Option 2 · The direct route
Prepare for BIMI and apply to a CA directly.
If you choose the direct route, use the steps below to get your domain, logo, and evidence ready. Submit your VMC or CMC application to a certificate authority (CA), complete its checks, then publish your BIMI record after issuance.
- Assign owners before touching DNS.
- Validate each prerequisite independently.
- A launch is complete only when there is a maintenance plan.
1. Define the scope
Write down the visible From domains, the systems that send from them, and the providers your audience uses. Pick a manageable first domain. Assign an email owner, DNS owner, brand contact, and certificate contact.
Your deliverable at this stage is a domain-and-sender list, not a DNS change. Use the readiness assessment to identify the next missing piece.
2. Get authentication ready
Check real messages from every legitimate service and review DMARC reports. Resolve alignment issues before moving to quarantine or reject. Confirm the applicable organisational and subdomain policies meet current BIMI requirements.
Keep a record of the change, who approved it operationally, and how you will monitor legitimate delivery. Our authentication guide explains the moving parts.
3. Approve and validate the artwork
Get the final logo from your brand team. Prepare the Tiny PS file, check small-size readability, and validate the profile. Freeze the approved artwork for the certificate application and hosting handoff.
4. Apply directly to a certificate authority
Choose a VMC or CMC based on your mark’s eligibility and the providers you want to reach. Confirm the issuer’s requirements, domain coverage, fees, and renewal terms. Gather your approved logo, organisation details, domain-control information, and the mark evidence the issuer requests.
Compare certificate authorities and published prices, then submit the application directly through your chosen CA’s process and complete its validation checks. Wait for the issued certificate and public PEM chain before moving on to publication. A submitted application is not an issued certificate.
Explore the BIMI Group’s certificate issuer directory ↗ and confirm acceptance with your target mailbox providers.
5. Host the files, then publish DNS
Make the SVG and any issued public PEM chain available over HTTPS. Test the exact URLs without authentication. Next, publish the BIMI TXT record and verify the result through DNS.
Preserve the previous record value and asset version in your change notes. This makes later troubleshooting much easier.
6. Test the full path
Send representative mail to controlled accounts at target providers. Record the timestamp, sending service, recipient app, authentication result, and observed logo. Test both marketing and transactional streams if they use different infrastructure.
If a logo is absent, work through the troubleshooting guide in order. Avoid changing several unrelated settings at once.
Your launch checklist
Tick off the work as you go. This checklist stays on this page for the current visit; use Print to keep a copy.
0 of 8 complete
Go to the source
Provider policies and specifications can change. These primary sources informed this guide, reviewed on 1 November 2026.