How to set up BIMI records for multiple subdomains while excluding the parent domain?
Published 5 Aug 2025
Updated 6 Oct 2026
12 min read
Summarize with
Updated on 6 Oct 2026: We clarified selective BIMI publication, certificate coverage and DMARC enforcement, and added DNS zone checks for subdomain rollouts.
Yes, you can set up BIMI (Brand Indicators for Message Identification) on several subdomains without enabling BIMI for the parent domain. Publish BIMI TXT records only at the exact subdomains that should show the logo, do not publish a BIMI record at the parent domain, and make sure the Mark Certificate covers the domain used for the assertion or its organizational domain.
The practical setup is simple: default._bimi.news.example.com gets a BIMI TXT record, default._bimi.offers.example.com gets a BIMI TXT record, and default._bimi.example.com is left empty. The parent domain can still have DMARC enforcement. DMARC is required for BIMI, but DMARC does not display a BIMI logo by itself.
Treat this as a DNS scoping problem first and a certificate coverage problem second. Suped's DMARC monitoring helps check DMARC results for each sending source before BIMI records are published.
Enable BIMI only on selected subdomains
BIMI has no policy tag for "all subdomains except the parent." BIMI records are discovered through DNS at a selector under the visible From domain. For most implementations, that selector is default. If a subdomain should display the logo, publish the BIMI record at that subdomain. If the parent should not display the logo, do not publish the parent BIMI record.
The receiver queries the selected BIMI host at the exact RFC5322.From domain first. When no BIMI record is found there, it checks the same selector at the organizational domain. With no BIMI record at the parent, only subdomains with their own assertion can use this setup. If a parent record is added later, subdomains without an override can inherit it. For complete parent exclusion, check other active selectors, CNAMEs and DNS wildcards that return a parent-domain assertion.
- Publish selectively: Create one BIMI TXT record or CNAME per approved sending subdomain, such as news, offers, billing, or account.
- Exclude the parent: Leave the parent BIMI host without a record. Use an explicit declination record only when a subdomain must override an inherited parent assertion.
- Reuse the same assets: Point every approved subdomain to the same SVG and Mark Certificate URLs when the same logo applies.
- Check certificate scope: A VMC or CMC containing the organizational domain can support its subdomains when the certificate and logo meet the receiver's requirements. Confirm the certificate contents and issuance workflow before purchase.
If the parent already has BIMI and selected subdomains must be excluded, publish an explicit declination at each excluded subdomain: v=BIMI1; l=; a=;. That reverse design is covered in parent BIMI rules.
How BIMI lookup behaves on subdomains
BIMI starts with the visible From domain, also called the RFC5322.From domain. If the message uses news.example.com in the From address, the receiver first checks the BIMI assertion record for that domain. With the common default selector, the lookup target is default._bimi.news.example.com. The Return-Path and DKIM signing domain do not choose the BIMI lookup domain. A message with From: sender@example.com still uses the parent domain even if its Return-Path is under news.example.com.
If that exact record does not exist, the receiver can fall back to default._bimi.example.com. A subdomain record does not make the parent domain show a logo, and a missing parent record prevents that fallback from finding an assertion. Publishing a valid record only makes a message eligible for BIMI. Each mailbox provider still applies its own support, reputation, and display rules. For nested subdomains, lookup checks the exact From domain and then the organizational domain, without searching every intermediate parent. The BIMI Group FAQs explain the visible From domain and subdomain record inheritance.
BIMI subdomain lookup and authentication checks with no parent-domain BIMI record.
Subdomain gets BIMI
- Record location: The BIMI TXT record exists under the sending subdomain.
- Logo path: The record points to the SVG logo and, when used, the Mark Certificate.
- Result: The mailbox can display the logo after authentication and provider checks pass.
Parent stays excluded
- Record location: The parent BIMI host has no TXT record.
- DMARC status: The parent still has an enforced DMARC policy.
- Result: Mail from the parent domain has no BIMI assertion to use.
DNS records to publish
This example enables BIMI on news.example.com and offers.example.com, but not on example.com. Both subdomains use the same logo and Mark Certificate. The parent domain has no BIMI TXT record. Publish each Value as one TXT record and replace the example asset URLs with your own.
BIMI TXT records for selected subdomains
Host: default._bimi.news.example.com Type: TXT Value: v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=https://assets.example.com/bimi/mark-certificate.pem; Host: default._bimi.offers.example.com Type: TXT Value: v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=https://assets.example.com/bimi/mark-certificate.pem; # Leave default._bimi.example.com without a BIMI record.
The l= tag points to the BIMI SVG. The a= tag points to the VMC or CMC PEM file. A self-asserted record without a certificate has limited provider support, so broad mailbox coverage usually requires a Mark Certificate.
Use a square SVG Tiny P/S (Portable/Secure) file with no scripts, external resources, or embedded raster images. Set baseProfile="tiny-ps" and version="1.2", include a <title> element, and remove x and y attributes on the root <svg> element. Host it on a stable public HTTPS URL and return the image/svg+xml media type so mailbox providers can retrieve and parse it.
|
|
|
|---|---|---|
Show logo on news | Add subdomain BIMI | Eligible after checks |
Show logo on offers | Add subdomain BIMI | Eligible after checks |
Hide logo on parent | No parent BIMI | No BIMI assertion |
Use the same brand mark | Reuse logo and certificate | Simpler maintenance |
BIMI scoping choices for parent and subdomains
The parent domain can have other DNS records for mail, including SPF, DKIM, DMARC, MX, MTA-STS, and TLS reporting. Those records do not create a BIMI display path unless a BIMI assertion record is found.
Publish records in the correct DNS zone
Create each record in the public DNS zone authoritative for its selector hostname. If news.example.com has been delegated through NS records to a separate DNS provider, publish its BIMI record in that child zone. Adding it only in the example.com zone will not make it discoverable below that delegation.
|
|
|
|---|---|---|
example.com | default._bimi.news | default._bimi.news.example.com |
news.example.com | default._bimi | default._bimi.news.example.com |
Relative host names when the DNS panel appends its zone name
Some DNS panels accept fully qualified names; others append the zone automatically. Confirm the resulting hostname before saving so the domain is not appended twice. After publication, query the public records for both approved subdomains and the excluded parent.
Check the public BIMI recordsBASH
dig +noall +comments +answer TXT default._bimi.news.example.com dig +noall +comments +answer TXT default._bimi.offers.example.com dig +noall +comments +answer TXT default._bimi.example.com
Each approved hostname should resolve to one BIMI TXT record, following any CNAME. The parent query should return no BIMI assertion. Investigate timeouts or SERVFAIL before confirming parent exclusion.
Optional CNAMEs for shared BIMI records
Repeating the same TXT value is manageable for a few subdomains. For a larger set that uses one logo and certificate, each approved selector host can be a CNAME to one shared BIMI TXT record. Each subdomain still has an explicit BIMI lookup name, while the parent remains without a BIMI record.
Shared BIMI assertion through CNAMEs
Host: default._bimi.news.example.com Type: CNAME Value: shared._bimi-assets.example.com Host: default._bimi.offers.example.com Type: CNAME Value: shared._bimi-assets.example.com Host: shared._bimi-assets.example.com Type: TXT Value: v=BIMI1; l=https://assets.example.com/bimi/logo.svg; a=https://assets.example.com/bimi/mark-certificate.pem;
Do not mix record types
Do not publish a CNAME and a TXT record at the same selector hostname. Put the BIMI TXT value only at the shared CNAME target, then test every source hostname after DNS changes. Keep exactly one BIMI TXT record at that target; duplicate BIMI assertions cause discovery to fail.
VMC and CMC coverage with DMARC enforcement
A separate Mark Certificate is not automatically required for every subdomain when the same logo is used. The current VMC validation draft permits certificate matching against the assertion's author domain or organizational domain. For example, a certificate containing example.com can support mail from news.example.com when its BIMI record points to the same certified mark. This draft is a work in progress; confirm the receiving provider's validation requirements.
Certificate issuance and receiver validation are separate steps. Inspect the Subject Alternative Name (SAN) entries and confirm that they cover the organizational domain or each exact assertion domain needed for the rollout. Also confirm that the BIMI SVG matches the mark embedded in the certificate.
Do not skip DMARC
The message must pass DMARC, and its visible From domain plus organizational domain must both be covered by enforcement. Use p=quarantine or p=reject at the organizational domain. For a subdomain, use an explicit enforced policy or inherit the parent's enforced p= or sp= policy. Keep sp=none out of this BIMI setup because current BIMI authentication requirements reject it.
RFC 9989 makes pct historic, so new DMARC records do not require pct=100. Existing BIMI guidance still checks legacy quarantine records for full enforcement: remove a reduced pct value or set it to 100 for compatibility. Omit t=y in production BIMI policies so DMARC test mode does not lower the requested enforcement.
DMARC records that support BIMI
Host: _dmarc.example.com Type: TXT Value: v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@example.com Host: _dmarc.news.example.com Type: TXT Value: v=DMARC1; p=reject; rua=mailto:dmarc@example.com Host: _dmarc.offers.example.com Type: TXT Value: v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Explicit subdomain DMARC records provide separate policy control and can simplify troubleshooting. They are not mandatory when the parent policy and its sp= value, when present, enforce the required policy for those subdomains. If sp is omitted, the parent's p policy applies. The subdomain DMARC setup guide explains both approaches.
The BIMI Group FAQs explain certificate options and provider display rules. A Verified Mark Certificate (VMC) and a Common Mark Certificate (CMC) have different logo eligibility requirements. A CMC provides a route for eligible logos without a registered trademark; confirm that your target mailbox providers accept it before purchase or renewal.
Validate each subdomain before launch
A certificate mismatch needs investigation. Compare the exact From domain and organizational domain with the certificate SAN entries, then verify the certificate chain and validity dates. Logo display alone does not establish certificate validity because mailbox providers cache assets and apply their own display rules.
Validate in this order to separate DNS, authentication, certificate, asset, and mailbox display issues.
- Confirm From domain: Send a real message and confirm the visible From domain is the subdomain you expect.
- Check BIMI host: Query the exact subdomain selector and follow any CNAME to confirm one BIMI assertion with the correct SVG and certificate URLs.
- Verify DMARC pass: Confirm SPF or DKIM passes with identifier alignment and check the policies at the From domain and organizational domain. An SPF or DKIM pass for an unrelated domain does not satisfy DMARC.
- Validate assets: Fetch the SVG and PEM over public HTTPS, confirm successful responses, and verify the SVG Tiny P/S structure and media type. Check that the certificate is unexpired, trusted by the receiver and valid for the assertion domain or its organizational domain.
- Allow for caching: Wait for DNS and mailbox-side caches to refresh before treating delayed logo display as a configuration failure.
- Verify parent exclusion: Query every selector used by parent-domain messages and confirm that none returns a BIMI assertion, including through a CNAME or DNS wildcard.
DMARC checker
Look up a domain's DMARC record and catch policy issues.
?/7tests passed
Before troubleshooting BIMI itself, run a focused DMARC check for the parent and each sending subdomain. BIMI debugging gets faster when the applied DMARC record and policy are clear.
If the DNS and DMARC records look correct but the logo is still missing, work through BIMI validation errors one by one. Frequent causes include a noncompliant SVG, an unreachable certificate URL, an unenforced DMARC policy, a different From subdomain than expected, or a provider display rule that the sender does not yet meet.
Monitor DMARC for the BIMI rollout
Suped is our DMARC reporting and email authentication platform. For this workflow, it centralizes aggregate DMARC data so the authentication state of each sending subdomain can be checked before BIMI records are published.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
For a subdomain BIMI rollout, Suped can show DMARC pass rates by sending source, identify SPF or DKIM identifier alignment failures, and alert the team when authentication changes after launch. That evidence helps separate a DMARC problem from a BIMI asset or provider-display problem.
Suped's Hosted DMARC supports policy changes without repeated DNS edits. The domain health check provides a preflight check across DMARC, SPF, and DKIM before BIMI display testing begins.
Practical launch rule
Start with one active subdomain. Publish BIMI there, validate logo eligibility and display, then copy the known-good record or CNAME pattern to the other approved subdomains.
Views from the trenches
Best practices
Publish BIMI records only on approved subdomains, then leave the parent without a BIMI TXT record.
Keep the same SVG and certificate URLs across subdomains when the brand mark is identical.
Validate DMARC results and enforcement before launch, because BIMI needs both to qualify.
Common pitfalls
Using an organizational-domain BIMI record for fallback also makes the parent eligible for a logo.
Ignoring a certificate mismatch without checking SAN entries leaves domain-scope errors unresolved.
Publishing the parent BIMI record by habit can make the parent eligible for logo display.
Expert tips
Use short DNS TTLs before launch so BIMI record edits propagate during validation quickly.
Document which subdomains own marketing, billing, and lifecycle mail before adding BIMI.
Stage one subdomain first, confirm logo display, then clone the known-good record elsewhere.
Marketer view
Marketer from Email Geeks says a VMC containing the organizational domain can work for a subdomain when the BIMI record is published at that subdomain.
2024-03-20 - Email Geeks
Marketer view
Marketer from Email Geeks says teams should not assume every subdomain needs its own SAN when the organizational domain is already in the certificate domain set.
2024-03-20 - Email Geeks
BIMI subdomain launch checklist
Check each approved subdomain before launch. Reuse one VMC or CMC only when its domain entries and certified logo cover the rollout.
- DMARC passes for each sending subdomain through SPF or DKIM identifier alignment.
- The subdomain and organizational-domain DMARC policies meet BIMI enforcement rules.
- Each approved subdomain has a BIMI TXT record or a CNAME to a shared assertion.
- Every active BIMI selector at the parent returns no assertion, including through CNAMEs or DNS wildcards.
- The SVG and Mark Certificate are valid, reachable over HTTPS, and consistent.
Frequently asked questions
Not necessarily. A certificate containing the organizational domain can support its subdomains when they use the same certified logo and pass the receiver's certificate checks. Inspect the SAN entries and confirm the issuance and receiver requirements before purchase.
No. A subdomain BIMI record does not create an assertion for the parent. Mail from the parent needs its own applicable BIMI record before it becomes eligible for a BIMI logo.
An organizational-domain BIMI record can provide fallback for subdomains, but it also enables BIMI for the parent. To exclude the parent, publish a TXT record at each approved subdomain selector or point those selector hosts by CNAME to one shared BIMI TXT record.
Yes. The parent needs DMARC enforcement for BIMI on its subdomains, but DMARC enforcement does not publish a logo. The parent stays without BIMI when its BIMI selector host has no record.
A validator can compare only the exact subdomain while the certificate contains the organizational domain. Inspect the SAN entries and assertion lookup, and check certificate trust and expiry. Confirm the DMARC result and the receiver's BIMI validation outcome instead of relying on logo display alone.
