How to implement BIMI on a subdomain without affecting the main domain or transactional emails?
Summary
What email marketers say9Marketer opinions
Email marketer from Reddit User shares that you need to create a separate BIMI record for your subdomain in the DNS settings. Ensure you do not affect the main domain's existing BIMI record (if any).
Email marketer from Email Geeks User explains you need to set up a subdomain or implement the logo as a profile picture for those addresses. They also state you can't take it away from the main email and still have it for transactional emails.
Marketer from Email Geeks explains if the BIMI Assertion record is published in DNS at `selector._bimi.X`, then the VMC SAN dNSName must contain either `X` or `selector._bimi.X` in order to validate.
Email marketer from Stackoverflow User states the BIMI DNS record must be deployed in the DNS of sending email domains or subdomains, in order to work properly and not affect the main domain.
Marketer from Email Geeks shares an example of how their company setup BIMI on a subdomain. They setup a BIMI record at the subdomain, and not at the org domain.
Marketer from Email Geeks explains the BIMI record should be set up for the subdomain only and the VMC needs to be valid for both the org domain and subdomain.
Email marketer from Valimail Blog shares that implementing BIMI on a subdomain requires creating a BIMI DNS record specifically for that subdomain. This ensures that only emails sent from the subdomain will display the BIMI logo, leaving the main domain unaffected.
Email marketer from OnlyMyEmail shares that BIMI impacts your entire domain, but to prevent that from happening, it is recommended to set BIMI up for subdomains or utilize a new domain.
Email marketer from Agari states you should consider the domain alignment implications of implementing BIMI. Ensure that your subdomain is properly aligned with your DMARC policy to maintain deliverability.
What the experts say5Expert opinions
Expert from Word to the Wise explains that When implementing BIMI on a subdomain, make sure that the subdomain has its own valid DMARC policy in place. This is essential to ensure that the BIMI implementation works correctly and doesn't negatively affect the overall email authentication posture of the main domain or the transactional emails.
Expert from Spam Resource explains that to implement BIMI on a subdomain without affecting the main domain, you need to ensure the BIMI record is specifically created and deployed for the subdomain only. This involves configuring DNS records to point to the logo and VMC (if used) associated with the subdomain.
Expert from Email Geeks suggests moving the BIMI record to the subdomain as a fix, confirming that the VMC linked in that BIMI record can still be for the org level.
Expert from Email Geeks advises that for transactional emails, you either have to move the BIMI record to that subdomain, set up a new subdomain, or implement the logo as a profile picture for that one address (which will only work on Gmail).
Expert from Email Geeks shares that BIMI protocol doesn’t have a way to specify which addresses should get logos, meaning any mail with the authenticated domain may display the logo.
What the documentation says3Technical articles
Documentation from BIMI Group Website explains that BIMI records are placed in DNS at either the organizational domain (e.g., example.com) or a subdomain (e.g., email.example.com), depending on the scope of application. To avoid affecting the main domain, place the BIMI record on the subdomain.
Documentation from Entrust explains that setting up BIMI on a subdomain without affecting your main domain requires you to configure your DNS records by adding a BIMI record to your subdomain. Make sure that your BIMI record includes the location of your logo and the location of your VMC. VMC is optional but is needed for Gmail and Yahoo.
Documentation from Digicert explains that if using a VMC, ensure it is valid for both the organizational domain and the subdomain, if required. You can request for both domains in the certificate or just for the higher level domain.