Choose a durable public origin

Use a hostname owned by the organization or an approved asset provider with clear renewal and incident ownership. The URLs in l= and a= should remain stable through website redesigns. Avoid session-dependent paths, signed short-lived links, query-heavy application routes, and hosts that redirect according to cookies or geography.

Serve a valid public TLS chain and HTTPS only. Return the SVG with Content-Type: image/svg+xml and the evidence document with the type expected by current BIMI/provider guidance. Keep files small and provide deterministic responses.

Remove accidental blockers

Review CDN and web-application-firewall rules for user-agent filtering, hotlink protection, IP allowlists, rate limits, bot challenges, geo blocks, and forced download behavior. Providers fetch from infrastructure you do not control; a rule that works for an employee browser may block them.

Allow only the narrow public asset paths instead of weakening controls across the site. Monitor status, TLS expiry, content type, size, and checksum from an external controlled probe. Do not log full query credentials because these URLs should not require any.

Validate content without network surprises

SVG is XML. Your publication pipeline and BIMI checker should disable external entities, scripts, remote references, and network resolution; enforce the SVG Tiny P/S profile; bound parse depth, time, and size; and render only in a sandbox when visual QA is needed.

If Deliverlens or another service validates a user-submitted BIMI URL, it must prevent server-side request forgery: allow HTTPS, resolve and reject private/reserved destinations, recheck every redirect, pin or revalidate resolved addresses, and cap redirects, bytes, and time. A browser-side fetch is not a safe substitute and can leak user information.

Plan cache-safe changes

Prefer versioned asset URLs when a certificate/logo pair changes, update and validate the new files first, then change DNS. Record HTTP cache headers and DNS TTL. Keep the old pair available through the planned transition and rollback window.

Verify from message to asset

Send a fresh aligned message, confirm the selected BIMI record, fetch exact bytes externally, validate their checksums, and observe named provider/client behavior. The hosting layer is ready when providers can retrieve the approved files reliably and your own validation process cannot be abused to fetch arbitrary internal resources.