Build the identity map first

List every visible From domain and message stream. Add the customer-facing brand, legal owner, approved logo, DMARC policy domain, alignment path, BIMI assertion location, certificate type/issuer, and operational owner. Include sub-brands, regional marks, acquired companies, and white-label use.

Do not select a logo based only on the website reached from the message. BIMI follows the From identity and validated mark evidence. Legal owners must confirm rights for every logo/domain combination.

Choose between domain records and selectors

A default BIMI record at an organizational domain can be available to subdomains according to current BIMI discovery guidance. A subdomain can publish its own assertion when it needs distinct ownership or branding. If one From domain sends multiple logo-qualified streams, BIMI selectors plus the BIMI-Selector message header can express a preference, subject to provider support.

Prefer a separate brand From domain when that also improves recipient clarity and operational separation; do not create domains solely to work around certificate requirements. Prefer selectors only when the sender can reliably set and preserve the header and each mark has valid evidence.

Design the matrix

From domain Stream Selector Logo/evidence DMARC readiness Owner
news.example.com Main newsletter default Main mark Verified Brand A
news.example.com Seasonal campaign winter Approved variant Verify provider support Brand A
alerts.example.net Product alerts default Product mark Pending Brand B

These domains are illustrative. Add provider-specific acceptance and client observations as separate columns.

Validate each row

For every launch row, send fresh mail and confirm DMARC pass/enforcement, selected assertion, SVG profile, certificate chain and mark/domain scope, public HTTPS retrieval, and target-provider behavior. Test the default path as well as any selector. Do not infer that success for one From subdomain or provider covers another.

Govern changes

Connect rebrands, domain moves, certificate renewal, sender onboarding, and provider migration to this map. Retire message headers before removing selected records and keep rollback assets during caches. The multi-brand plan is complete when every production From identity resolves to a legally approved, technically valid, owned configuration—or is explicitly excluded without suggesting it has BIMI coverage.