BIMI after forwarding, mailing lists and email gateways

Draw the actual route to the recipient

Start with a concrete route, such as your newsletter platform → a distribution list → a recipient’s mailbox. Compare that with a copy delivered directly to an account you control. Keep the sender, content and timing similar so the intermediary is the main difference under investigation.

Record any gateway that adds disclaimers, changes subject lines or rewrites the visible sender. The receiving application may look identical in both tests even though the messages took different routes.

Identify which evidence changed

Google’s forwarding guidance explains that forwarded mail often fails SPF and that modifications to signed headers or content can break DKIM. A direct message passing authentication does not establish the result of the forwarded copy.

Compare the final receiver’s authentication results, the visible From identity and the DKIM signing domain. Keep the original message source files if your tools allow it. Screenshots of the sender row alone cannot show whether the relevant identity or signature changed.

Understand what ARC can and cannot establish

The BIMI protocol draft allows a receiver to consider a trusted ARC chain or other local policy when handling authentication. This is optional receiver behaviour in a work-in-progress specification, not a promise that every forwarded message keeps its logo.

Ask the operator of the intermediary which changes it makes and what authentication information it preserves. Keep the questions about message handling separate from questions about DNS publication. Changing a working logo URL will not repair a signature broken later in the delivery path.

Create a useful escalation packet

• The direct and indirect routes, with timestamps.
• Redacted source headers from both received copies.
• The authentication result and visible From domain for each.
• Any known rewriting or footer insertion at the intermediary.
• The recipient provider, application and observed logo result.

Use the packet to ask a focused question of the forwarding or gateway operator. Do not weaken domain-wide authentication merely to make one indirect route look like a direct delivery. Test an agreed fix on that route and retain the comparison.