1. Define the From domain and target providers

Choose the actual From domain your messages use. A website domain and a sending subdomain are not automatically the same implementation target. List the providers that matter to your audience, then check their current BIMI and evidence-document requirements.

Do this before buying a certificate. Provider acceptance and logo treatment vary; a checklist should name its coverage rather than imply a universal display promise.

2. Verify the authentication foundation

Review the domain’s DMARC posture and fresh message evidence against the applicable BIMI/provider requirements. A policy change can affect legitimate mail, so inventory senders and use an approved change process. A branding project is not a reason to rush enforcement.

Keep observations for the exact sending service and domain. Passing a test from a different platform will not establish readiness for the service used by your campaign.

3. Review the assertion and assets

Inspect the relevant BIMI selector record, commonly the default selector. This is an illustrative record shape only, with non-production URLs:

default._bimi.example.com
v=BIMI1; l=https://example.com/logo.svg;
        a=https://example.com/evidence.pem

Have the logo checked against the required SVG profile, and review any required evidence document and its validity. Verify HTTPS availability and stable hosting. Never assume any arbitrary SVG is acceptable or that a public logo URL authorizes unrestricted server-side fetching.

4. Capture provider observations

Send authorized test messages through the actual platform and inspect supported receiving mailboxes. Record the provider, date, From domain, selector, and visible outcome. If the logo is missing, work through the provider’s documented criteria before repeatedly changing the record.

Store renewal ownership and an asset-change checklist with the launch evidence. A future logo or certificate change needs the same careful review as the initial setup.

Before you move on

  • Target providers and coverage listed.
  • Authentication readiness reviewed.
  • SVG/evidence requirements checked against current guidance.
  • Logo display observed rather than promised.