BIMI (Brand Indicators for Message Identification) can show your logo beside the From name in Gmail, Yahoo, Apple Mail, and Fastmail—but only after DMARC enforcement reaches quarantine or reject on the sending domain. Monitoring mode with p=none or subdomain policy sp=none blocks BIMI even when SPF and DKIM pass. DarDev enforces DMARC quarantine on every Stalwart outbound subdomain before publishing BIMI TXT records at GoDaddy.
This is compliance architecture on the Unified Mailer stack documented in inside-unified-mailer-stack. Product mail exits send.dardev.net, sales outreach uses sales.dardev.net, and automation SMTP uses agents.dardev.net—all three share one MTA at mta.dardev.net but carry independent SPF, DKIM, DMARC, and BIMI DNS. Root @dardev.net stays on Zoho for staff inbox; BIMI for outbound channels does not replace Zoho authentication on the corporate domain.
What BIMI requires beyond SPF and DKIM
Receivers already expect aligned SPF and DKIM before they trust bulk or transactional mail. BIMI adds a visible brand layer: a small logo fetched from a URL in a DNS TXT record at default._bimi.{domain}. The specification and major inbox providers additionally require a DMARC policy that actually protects the domain—typically p=quarantine or p=reject with pct=100—not a passive p=none report-only posture.
For organizational mail on dardev.net, BIMI DNS lives at default._bimi with _dmarc at the root. The subdomain policy sp= must be quarantine or reject; sp=none is a common mistake that passes DMARC aggregate reports but fails BIMI eligibility checks. DarDev automated fix scripts set sp=quarantine alongside per-subdomain _dmarc.send, _dmarc.sales, and _dmarc.agents records.
- SPF TXT authorizing the VPS IP on each send subdomain
- DKIM selector published after Stalwart domain onboarding
- DMARC TXT with p=quarantine; pct=100; adkim=s; aspf=s
- BIMI TXT with v=BIMI1 and l= pointing at hosted SVG logo
- Optional a= URL for Mark Certificate (CMC/VMC) — required for Gmail logo
DarDev domain coverage
Three Stalwart outbound identities each get paired DMARC and BIMI hosts on GoDaddy. send.dardev.net uses default._bimi.send and _dmarc.send for Listmonk product mail and warm-up newsletters. sales.dardev.net carries CRM-orchestrated outreach such as 20.tn school intros. agents.dardev.net is SMTP-only for bots and CI—no webmail, but the same authentication bar applies because receivers do not distinguish automation from human senders at the protocol layer.
Why quarantine before BIMI matters for outreach: a school director who sees your logo in Gmail infers institutional legitimacy. Showing that logo without enforced DMARC would train users to trust visual branding that spoofers could imitate on lookalike domains. Quarantine policy tells receivers to park suspicious mail while legitimate Stalwart-signed messages still deliver—tight enough for BIMI, softer than reject during early rollout.
Logo asset and hosting
DarDev publishes a single SVG Tiny PS logo at bimi/dardev-logo.svg in the monorepo. Production URL is https://mta.dardev.net/bimi/dardev-logo.svg served from /var/www/dardev-bimi/ on dardev-vps with nginx on the MTA host. A mirror at news.dardev.net/bimi/ exists for redundancy. BIMI records reference the mta hostname in the l= tag—not GitHub avatars, random CDNs, or PNG files, which major providers reject.
The logo is a 512×512 circular dark field with a cyan geometric D matching DarDev brand marks elsewhere. Consistency across web, news, and inbox reduces confusion when recipients click through from a tracked outreach message to the product site.
Automation scripts operators run
- python scripts/mail/fix-bimi-dmarc-dns.py — set DMARC quarantine and BIMI TXT on GoDaddy in one pass
- python scripts/mail/setup-bimi-dardev.py — deploy SVG to VPS, patch nginx, publish DNS via API
- python scripts/mail/complete-bimi-dardev.py — re-run full pipeline after logo or record changes
- python scripts/mail/deploy-bimi-vmc.py — after CA issues PEM, update a= tag in BIMI TXT
Verification commands stay boring on purpose: dig +short default._bimi.send.dardev.net TXT and curl -sI on the logo URL confirm DNS and HTTPS before you send a test message to a BIMI-capable personal inbox. Aggregate DMARC reports to dmarc@dardev.net surface alignment gaps when a new template changes Return-Path or From.
Current rollout status
As of June 2026 the automated pipeline reports: SVG hosted on mta and mirrored on news, BIMI TXT live on send / sales / agents, and DMARC quarantine with strict alignment flags deployed. The remaining manual step is purchasing a Common Mark Certificate or Verified Mark Certificate from a public CA—DigiCert CMC or SSL.com CMC are documented paths when no registered trademark exists.
Gmail specifically requires the a= tag pointing at a PEM chain served over HTTPS on the same infrastructure as the logo. Until dardev-cmc.pem is issued and deployed, Yahoo and some Apple Mail clients may show the logo while Gmail shows only authenticated mail without the brand mark. That gap is expected—not a misconfiguration of quarantine policy.
Relationship to outreach and marketing lists
BIMI is not permission to mail cold lists. Tracked transactional outreach for 20.tn still flows through CRM approval and consent gates in crm-driven-product-lists. DMARC quarantine protects your domains when a template misbehaves or a list sync goes wrong—it does not replace UNKNOWN consent on import. Sales staff sending one school at a time benefit from inbox branding only when authentication already passes; complaint rate still governs reputation.
Three-outbound-domains-send-sales-agents explains why product, sales, and agents channels stay isolated at the DNS layer even on one IP. BIMI per subdomain lets outreach mail show the same DarDev mark without conflating complaint signals from high-volume newsletters on send.dardev.net.
Ordering work for a new send subdomain
- Register domain in Stalwart Management → Domains and export DKIM TXT
- Publish MX, SPF, DKIM on GoDaddy for the new label
- Set _dmarc.{label} to quarantine before any bulk or TX volume
- Host or reuse SVG; publish default._bimi.{label} with l= URL
- Send test mail; review DMARC aggregate; then pursue CMC if Gmail logo is required
- Only after stable alignment, increase outreach volume on sales or send identity
Skipping straight to BIMI TXT while DMARC remains p=none produces green checkmarks in internal slides and red silence in recipient inboxes. Quarantine first is the prerequisite—not an optional hardening step for later.
Can we use BIMI with DMARC p=none?
No for production BIMI display. Major providers require enforcement policy quarantine or reject on the From domain or organizational policy. Monitoring-only DMARC may collect reports but will not unlock inbox logos.
Does Zoho mail on @dardev.net need the same BIMI setup?
Org-domain BIMI at default._bimi is separate from send/sales/agents subdomains. Staff inbox on Zoho uses Zoho SPF/DKIM; outbound product and outreach mail must authenticate on Stalwart subdomains described in inside-unified-mailer-stack.
Why quarantine instead of reject?
Quarantine lets misaligned forwarders and legacy forwards surface in reports without hard bounces during migration. pct=100 still applies full policy to aligned mail streams. Reject is viable once aggregates stay clean for months.
What breaks BIMI after it worked?
Logo URL downtime, SVG format drift, DMARC accidental revert to p=none, or From domain changes that stop DKIM alignment. Re-run fix-bimi-dmarc-dns.py after DNS edits in GoDaddy.
Is BIMI required for 20.tn outreach?
No. Outreach requires CRM consent discipline and tracked transactional sends. BIMI is a trust and branding enhancement once authentication is already correct—not a substitute for one-school-at-a-time approval.
