Decide whether selectors are justified

Use selectors when one visible From domain legitimately needs different approved logos for distinct streams or brands. If brands use separate From domains, domain-level default records may be clearer. Every logo can need its own evidence document because certificate evidence is tied to a mark.

Create an ownership table with From domain, stream, selector, logo checksum, evidence document, sending system, and approving brand/legal owner. Avoid campaign staff inventing selector names without DNS and certificate governance.

Publish one assertion per selector

The default record uses default._bimi.example.com. A selector named offers uses:

offers._bimi.example.com TXT "v=BIMI1; l=https://assets.example.com/offers.svg; a=https://assets.example.com/offers.pem"

The domain and URLs are illustrative. Validate each record and its assets independently. Do not point multiple selectors at certificates that do not cover the corresponding image.

Add the message signal

The sender requests a selector with a header in this form:

BIMI-Selector: v=BIMI1; s=offers;

Insert it through the authorized sending platform before final delivery. Preserve it through any gateway and inspect the original received message. Do not trust a template preview that omits outbound header processing.

The visible From domain and selector together determine the lookup. DKIM selectors are unrelated even if names happen to match.

Test fallback and support explicitly

Current BIMI Group guidance notes that selector support can vary by mailbox provider. Build a provider/client matrix. Send fresh aligned messages for the default and alternate selector, verify DNS and assets, and record whether the expected mark is displayed. A provider may ignore the header, apply its own eligibility rules, cache an older image, or show no BIMI logo.

Do not promise that default will always be used when a requested selector is unsupported or invalid without checking the current specification and provider behavior. Define your acceptable fallback from observed evidence.

Operate the selector set

Include selectors in certificate renewal, asset monitoring, sender migrations, and incident response. Retire headers before removing their assertions, then observe caches and traffic. The design is ready when every sent selector maps to an approved, retrievable, valid asset set and unsupported-provider behavior is documented rather than guessed.