How do BIMI VMC certificates work with sub-domains and why are they important for email logo display?
Published 4 Aug 2025
Updated 12 Oct 2026
15 min read
Summarize with
Updated on 12 Oct 2026: We updated VMC subdomain coverage and the authentication checks required for BIMI logo display.
A VMC does not need to be bought separately for every subdomain merely because those subdomains send email. When the same organization and certified logo apply, a VMC listing example.com can cover its sending subdomains without listing each child separately. A BIMI record at the organizational domain can also be inherited by subdomains unless a child domain publishes its own BIMI record to change or suppress the logo.
The caveat is important: inheritance of the BIMI DNS record and coverage of the VMC are related, but they are not the same. The DNS record tells mailbox providers where to find the SVG logo and certificate file. The VMC tells them that a mark verifying authority has checked the organization, its rights to the logo, and the validated domain scope. A different certified logo needs separate certificate validation. An uncovered organizational domain needs an issuer-validated addition or separate certificate coverage.
Treat BIMI as the display layer on top of email authentication. BIMI eligibility depends on whether DMARC is enforced, SPF or DKIM produces the required domain match, and the logo assets can be fetched over HTTPS; mailbox providers still control display. Suped's DMARC monitoring workflow shows pass rates, policy state, failing sources, and the sender cleanup needed before BIMI can work.
Do subdomains need separate VMCs?
For a normal setup such as example.com, news.example.com, offers.example.com, and receipts.example.com, one VMC is usually enough when every domain uses the same certified logo and example.com is in the certificate's Subject Alternative Name (SAN) extension. A quote that triples the cost because there are three sending subdomains should be checked against the proposed certificate scope before renewal.
- Same logo: one VMC covering the organizational domain can cover its sending subdomains.
- Different logo: a separate Mark Certificate is needed for each distinct certified SVG logo displayed in the inbox.
- Different organizational domain: ask the issuer to add that organizational domain as a SAN for the same logo or obtain separate coverage.
- Subdomain override: a child domain can publish its own BIMI record when it needs a different logo path.
The BIMI Group FAQ states that a default BIMI record should be published at the organizational domain and can be inherited by subdomains. It also notes that a subdomain can publish its own record, which gives the domain owner a clean way to override inherited display. The VMC validation draft allows a SAN to match the visible From domain or its organizational domain, which explains why child names do not always need individual entries.
Before approving a per-subdomain renewal, ask the issuer why separate certificates are needed when one organizational-domain VMC covers the same logo. The useful questions are 'How many certified logos need certificates?' and 'Which organizational domains will appear in the SAN extension?'
BIMI subdomain lookup flow through DMARC, certificate validation, and inbox logo display.
How BIMI lookup works for subdomains
A mailbox provider starts with the visible From domain, not the return-path alone. If the message is from offers.example.com, the provider checks whether the message passes DMARC for that visible domain. DKIM is often the cleaner route for BIMI because its signing domain can meet DMARC's strict or relaxed domain-matching rules even when a sending platform uses its own bounce domain.
After DMARC passes, the provider looks for a BIMI TXT record at the selected BIMI selector. Most senders use the default selector. For offers.example.com, the default lookup checks default._bimi.offers.example.com, then default._bimi.example.com if the child has no BIMI record. It does not search every intermediate parent domain. That is why a parent-domain BIMI setup can display a logo for subdomain mail without copying identical records everywhere. The BIMI discovery draft defines this fallback.
Parent-domain BIMI recorddns
default._bimi.example.com. IN TXT "v=BIMI1; l=https://brand.example/bimi/logo.svg; a=https://brand.example/bimi/vmc.pem;"
The value of l= points to the SVG logo. The value of a= points to the Mark Certificate file. The provider fetches the assets, checks the certificate, applies its own mailbox policy, and then decides whether to display the logo. A correct DNS record is necessary, but it does not force every provider to show the logo every time.
Inherited parent record
- Best fit: one logo across parent and child sending domains.
- DNS effort: publish once at the organizational domain.
- Risk: the logo appears on more subdomains than intended.
Subdomain record
- Best fit: a child domain needs a different logo or no logo.
- DNS effort: publish a record at the child BIMI hostname.
- Risk: stale child records can override the parent setup.
When one VMC is enough
One VMC is usually enough when the business has rights to one qualifying logo and wants that same logo to appear for mail sent by the parent domain and its subdomains. A single certificate can include multiple organizational domains as SANs for one certified logo, subject to the issuer's validation and ordering rules.
|
|
|
|---|---|---|
Same logo | One | Same certified SVG and covered organizational domain |
Different logos | Multiple | Distinct marks |
Different domains | One if included | Same logo with validated SAN coverage |
Seasonal logo | Additional if the certified SVG changes | Certificate binds a specific SVG |
Typical VMC renewal decisions for subdomain senders.
Make the renewal request specific: ask the issuer to confirm the organizational-domain SAN and any other organizational domains using the same certified SVG. If the answer is yes, the subdomain count should not multiply the certificate count. If coverage is missing, ask whether reissuance with an additional validated SAN solves the problem before ordering another certificate. Also record the expiry date and start renewal early, because BIMI Mark Certificates currently have a maximum validity period of 398 days. The Mark Certificate requirements specify that limit. Assign a renewal owner and recheck the published certificate URL after renewal.
DigiCert CertCentral VMC renewal screen for reviewing domain and subdomain scope.
When a separate certificate is justified
A separate VMC is justified when another sending stream uses a different certified SVG logo. BIMI is not a general image-hosting method. The certificate binds the approved SVG representation, so a seasonal design or color variation needs issuer review before display.
- Brand split: marketing.example.com and billing.example.com use different registered marks.
- Uncovered domain: the issuer cannot add the required organizational domain to the same certificate under its validation or product rules.
- Business split: a subsidiary uses a distinct legal identity and its own trademark.
- Different selector logos: selectors point to different certified SVGs; a selector alone does not require another certificate.
Subdomain override exampledns
default._bimi.news.example.com. IN TXT "v=BIMI1; l=https://brand.example/bimi/news.svg; a=https://brand.example/bimi/news-vmc.pem;"
That override is useful when a child domain needs its own brand treatment. Duplicate child records are unnecessary when the parent record already supplies the same SVG and VMC. For a deeper walkthrough of inheritance controls, the subdomain BIMI display page covers parent and child record behavior in more detail.
Why VMCs matter for logo display
A Mark Certificate matters because several major mailbox providers will not display a BIMI logo without certificate-backed evidence. Google's BIMI setup guidance accepts a VMC or CMC for logo display, while Apple's BIMI guidance describes support for VMCs and other accepted BIMI Evidence Documents. A self-asserted BIMI record can still be useful where a provider accepts it, but provider-specific certificate rules control broader display.
|
|
|
|---|---|---|
VMC or CMC | Both support logos; VMC adds the verified checkmark | |
Accepted evidence document | The receiving provider must validate evidence and add BIMI headers | |
VMC optional | Bulk mail with sufficient reputation and engagement |
Provider behavior changes, so confirm current requirements during implementation.
The business reason is simple: the logo is visible to recipients before they read the message. That makes BIMI useful for recognition, but it also means providers need stronger proof than a domain owner pointing DNS at any image. A Mark Certificate connects the logo to a validated organization and its rights to the mark. It also binds the evidence to specified domain names.
BIMI does not override reputation, mailbox policy, asset caching, or interface rules. It also does not repair deliverability. Even with enforced DMARC and valid assets, a provider can delay display or choose not to display the logo in a specific inbox view. A displayed logo or Gmail checkmark does not prove that every message is safe.
For Gmail-specific planning, the Gmail and VMC page explains why certificate-backed BIMI differs from publishing only a DNS record.
How VMCs and CMCs differ
A VMC and a CMC are both BIMI Mark Certificates, but they prove rights to different classes of marks. A VMC normally uses a registered trademark; qualifying government marks are also accepted under certificate rules. A CMC gives qualifying organizations a certificate-backed route for a logo that is not registered as a trademark, subject to the issuer's evidence and usage requirements. For prior-use CMCs, the Mark Certificate requirements require current display and archived use at least 12 months earlier on a domain controlled by the applicant.
|
|
|
|---|---|---|
VMC | Registered or otherwise eligible verified mark | Logo display plus verified checkmark when all criteria pass |
CMC | Prior-use evidence or another eligible CMC mark category | Logo display without the VMC verified checkmark |
VMC and CMC planning differences for BIMI.
This distinction changes the certificate type, not the subdomain lookup. The BIMI record still uses the a= tag to reference the PEM file, DMARC must meet the provider's enforcement rules, and the certificate must contain the required domain names. Confirm provider acceptance before ordering because support differs by certificate type and inbox interface.
The DMARC work that comes first
Start a VMC or CMC renewal by proving that every sending stream using the parent or child domain passes DMARC for its visible From domain. BIMI requires enforcement on both the organizational domain and the visible From domain, using p=quarantine or p=reject. Check the organizational record and each child record; an omitted sp= inherits the parent p= policy. The BIMI authentication requirements reject organizational-domain p=none or sp=none, even when a child publishes its own enforcement record.
RFC 9989 removed pct from DMARC. For a fully enforced rollout, omit t or use t=n; t=y requests testing and reduces the specified policy by one level. Gmail's published BIMI requirements still specify pct=100, so retain that legacy value when following its documented workflow. Do not use a lower percentage to stage a new BIMI deployment.
BIMI readiness by DMARC policy
Check enforcement at the organizational domain and the effective policy for the visible From domain; mailbox providers still apply their own display rules.
Monitoring
p=none
Useful for discovery, but not enough for BIMI display at providers that require enforcement.
Testing or legacy percentages
t=y / legacy pct below 100
Testing reduces the requested policy by one level; legacy percentages below 100 conflict with Gmail's published BIMI requirements.
Enforced
quarantine or reject
Verify full enforcement at the organizational domain and the effective sending-domain policy.
Suped's Hosted DMARC product lets teams stage policy changes without editing DNS for every adjustment. That matters when BIMI covers several sending platforms and subdomains, because failing sources must be fixed before enforcement. Use Suped's aggregate reports to identify failing sending sources before policy changes, and its blocklist (blacklist) alerts to investigate reputation problems separately from BIMI asset errors.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
For a quick check outside the dashboard, use the DMARC checker to confirm record syntax. Then use the domain health checker for a broader view of DMARC, SPF, DKIM, and DNS health before publishing BIMI.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Check the SVG logo and PEM certificate chain
Subdomain inheritance does not correct an invalid logo or incomplete PEM file. Use the same issuer-approved assets wherever the same certificate is referenced.
- Use SVG Tiny Portable/Secure (SVG Tiny PS), version 1.2 with baseProfile="tiny-ps". Remove scripts, animations, external resources, and embedded raster images.
- For Gmail, specify absolute pixel dimensions of at least 96 by 96. Google's SVG guidance recommends centered square artwork, a solid background, and a file of 32 KB or smaller.
- Serve the SVG and certificate publicly over HTTPS without login or access restrictions. Return image/svg+xml for the SVG, as specified in the BIMI Group FAQ.
- Publish the complete PEM certificate chain, with the Mark Certificate first. For Gmail, append intermediate and root certificates in the issuer-provided order.
Keep the hosted SVG identical to the issuer-approved SVG embedded in the certificate. The VMC validation draft allows rejection when those images differ. Changing l= alone does not replace the certified asset.
A practical rollout plan
For a renewal with multiple sending subdomains, use this order. It keeps the certificate decision tied to actual sending behavior instead of a rough domain count.
- Inventory senders: list every parent domain and child domain used in visible From addresses.
- Confirm effective policy: check organizational p and sp plus the effective child policy for quarantine or reject; use full enforcement rather than test mode.
- Check logo scope: decide whether every stream uses the same mark and whether that mark qualifies for a VMC or CMC.
- Ask the issuer: confirm the organizational-domain SANs needed for the certified logo; child domains need not each have their own entry.
- Publish BIMI: use the parent record by default, then override only where needed.
- Send tests: send new messages from every active subdomain to target inboxes and allow for DNS and provider asset caching.
BIMI selector exampletext
BIMI-Selector: v=BIMI1; s=receipts; receipts._bimi.example.com. IN TXT "v=BIMI1; l=https://brand.example/bimi/receipt.svg; a=https://brand.example/bimi/receipt-vmc.pem;"
Selectors are useful when one domain needs more than one approved logo. They do not remove the certificate requirement for providers that require a VMC or CMC. They tell a supporting provider which BIMI record to query for a given message, but selector support and display behavior vary by provider. Include the BIMI-Selector header in the DKIM signature that passes DMARC, as recommended by the BIMI header-signing guidance; receivers otherwise have reason to ignore it.
Suped's DMARC reporting product identifies failing senders across the parent domain and its subdomains. Use those reports to fix authentication failures before changing policy or renewing the Mark Certificate.
If DNS ownership slows the rollout, Hosted DMARC is a practical way to stage policy changes while the team cleans up senders and prepares the logo assets.
How to avoid inherited logo surprises
Parent-domain BIMI can cause unintended display. If the parent record is inherited, a child domain can start showing the parent logo once it meets the same authentication and provider requirements. That is suitable for normal brand mail, but not always for test domains, partner streams, or internal-only mail.
Before publishing a parent BIMI record, map every subdomain that appears in the visible From address. Decide which ones should display the brand logo, which ones need their own logo, and which ones should not display a BIMI logo. To suppress the inherited BIMI logo, publish an explicit no-logo record at the child selector hostname. Deleting the child record enables organizational-domain fallback again.
Suppress inherited BIMI for a test subdomaindns
default._bimi.test.example.com. IN TXT "v=BIMI1; l=; a=;"
Empty l= and a= values explicitly decline BIMI, as defined in the BIMI discovery draft. Apply the no-logo record to each selector used by the excluded stream; it controls BIMI rather than other provider-managed avatars.
Good parent setup
- Domain map: every visible From domain is known.
- Logo scope: the same verified mark fits each stream.
- DNS control: child overrides are intentional.
Risky parent setup
- Unknown mail: old systems still send from child domains.
- Mixed brands: different logos share one parent.
- No owner: nobody reviews child BIMI records.
The same logic applies to the certificate. A subdomain does not need a separate certificate merely because it is not the organizational domain, but the applicable name still needs valid certificate coverage. The VMC subdomain certificate page covers that certificate-specific edge case.
Views from the trenches
Best practices
Verify domain scope before pricing separate certificates for every sending subdomain.
Publish a parent BIMI record, then override only subdomains that need different logos.
Confirm effective DMARC enforcement before spending time on certificate renewal.
Common pitfalls
Buying one certificate per subdomain wastes budget when a parent VMC already covers them.
Publishing BIMI before DMARC enforcement creates a record that providers can ignore.
Using a complex SVG often fails because mailbox providers fetch small, strict files.
Expert tips
Check the organizational-domain SAN before asking the issuer to add each child separately.
Use a no-logo BIMI record only when a subdomain must suppress inherited display.
Track logo tests by mailbox because caching can make a correct setup look broken today.
Marketer view
Marketer from Email Geeks says a VMC validated at the organizational domain can cover child sending domains when the same mark is used.
2025-03-06 - Email Geeks
Marketer view
Marketer from Email Geeks says Google and Apple require certificate-backed BIMI before showing logos in supported inbox views.
2025-03-13 - Email Geeks
VMC renewal decisions for subdomains
Renew one parent-domain VMC when the subdomains use the same verified logo and the issuer confirms that the certificate includes the required domain scope. For the same logo on another organizational domain, ask whether adding a validated SAN is sufficient before buying another certificate. If the logo lacks the mark basis needed for a VMC, check whether a CMC meets the issuer and target provider requirements.
The larger task is often getting DMARC enforcement stable across every sender, publishing a compliant SVG, keeping the certificate file reachable, and checking real mailbox display. Suped's DMARC reporting product supports this work by showing sender readiness and sources that block enforcement.
