subdomains should share the same logo.
- Exclude: Add explicit declination records where inherited display should stop.
Suped DMARC dashboard showing email volume, authentication health, and source breakdown
Suped supports this workflow in one operational view. Add the parent domain and sending subdomains, review aggregate DMARC results, fix sources that fail domain matching, then stage policy changes before publishing BIMI records.
For teams managing many domains, hosted DMARC keeps parent and subdomain policies consistent while BIMI rolls out. Suped places those policies beside aggregate reports and authentication issues, so teams can verify each change before publishing it.
Operational gates for BIMI rollout
Use report findings rather than a universal pass-rate cutoff, because BIMI has no standard readiness percentage.
Ready
Known mail passes
All legitimate senders are identified, pass domain matching, and are covered by enforcement.
Investigate
Known failures remain
A known sender still needs authentication or domain-matching remediation.
Not ready
Traffic unresolved
Unresolved legitimate or unknown traffic would be affected by enforcement.
Common DNS patterns
Most BIMI subdomain setups use a few repeatable patterns. Choose the pattern based on whether most mail should inherit the parent identity and whether any subdomain needs a separate identity or no BIMI display.
Pattern 1: parent BIMI applies broadlydns
_dmarc.example.com TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.com" default._bimi.example.com TXT "v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=https://assets.example.com/bimi/vmc.pem"
Pattern 2: subdomain uses its own BIMIdns
_dmarc.example.com TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc-reports@example.com" _dmarc.news.example.com TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com" default._bimi.news.example.com TXT "v=BIMI1; l=https://assets.example.com/bimi/news.svg; a=https://assets.example.com/bimi/news.pem"
Pattern 3: subdomain declines inherited BIMIdns
default._bimi.receipts.example.com TXT "v=BIMI1; l=; a=;"
Pattern 1 fits an organization with one brand logo and many sending subdomains. Pattern 2 fits a subdomain with a separate brand identity. Pattern 3 is the targeted opt-out when the parent assertion should remain active but a specific subdomain should not show a logo.
Validation order
- DNS: Confirm one BIMI TXT record exists at the intended selector and domain.
- DMARC: Confirm the visible From domain passes domain matching and has an effective enforcement policy.
- Logo: Confirm the square SVG Tiny-PS file is publicly reachable over HTTPS with the image/svg+xml MIME type.
- Certificate: Confirm the VMC or CMC is valid and covers the domain where the mailbox provider requires evidence.
Why a subdomain BIMI logo is not showing
A correct parent BIMI record does not guarantee a visible logo. Mailbox providers make the final display decision, and BIMI has several dependencies outside the TXT record itself. When a subdomain does not show the logo, work through the same failure points in order instead of changing unrelated DNS records.
|
|
|
|---|---|---|
No logo | Effective subdomain policy is p=none, or a checked record contains sp=none | Review organizational-domain and subdomain DMARC settings |
Parent works | Subdomain has a declination record | Remove the declination to restore fallback for that selector |
Intermittent display | Provider rules or caching | Test each mailbox provider |
Wrong logo | Parent fallback used | Publish subdomain BIMI |
No logo after adding an override | Malformed assertion or multiple BIMI1 records | Repair the record at the selected DNS name |
Troubleshooting subdomain BIMI display
Also check caching and propagation before declaring a setup broken. Receivers can cache BIMI and DMARC DNS answers as well as hosted logo and certificate files. After a DNS change, wait for the previous TTL to expire and send a fresh message. Provider caches for hosted files have separate lifetimes, so DNS expiry alone does not guarantee a refreshed logo.
A logo URL that opens in a browser still needs to be reachable by the receiving provider. Serve the SVG and PEM files without sign-in, geographic restrictions, or CDN browser challenges, and avoid redirect chains. The BIMI receiver guidance draft explains the retrieval limits.
Another common issue is assuming BIMI display equals delivery improvement. BIMI is a brand display layer. It depends on domain authentication and sender reputation, but it does not replace list hygiene, complaint control, bounce handling, or blocklist (blacklist) monitoring. If the sending domain or IP is on a major blacklist or blocklist, fix that separately.
Issue steps to fix dialog showing the issue overview, tailored fix steps, and verification action
Suped's issues view helps separate authentication problems before BIMI troubleshooting begins. Use the issue details alongside aggregate DMARC data to investigate policy gaps or failing DKIM signatures, then validate the selected BIMI record and hosted files separately.
Views from the trenches
Best practices
Check subdomain DMARC enforcement before treating parent BIMI as ready for display.
Use a BIMI declination record when a specific mail stream should not show a logo.
Keep parent fallback for shared brands, then override only the subdomains that differ.
Common pitfalls
Setting sp=none can leave subdomains outside enforcement even when the parent is strict.
Assuming one certificate covers every subdomain can delay launch during validation.
Relaxing DMARC to control BIMI weakens security when a declination record will work.
Expert tips
Test with fresh messages after DNS propagation because cached BIMI results can mislead.
Document each subdomain's intended display state so DNS changes do not restore logos.
Review DMARC reports before BIMI rollout to find senders failing domain matching.
Expert view
Expert from Email Geeks says parent-domain BIMI can apply to subdomains when the authentication and policy conditions are also satisfied.
2023-05-08 - Email Geeks
Marketer view
Marketer from Email Geeks says the important caveat is subdomain DMARC enforcement, because p=reject with sp=none leaves the subdomain relaxed.
2023-05-08 - Email Geeks
Frequently asked questions
It can apply when the subdomain has no BIMI1 assertion record for the selected selector and the visible From domain passes DMARC under qualifying enforcement policies. A receiver can still decide not to show the logo.
Publish an explicit BIMI declination at that subdomain: v=BIMI1; l=; a=;. That stops fallback to the parent assertion for the same selector without weakening DMARC policy.
Yes. Publish a complete BIMI record at that subdomain with its own logo URL and certificate URL where required. The subdomain record overrides parent fallback.
Yes. Publish each logo under a different selector and add a signed BIMI-Selector header to the messages that should request it. Test provider support before depending on selector-specific display.
Yes. An sp=none value in either checked record blocks BIMI under the draft rules. A separate enforced subdomain record does not bypass that check. Correct the sp setting without weakening DMARC.
Check DMARC domain matching, the effective subdomain policy, the selected BIMI TXT record, SVG Tiny-PS formatting and MIME type, certificate coverage, HTTPS access, DNS propagation, sender reputation, and receiver support. A valid record does not force mailbox providers to display the logo.
