BIMI on self-hosted mail: logo, DMARC, and VMC

Brand Indicators for Message Identification (BIMI) lets supporting inbox providers display your logo beside authenticated mail. On self-hosted Stalwart, BIMI is not a Stalwart toggle—it is a chain of DMARC policy, a hosted SVG logo, DNS TXT records on each send subdomain, and for Gmail a purchased Common Mark Certificate (CMC) or Verified Mark Certificate (VMC). DarDev publishes BIMI for send.dardev.net, sales.dardev.net, and agents.dardev.net; CMC/VMC remains pending CA purchase.

This guide documents what DarDev deployed honestly—including what works today in Fastmail and Apple Mail versus what still requires a mark certificate for Gmail. Read why-send-dardev-subdomain for DMARC alignment context and inside-unified-mailer-stack for where mta.dardev.net serves assets.

Domains covered

• send.dardev.net — Listmonk and news@ company outbound; BIMI host default._bimi.send
• sales.dardev.net — sales outreach; default._bimi.sales
• agents.dardev.net — bot and automation SMTP; default._bimi.agents
• dardev.net org zone — default._bimi on root when DMARC sp= is quarantine or reject, not none

Each subdomain needs its own DMARC TXT at _dmarc.send, _dmarc.sales, or _dmarc.agents with p=quarantine or p=reject. BIMI without strict DMARC fails validation at providers that implement the spec. DarDev uses p=quarantine; pct=100; adkim=s; aspf=s on send subdomains after scripts/mail/fix-bimi-dmarc-dns.py alignment.

Logo asset requirements

BIMI requires SVG Tiny Portable/Secure profile—not a PNG in DNS, not a GitHub avatar, not a random CDN image. DarDev logo lives at bimi/dardev-logo.svg in the monorepo: 512×512 viewBox, circular dark background, cyan geometric D mark matching brand guidelines.

Public URL: https://mta.dardev.net/bimi/dardev-logo.svg served from /var/www/dardev-bimi/ on dardev-vps with nginx on mta.dardev.net. Mirror at https://news.dardev.net/bimi/ for editorial cross-linking only; authoritative BIMI l= tag points at mta.

DNS TXT record shape (pre-VMC)

Before a mark certificate exists, records publish logo URL only: v=BIMI1; l=https://mta.dardev.net/bimi/dardev-logo.svg; on default._bimi.send, default._bimi.sales, and default._bimi.agents in GoDaddy. Verify with dig +short default._bimi.send.dardev.net TXT and curl -sI on the SVG URL for 200 OK and image/svg+xml content type.

After CMC or VMC issuance, the a= tag adds the PEM chain URL—for example https://mta.dardev.net/bimi/dardev-cmc.pem—deployed by python scripts/mail/deploy-bimi-vmc.py. Full record becomes v=BIMI1; l=...; a=...; Gmail and Yahoo require the a= tag for inbox logo display.

Honest status table (June 2026)

• SVG Tiny PS logo on mta.dardev.net — done
• Mirror on news.dardev.net/bimi/ — done
• BIMI TXT on send, sales, agents — done
• DMARC quarantine with strict alignment — done
• CMC/VMC PEM in a= tag — pending CA purchase; cannot be issued in-repo

We do not claim Gmail inbox logos are live. Providers that show BIMI without mark certificates may display the logo sooner; Gmail documentation requires a Mark Certificate from an approved CA. Re-run python scripts/mail/complete-bimi-dardev.py after any DNS or asset change to keep automation idempotent.

Gmail inbox logo: manual CA step

1. Choose certificate type

   DigiCert Common Mark Certificate if you have 12+ months provable logo use on dardev.net without registered trademark; Verified Mark Certificate if trademarked.

2. Submit logo during validation

   Use bimi/dardev-logo.svg—the same file hosted on mta.dardev.net. Mismatched artwork fails CA review.

3. Save issued PEM

   Store chain as bimi/dardev-cmc.pem in repo secrets area; deploy to VPS—not committed if policy forbids.

4. Deploy and republish DNS

   python scripts/mail/deploy-bimi-vmc.py then confirm a= URL is reachable over HTTPS.

5. Send seed message

   From news@send.dardev.net or bot@agents.dardev.net to a Gmail account with BIMI enabled; allow 24–48h for logo cache.

Application field hints for CAs live in bimi/README.md in the monorepo—legal entity name, domain alignment, logo aspect ratio. Budget and lead time are measured in weeks, not hours; plan before a major product launch expects brand marks in inbox.

DMARC prerequisites operators miss

BIMI consumers check that DMARC passes with alignment on the From domain. Sending from news@send.dardev.net requires SPF or DKIM alignment on send.dardev.net, not root Zoho. Listmonk must use Stalwart SMTP with mail._domainkey.send published—see self-hosted-email-vs-saas for why misaligned SaaS relays break BIMI even when mail delivers.

Root dardev.net BIMI on default._bimi requires org DMARC with sp=quarantine or stricter—not sp=none. Zoho-hosted inbound can coexist if organizational DMARC policy is upgraded carefully with reporting first.

Stalwart-specific considerations

Stalwart does not host BIMI certificates inside the MTA database. You publish DNS and HTTPS assets like any self-hosted operator. Stalwart's job remains DKIM signing with selector mail on each outbound domain and presenting mta.dardev.net on SMTP HELO matching PTR.

agents.dardev.net participates in BIMI for programmatic senders—Cursor agents, automation bots—not Roundcube users. Logo consistency across send, sales, and agents reinforces brand even when traffic sources differ.

Verification checklist

1. dig +short default._bimi.send.dardev.net TXT — expect v=BIMI1 and l= URL
2. curl -sI https://mta.dardev.net/bimi/dardev-logo.svg — 200, correct content type
3. dig +short _dmarc.send.dardev.net TXT — p=quarantine or reject
4. dig +short mail._domainkey.send.dardev.net TXT — DKIM public key present
5. Send test to Yahoo, Apple, Fastmail seeds; Gmail after CMC deployed

Compliance and brand risk

BIMI is a trust signal, not a deliverability bypass. Poor list hygiene or cold outreach still lands in spam without a logo. VMC/CMC additionally binds logo use to verified trademark or proven brand history—do not submit third-party or stock artwork.

Aggregate DMARC reports remain the early warning for spoofing or misconfigured third-party senders before they poison BIMI eligibility. DarDev routes rua to dmarc@dardev.net monitored by ops.

Relationship to multi-subdomain mail

DarDev operates three Stalwart outbound subdomains plus Zoho inbound. Each outbound subdomain carries duplicate BIMI TXT shape with the same logo URL—a deliberate brand consistency choice. Per-subdomain DMARC and DKIM remain separate; a failure on sales.dardev.net does not automatically invalidate send.dardev.net BIMI if alignment on that From domain still passes.

Future product zones like send.hesabi.tn need their own BIMI and DMARC package if product mail should show Hesabi marks independently of DarDev corporate logo policy.

Troubleshooting common BIMI failures

Logo not appearing after DNS publish: wait TTL propagation (up to 48 hours), confirm HTTPS certificate on mta.dardev.net serves the SVG without redirect loops, and verify DMARC passes on a seed message before blaming BIMI TXT. dig returning old TXT often means GoDaddy API lag—re-run point-bimi-dardev-dns.py rather than hand-editing conflicting records.

Gmail shows authentication pass but no logo: almost always missing a= PEM. Do not purchase VMC until DMARC aggregate reports show stable quarantine compliance for two weeks—CAs ask for evidence of brand use and aligned mail history.

SVG validation errors at CA: re-export with SVG Tiny PS profile, square canvas, centered mark, no embedded raster images. DarDev bimi/dardev-logo.svg is the single source; forked marketing PNGs belong in newsletters, not BIMI DNS.