Will a VMC work on a subdomain if the subdomain isn't explicitly listed in the certificate?
Published 28 Apr 2025
Updated 9 Aug 2026
11 min read
Summarize with
Updated on 9 Aug 2026: We clarified VMC subdomain coverage and BIMI selector fallback, including the DMARC policies required for logo display.
Yes, a VMC can work on a subdomain even when that exact subdomain is not written in the certificate. The listed base domain must be the registrable domain above the subdomain, and the subdomain must use the logo bound to that VMC. If the VMC covers example.tech, mail sent as edu.example.tech is normally inside that base-domain coverage.
The confusing part is that some validators report this like a normal TLS certificate hostname problem: x509 says the certificate is valid for the base domain, not the subdomain. That message can be misleading for BIMI, because a VMC is not used like a web server certificate. A VMC binds a sending domain to an organization and its logo for BIMI. It does not encrypt traffic and the applicant does not need a private key or CSR.
The fix is not automatically to buy a new VMC for every subdomain. First, check whether the intended BIMI DNS record is being discovered. Many setups keep the BIMI record on the organizational domain so subdomains inherit it, then publish a subdomain record only when that subdomain needs a different logo, selector, certificate reference, or explicit declination.
The short answer
A subdomain does not need to be explicitly listed in a VMC when its registrable base domain is already listed and the same certified logo applies. The DigiCert FAQ states the practical rule clearly: sending domains need to be listed, but subdomains are covered by the base domain.
Rule of thumb
If your VMC covers example.tech, you normally do not need a separate certificate entry for mail.example.tech, edu.example.tech, or billing.example.tech. If you also send as example.co.uk, that is a different base domain and must be added to the VMC request, commonly as a SAN when the same logo applies.
The part that still needs care is BIMI record discovery. The BIMI Group FAQ describes the usual setup: publish a default BIMI record at the organizational domain so subdomains can inherit it, and publish a subdomain record only when that subdomain needs its own record.
- Certificate scope: The VMC can cover subdomains under the listed registrable base domain.
- BIMI lookup: Receivers check the visible From domain and the requested selector, then use the BIMI record discovered through that path.
- DMARC gate: BIMI requires DMARC to pass and the applicable policies to be at enforcement.
- Provider decision: Mailbox providers decide whether the logo appears after the technical checks pass.
Why the x509 error appears
The error usually comes out of a generic certificate validation path. In ordinary TLS, a certificate for example.tech does not automatically match edu.example.tech unless the certificate also contains that subdomain or a valid wildcard. That web-certificate rule is familiar, so many libraries report a plain hostname mismatch.
BIMI VMC validation has a different goal. It checks whether the certificate is valid for the domain identity used by BIMI and whether the referenced logo matches the logo bound into the certificate. A plain TLS-style hostname error is not proof that a subdomain falls outside a base-domain VMC, so inspect the BIMI record and certificate path before reissuing it.
TLS hostname thinking
- Exact host: The validator expects the exact DNS name in the certificate.
- Wildcard rule: A wildcard covers only the allowed host depth for web TLS.
- Wrong model: This can misread a VMC as if it protects a web endpoint.
BIMI VMC thinking
- Base domain: A listed registrable base domain can cover its subdomains for VMC use.
- Logo binding: The SVG referenced in DNS must match the certificate evidence.
- Record path: The receiver uses the selector-specific BIMI record it discovers for the sender domain.
How BIMI discovery affects subdomains
For a message using edu.example.tech in the visible From address, a receiver first looks for the selected BIMI record at the subdomain. If it finds a valid record there, that record overrides the organizational-domain record for the same selector. If it does not find one, the receiver looks for that selector at the organizational domain. That inheritance pattern is why a single parent record often solves the same-logo, same-VMC case.
This is also why removing an unnecessary subdomain record can make a failing test pass. It does not make the VMC cover less. It makes the receiver use the parent-domain BIMI record, which can remove a stale SVG URL or certificate reference from the path. For more detail on this inheritance question, see root BIMI inheritance.
Parent BIMI record inherited by subdomainsDNS
default._bimi.example.tech. TXT "v=BIMI1;" " l=https://assets.example.tech/logo.svg;" " a=https://assets.example.tech/vmc.pem"
Subdomain BIMI record when you need an overrideDNS
default._bimi.edu.example.tech. TXT "v=BIMI1;" " l=https://assets.example.tech/edu.svg;" " a=https://assets.example.tech/vmc.pem"
Flowchart showing BIMI lookup moving from subdomain record to parent record and VMC validation.
Multi-level subdomains add another place to make mistakes. A default record at default._bimi.example.tech can cover lower subdomains that use the default selector, but a custom selector follows its own path. If a message requests education, the receiver checks education._bimi.edu.example.tech and then education._bimi.example.tech. It does not switch to default._bimi.example.tech. Check multi-level BIMI before changing the certificate.
How selectors change the answer
A BIMI-Selector header lets a message request a named BIMI record instead of default. The visible From domain still controls the lookup domain. For mail from edu.example.tech, the header below sends the receiver to education._bimi.edu.example.tech, with fallback to education._bimi.example.tech when the subdomain record does not exist.
BIMI-Selector header for an education logoEmail header
BIMI-Selector: v=BIMI1; s=education;
Selectors choose records, not certificate coverage. One VMC can cover multiple domains and subdomains that use the same logo, but a mark certificate binds only one logo. A distinct logo therefore needs its own VMC or CMC matched to its SVG through a selector record.
- Same logo on subdomains: Use one VMC and let the organizational-domain record handle inheritance.
- Same logo with a custom selector: Publish that selector at the subdomain or organizational domain and reference the same VMC.
- Different logo: Use a separate mark certificate and a selector record that points to the matching SVG and certificate.
- Different base domain: Add that base domain to the certificate request, often as a SAN when it uses the same logo.
How to troubleshoot the setup
Start by listing every visible From domain used by the mail streams. Then decide whether each stream needs its own BIMI record. If the same logo and VMC apply everywhere, the cleanest setup is often one organizational-domain BIMI record and no duplicate records on the subdomains.
Do not over-correct the certificate
Buying or reissuing a VMC with every subdomain listed is usually unnecessary when all subdomains are under the same registrable base domain and use the same logo. Check BIMI DNS discovery, certificate hosting, SVG equality, and DMARC policy first.
- Inventory senders: List every visible From domain used for marketing, product mail, receipts, or internal notifications.
- Check DMARC: Confirm each stream passes DMARC through aligned SPF or DKIM and has the required enforcement policy.
- Trace the selector: Read the BIMI-Selector header and query that selector at the visible From domain, then at the organizational domain.
- Simplify BIMI: Keep the parent record when all streams use the same logo and certificate.
- Retest fresh mail: Send a new message after DNS has propagated because cached BIMI results can preserve stale failures.
A domain-wide check helps separate BIMI certificate noise from authentication problems. Suped's domain health check checks the DMARC policy together with SPF and DKIM results so the VMC warning can be investigated alongside the sending domain's authentication state.
?
What's your domain score?
Deep-scan SPF, DKIM & DMARC records for email deliverability and security issues.
After that, test the specific message path. The visible From domain, DKIM signing domain, SPF return-path domain, DMARC policy, BIMI selector, SVG URL, and VMC URL need to be read together. One broken part can stop the logo even when the certificate itself is acceptable.
Where DMARC fits
BIMI sits on top of DMARC. The organizational domain and the visible From domain need a strong DMARC policy. A policy of p=none does not qualify. Use p=quarantine with pct=100 or use p=reject. For subdomain mail, an applicable sp=none policy prevents BIMI processing.
DMARC policy readiness for BIMI
The organizational domain and visible From domain must meet the applicable enforcement threshold.
Monitor only
p=none
Useful for discovery, but it does not qualify for BIMI processing.
Partial quarantine
p=quarantine; pct<100
A quarantine policy below full percentage does not qualify.
Full enforcement
quarantine at 100 or reject
Use full quarantine or reject on each applicable DMARC policy.
Suped's DMARC monitoring shows which sender streams pass alignment and which subdomains still rely on a monitoring or ineffective inherited policy. That evidence supports controlled policy changes before BIMI is retested.
DMARC record detail view showing SPF, DKIM, DMARC, rDNS diagnostics, and DNS records
For a VMC subdomain problem, that workflow matters because the visible symptom can be a certificate warning while the cause sits in BIMI DNS, DMARC policy staging, alignment, a missing DKIM signature, or one sender stream. Suped's hosted DMARC can reduce DNS-change friction when several subdomains share one parent-domain rollout.
To validate the current DNS policy before changing BIMI, run a DMARC check. For many domains or client domains, hosted DMARC keeps staged policy changes in one workflow instead of requiring a manual TXT edit at every step.
Decision table for VMC subdomain cases
Use this table to decide whether to change BIMI DNS, change the certificate request, or leave the certificate alone.
|
|
|
|---|---|---|
Subdomain, same logo | Covered by base domain | Use parent BIMI |
Different base domain | Needs certificate entry | Add domain or SAN |
Different logo | Needs separate certificate | Add selector and certificate |
Expired VMC | Fails | Renew certificate |
DMARC at none | Does not qualify | Enforce DMARC |
Common VMC and BIMI subdomain decisions
Expiration is easy to overlook because the BIMI DNS record can stay unchanged while the hosted PEM becomes invalid. Keep renewal ownership clear, and review VMC expiry checks before the certificate expires.
When to keep subdomain BIMI records
- Different brand: A product line, school, region, or business unit needs its own approved mark and certificate.
- Different selector: A stream intentionally chooses a non-default BIMI selector in message headers.
- Different control: A subdomain owner needs independent change control for logo and certificate URLs.
- Explicit exclusion: A subdomain publishes a valid declination record for the selected name to stop inheritance and suppress BIMI processing.
Views from the trenches
Best practices
Keep the parent BIMI record authoritative when subdomains share the same logo and VMC.
Validate the visible From domain, DMARC policy, SVG URL, and PEM URL as one path.
Document which subdomains inherit BIMI and which ones intentionally override the parent.
Common pitfalls
Treating a VMC like a normal TLS cert leads teams to list needless subdomain names.
Duplicating BIMI records on every subdomain increases drift and stale certificate links.
Testing cached messages after DNS changes makes old BIMI or VMC failures look current.
Expert tips
Work the BIMI discovery path by hand before paying to reissue a certificate too early.
Use subdomain BIMI for a distinct logo, named selector, independent control, or decline.
Track VMC renewal dates with the same ownership model used for DMARC policy changes.
Marketer from Email Geeks says a parent BIMI record can be the right fix when subdomains share the same VMC.
2025-01-09 - Email Geeks
Marketer from Email Geeks says a subdomain not listed in the VMC does not automatically mean the certificate is wrong.
2025-01-09 - Email Geeks
The practical answer
A VMC for the registrable base domain can work for subdomains under that base domain even when the subdomain is not explicitly named in the certificate. Do not reissue the certificate only because a checker prints a TLS-style hostname mismatch.
Verify the base domain in the VMC, trace the selected BIMI record, simplify DNS so the organizational-domain record is inherited where appropriate, confirm the SVG and PEM files are publicly reachable over HTTPS, and enforce DMARC for the organizational domain and visible From domain. Add another base domain to the VMC when it is truly separate. Obtain another mark certificate when a different logo is required.
For teams splitting mail streams across many subdomains, Suped's product shows which domains pass authentication, which ones still need policy work, and where DNS or sender configuration blocks BIMI readiness.
