How do I set up Complaint Feedback Loop (CFL) within Yahoo SenderHub with DKIM domain, and why is my BIMI logo not showing?
Published 30 Apr 2025
Updated 21 Oct 2026
13 min read
Summarize with
Updated on 21 Oct 2026: We clarified Yahoo CFL verification, DKIM alignment, and the BIMI policy checks behind missing logos.
Enroll Yahoo's Complaint Feedback Loop (CFL), also called the Yahoo FBL, against the DKIM signing domain, specifically the value in the d= tag of the DKIM-Signature header. If the visible From domain is marketing.notcutts.co.uk but the DKIM signature says cd.marketing.notcutts.co.uk, add, verify, and enroll cd.marketing.notcutts.co.uk in Yahoo CFL. The reporting address can be any mailbox you control, but the enrolled sending domain has to match the DKIM d= domain for Yahoo to send ARF reports. If an email service provider controls signing and complaints, confirm whether it already enrolls and processes that domain before creating another workflow.
The BIMI answer is different. BIMI discovery starts with the header From author domain, not the DKIM signing domain. For mail from marketing.notcutts.co.uk using the default BIMI selector, a receiver first queries default._bimi.marketing.notcutts.co.uk. If no BIMI record is found there, it can fall back to default._bimi.notcutts.co.uk. An explicit empty logo record declines BIMI and stops that fallback. Publish the subdomain record when that mail stream needs its own logo or an explicit override. Yahoo's Sender Hub FAQs tie display to a valid BIMI SVG, an enforced DMARC policy, bulk mail, reputation, and engagement.
- Use the DKIM d= domain for CFL. Yahoo sends ARF reports when that signed domain is enrolled and a recipient reports the message.
- If only the CFL enrollment is wrong, add and verify the DKIM domain in Sender Hub. If the DKIM d= value is wrong, change the sender platform signing setup and publish its DKIM key.
- Start BIMI checks with the header From domain. A DKIM subdomain does not control the BIMI lookup, and an absent subdomain record can fall back to the organizational domain.
- Do not dismiss an sp=none warning solely because the sending subdomain has p=reject. BIMI checks the author-domain and organizational-domain policies separately from normal DMARC policy application.
Which domain Yahoo CFL uses
Split this problem into separate identities because email headers hide important detail. The header From domain is the brand-facing author domain. The envelope From domain is the bounce path used by SPF. The DKIM d= domain is the domain that cryptographically signs the message. Yahoo CFL is tied to the DKIM-signed identity, so enrolling the envelope From or header From domain leaves reporting quiet when the message is signed by a different subdomain.
|
|
|
|---|---|---|
CFL | DKIM d= | ARF follows signing |
BIMI | Header From first | Org fallback is possible |
SPF | Envelope From | Return path check |
DMARC | Header From | Policy domain |
Use the domain that matches the protocol being checked.
Do not infer the envelope domain from the visible sender
A mailbox client shows the visible From address, but that is not proof of the envelope From domain or the DKIM d= value. Open the full headers of a real campaign message and inspect the DKIM-Signature header before changing Sender Hub enrollment.
- Find the DKIM-Signature line and read the d= tag.
- Add that domain under Domains, complete verification, then enroll it under Manage Services > Complaint Feedback Loop.
- Expect ARF reports only when Yahoo users report mail signed by the enrolled DKIM domain.
Verify the reporting mailbox by entering the code Yahoo sends during enrollment. It does not need to match the From or DKIM domain, and the same verified address can receive reports for additional domains. Check the enrollment status under Manage Services > Complaint Feedback Loop; domain verification alone does not activate reporting. Enrolling the organizational domain does not automatically enroll every DKIM signing subdomain. Yahoo no longer offers IP-based or CIDR-based CFL enrollment, as its CFL FAQs explain. Legacy FBL registrations must be enrolled through Sender Hub to receive reports.
Yahoo Sender Hub CFL enrollment screen showing a verified DKIM domain.
How to verify the DKIM domain
The cleanest check is to send yourself a real message from the same stream that goes to Yahoo recipients, then view the full headers. Do not rely on a setup screenshot from a campaign tool, because the message can have multiple signatures, a vendor signature, or a custom signing domain that differs from the branded From address.
DKIM signature to inspecttext
DKIM-Signature: v=1; a=rsa-sha256; d=cd.marketing.example.com; s=selector1; c=relaxed/relaxed; h=from:to:subject:date; bh=BODY_HASH; b=SIGNATURE_DATA
In that example, the CFL enrollment domain is cd.marketing.example.com. If that domain is not already verified in Sender Hub, add it and publish the verification TXT record Yahoo gives you. This ownership TXT record is separate from the DKIM public key. If your sender platform is signing with the wrong d= domain, change the sender platform configuration first, then publish the DKIM public key for the new selector. Yahoo requires a key length of at least 1024 bits and recommends 2048 bits when the platform supports it.
DKIM public key locationdns
selector1._domainkey.cd.marketing.example.com. TXT "v=DKIM1; k=rsa; p=BASE64_PUBLIC_KEY"
DKIM checker
Check selector records and public key configuration.
?/7tests passed
After publishing the key, use a DKIM checker to confirm the selector resolves and the key is syntactically valid. A DNS check does not prove that a delivered message passes DKIM; confirm dkim=pass in the receiving server's Authentication-Results header. If Yahoo CFL enrollment is still quiet after that, check whether the enrolled domain and the observed d= value are identical, including every subdomain label. A selector change under the same d= domain does not change the CFL enrollment domain.
When a DNS-only change is enough
A DNS-only change is enough when the outbound mail already signs with the correct DKIM domain and Sender Hub only needs proof that you control that domain. A sender platform change is required when the outbound mail needs to sign with a different DKIM domain.
How DKIM alignment affects DMARC and BIMI
A passing DKIM signature authenticates its signing domain. DMARC also checks whether that domain matches the visible From identity. With relaxed DKIM alignment, the two domains share an organizational domain; strict alignment requires an exact match. These rules are defined in RFC 9989.
For a From address at marketing.example.com and signing domain cd.marketing.example.com, relaxed alignment normally succeeds under example.com. With adkim=s, that signature does not satisfy DKIM alignment because the names differ. The CFL domain remains cd.marketing.example.com in either case.
Example receiving-server authentication resultstext
Authentication-Results: receiving.example; dkim=pass header.d=cd.marketing.example.com header.s=selector1; spf=pass smtp.mailfrom=bounce.marketing.example.com; dmarc=pass header.from=marketing.example.com
DMARC passes when at least one authentication method, SPF or DKIM, both passes and meets its alignment requirement. Check dmarc=pass on a real Yahoo-delivered message before troubleshooting the logo. Publishing p=reject does not itself make a message pass. If several DKIM signatures exist, inspect each result: Yahoo evaluates all signatures and warns that mixed results across signatures that meet DMARC alignment do not guarantee a DMARC pass.
Why the BIMI logo is not showing
The common trap is expecting the BIMI lookup to follow the DKIM signing domain. It does not. BIMI uses the header From author domain first. If the user sees email from marketing.notcutts.co.uk, the default-selector lookup is default._bimi.marketing.notcutts.co.uk, even when the message is DKIM-signed by cd.marketing.notcutts.co.uk. If no BIMI record is found there, the receiver can check default._bimi.notcutts.co.uk as the organizational-domain fallback. If a BIMI-Selector header specifies a custom selector, check that selector at both locations.
Yahoo CFL
- Enroll the DKIM d= domain.
- Receive ARF complaint reports for reported mail.
- No reports arrive when the wrong signed domain is enrolled.
BIMI logo
- Start at the header From domain, with organizational-domain fallback when no BIMI record is found there.
- A brand logo appears when the mailbox provider chooses to show it.
- No logo appears despite technically valid DNS when reputation or cached data prevents display.
Illustrative BIMI and DMARC recordsdns
default._bimi.marketing.example.com. TXT "v=BIMI1; l=BIMI_SVG_HTTPS_URI; a=" _dmarc.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com" _dmarc.marketing.example.com. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
Replace BIMI_SVG_HTTPS_URI with the public HTTPS address of your logo. Use the SVG Tiny Portable/Secure profile (SVG Tiny PS); an ordinary SVG export is not sufficient. The logo must be square and must not depend on scripts or external resources. Check that Yahoo can fetch it without a login. The empty a= above is intentional for a setup without a certificate. If you include a Verified Mark Certificate (VMC), use its actual HTTPS certificate URL and confirm its validity and domain coverage.
BIMI readiness checks
A quick way to separate technical requirements from display conditions.
Ready
eligible for display
Message passes DMARC, both author-domain and organizational-domain policies meet BIMI rules, and the SVG Tiny PS logo is reachable. A certificate is valid when used.
Needs work
not eligible
Record exists, but DMARC, SVG formatting, selector, or certificate details need correction.
Display gated
provider decides
DNS is correct, but mailbox provider reputation, engagement, volume, or cache prevents display.
If the records are correct and the logo still does not show in Yahoo Mail, stop changing DNS and check the viewing context. Yahoo currently displays BIMI logos in the message list and read view of its Yahoo and AOL mobile apps, plus the desktop webmail read view. Absence from the desktop message list alone does not prove failure. Yahoo does not require a VMC, although it uses one as an eligibility signal when the BIMI record includes it. Sufficient sending reputation and engagement are still required.
After a record change, allow DNS and Yahoo's cached data to refresh, then test a newly delivered bulk message in a fresh webmail session with a cleared cache. A personal test message does not establish bulk-mail eligibility. If the requirements are met and the logo remains absent, follow the support instructions in the Yahoo BIMI FAQ and provide the From domain, full headers, record values, and logo URL.
Flowchart showing BIMI lookup and display checks from header From domain to logo display.
Why sp=none needs a separate BIMI check
The sp= tag is a subdomain policy. A DMARC record at marketing.example.com applies directly to marketing.example.com through p=. An sp=none tag in that record does not change its own p=reject. Under normal DMARC policy discovery, sp= on a non-organizational subdomain is ignored; it does not automatically govern deeper names such as news.marketing.example.com.
DMARC policy example with a BIMI warningdns
_dmarc.example.com. TXT "v=DMARC1; p=quarantine; rua=mailto:dmarc@example.com" _dmarc.marketing.example.com. TXT "v=DMARC1; p=reject; sp=none; rua=mailto:dmarc@example.com"
|
|
|
|---|---|---|
example.com | _dmarc.example.com | p=quarantine |
marketing.example.com | Its own DMARC record | p=reject |
news.marketing.example.com without its own record | Organizational-domain policy | p=quarantine in this example; the marketing sp tag is ignored |
A child with its own DMARC record | The child record | Its own p value applies |
DMARC policy application when example.com is the organizational domain.
What that means for BIMI
BIMI has additional policy checks. The BIMI draft validation rules reject sp=none in either the author-domain or organizational-domain record, even when the author domain has p=reject. Both domains need an enforcing DMARC policy. Remove sp=none or use an appropriate enforcing value after confirming legitimate subdomain mail authenticates correctly. The warning does not prove that the BIMI record is on the wrong domain.
RFC 9989 makes pct historic. The current BIMI draft still rejects quarantine records that explicitly contain pct below 100, so do not retain an old partial-enforcement value when preparing for BIMI.
A practical troubleshooting workflow
Use this order to avoid mixing Sender Hub enrollment, DNS verification, and BIMI display into one task. First prove which domains the message uses and whether DMARC passes. Then fix the Yahoo CFL enrollment. Next, validate BIMI under the visible From domain and its organizational-domain fallback. Last, review reputation and complaint signals instead of repeatedly changing working DNS records.
- Send a real message from the same campaign stream and save the full headers.
- Record the header From domain, envelope From domain, DKIM selector, and DKIM d= domain. Confirm the receiving server reports DKIM and DMARC results.
- Add the DKIM d= domain to Sender Hub, verify it, verify the reporting mailbox, and confirm active CFL enrollment.
- Check BIMI at the header From domain first, then confirm the intended organizational-domain fallback, both DMARC policies, the SVG Tiny PS logo, and any certificate.
- Process ARF complaints and review Sender Hub Insights before deciding the setup failed. A quiet reporting mailbox does not prove failure when no covered complaint has occurred.
For a broad check across DMARC, SPF, and DKIM, run a domain health checker before changing records. Check the DKIM selector separately, then use message headers to verify authentication. A domain DNS check alone does not confirm CFL enrollment or BIMI display.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
Suped's product supports this workflow through DMARC monitoring and SPF and DKIM diagnostics. Review reports for the sending stream to compare authentication results with the From and signing domains before changing policy. Use Yahoo Sender Hub to confirm CFL enrollment, and process ARF complaints through the reporting mailbox or sender platform.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
If the message passes SPF and DMARC but Yahoo still reports DKIM issues, compare the signed domain, selector, and authentication result in the headers before changing policy. Check the specific failure pattern described under Yahoo DKIM errors.
How to process ARF complaints and track the rate
Enrollment only creates the reporting path. Yahoo complaint reports use Abuse Reporting Format (ARF) with machine-readable metadata and the original message headers. Route reports to a monitored mailbox or automated processor, then match a message identifier or recipient identifier to your sending logs. Do not assume every report exposes the recipient address or contains the full message body.
- Stop further promotional mail to the identified complaining recipient across every list that uses the same consent.
- Log the campaign, sending stream, message identifier, and DKIM domain so repeated patterns are visible. Make complaint processing idempotent so duplicate reports do not repeat actions or inflate your internal counts.
- Validate the report's DKIM signature and expected Yahoo identity before an automated job changes subscriber data. Yahoo signs CFL mail with arf.mail.yahoo.com and uses feedback@arf.mail.yahoo.com as the envelope sender. A matching visible sender address alone is not authentication.
- Review consent source, audience age, message frequency, and segmentation when complaints cluster around one stream.
Sender Hub Insights is separate from CFL and does not require CFL enrollment. Under Dashboard, select a verified DKIM domain and click Activate. Allow 24 to 48 hours for data, and remember that Yahoo withholds daily data below an unpublished volume threshold. Insights shows delivered messages and spam complaint rate, rather than a complete inbox-placement or engagement report. Its complaint rate uses inbox-delivered messages as the denominator, covers Yahoo-managed domains, and is displayed in UTC. Keep the rate below Yahoo's 0.3% enforcement threshold. When one DKIM domain signs several streams, Insights rolls their data together, so retain campaign-level detail in your ARF processing.
CFL reports are not the complaint-rate denominator
Counting ARF messages against all messages sent will not reproduce Yahoo's rate. Use Sender Hub Insights for Yahoo's inbox-based rate and use ARF reports to suppress recipients and diagnose the affected stream.
Frequently asked questions
Enroll the DKIM d= domain. Yahoo sends ARF reports when mail signed by the enrolled DKIM domain is reported by a Yahoo user. Enrolling a parent domain does not automatically enroll a different signing subdomain.
Only when the current DKIM d= domain is not the domain you want Yahoo to associate with the mail. If the signature is already correct, verify and enroll that domain in Sender Hub. Changing only the selector does not change the CFL enrollment domain.
No. BIMI starts with the header From author domain and the applicable BIMI selector. If no BIMI record is found there, the receiver can fall back to that selector at the organizational domain. An explicit empty logo record stops fallback. The DKIM signing domain does not move the first BIMI lookup.
Treat it as a BIMI eligibility problem even when the sending subdomain has p=reject. The BIMI draft rejects sp=none in the author-domain or organizational-domain record. That is a separate check from the way DMARC applies p= to the sending domain itself.
Check that a real message passes DMARC, both domain policies meet BIMI rules, and the logo is reachable in SVG Tiny PS format. Bulk sending, reputation, engagement, and the Yahoo Mail view also affect display. Yahoo does not require a VMC, but it considers one when the record includes it. Retest after cached data refreshes in a fresh webmail session.
Authenticate the report, match it to your sending logs, and suppress the identified recipient from further promotional mail immediately. Then map the original message headers to the campaign and sending stream so you can correct consent, frequency, or audience problems.
