The direct answer
Use stable public HTTPS URLs that receivers can fetch without signing in. DNS points to the assets; it does not store the SVG artwork or certificate file itself.
Can I use my website or a CDN?
A suitable website or CDN can serve the files if it meets the receiver’s requirements. Choose a stable location and test the actual response. A sharing page, expiring download link or login-protected folder is unsuitable for unattended receiver access.
Security middleware can also interfere: a browser challenge may look harmless to a person but prevent an automated fetch. Test the files independently of your normal logged-in browsing session.
Who should maintain the URLs?
Assign an owner who knows that these files are email infrastructure. Include them in availability checks and website migration plans so a routine asset clean-up does not remove them.
Store the certificate expiry date and replacement process with the hosting details. When changing files or URLs, validate the new assets and repeat a real-message test. Keep the public URL free of credentials and temporary access tokens.
Sources & further reading
Provider guidance checked on . Requirements can change; check the original guidance when implementing. Planning checklists and examples are BIMI World’s editorial suggestions.