[ BIMI & brand ]

BIMI after a company rebrand or acquisition

Treat a rebrand or acquisition as a review of brand rights, sending identities, certificate coverage and public assets, not merely a logo-file replacement.

By the EmailAuth research team · 3 min read

[ Key points ]

  • Treat a rebrand or acquisition as a review of brand rights, sending identities, certificate coverage and public assets, not merely a logo-file replacement.
  • A new SVG does not resolve changed brand rights or certificate coverage.
On this page

A rebrand or acquisition can change the legal organisation, the approved mark, sending domains and the people authorised to manage certificates. Updating an SVG file alone may leave those relationships inconsistent. Start with an inventory of what actually changes, then coordinate a controlled transition that preserves email authentication independently of the visual brand launch.

Identify the change boundary

List old and new legal names, mark owners, logo versions, sending domains, providers, certificate records and hosting accounts. Separate a visual refresh under the same rights from an acquisition that changes ownership or licensing. Ask the issuer which evidence is required for the specific transition. Do not infer trademark rights from possession of a DNS account or treat a purchase agreement as a certificate automatically recognised by receivers.

DigiCert's request workflow includes organisation validation and verified-contact approval. Use that as a concrete example of why certificate administration may need updating during a transaction. The appropriate issuer, legal adviser and authorised organisational contacts must resolve the actual rights and representation questions.

Keep authentication and branding work separate

Map each visible From domain to its mail systems. A new brand domain needs its own operational readiness checks, including legitimate sender inventory and DMARC outcomes. Do not move customer billing traffic merely to obtain a new logo before the replacement identity works reliably. Preserve records of current mail routes and authentication results so a branding issue is not mistaken for a mail-delivery problem.

Prepare the new SVG and any certificate material as a coordinated set. Keep the proposed asset URLs stable during testing. Review access to old hosting accounts, DNS zones and issuer accounts before staff departures. A domain still used for receipts or support replies needs a named owner even if marketing has stopped advertising it.

Rehearse a two-brand transition

Consider the fictional acquisition of branch.example by example.com. Branch continues sending support messages under branch.example during a transition, while a new campaign uses example.com. The release worksheet contains two distinct rows, with an approved logo, certificate coverage, DNS assertion and responsible owner for each identity. Mark rights and receiver eligibility remain approval fields, not assumptions derived from corporate ownership.

The negative test assigns the new parent logo to the branch row while retaining certificate material associated with the old branch logo. The worksheet must flag the inconsistent asset set for review. This is a synthetic consistency test, not a cryptographic validator or legal opinion. The repair is to obtain an approved, mutually consistent set rather than changing file extensions or suppressing validation errors.

Sequence the launch and the retirement

Publish reviewed assets and verify their public retrieval before changing assertions. Send authorised tests from each actual mail system to the selected receivers, recording message identity, date, client and result. BIMI Group's implementation guide notes that receiving providers determine their own display criteria; do not promise a simultaneous visual switch across all inboxes.

Retire an old brand only after identifying residual mail flows, certificate obligations and domain-retention requirements. Do not delete old infrastructure solely because the new website is live. The exit record should say which identities remain active, which assets were replaced and which observations are still missing. No real brand transfer, issuer request or receiver test was performed here; the transition plan is illustrative and requires organisation-specific validation.

Record the rights decision separately from deployment

Use two approvals: the authorized brand and legal decision about the mark, and the technical decision about the domain, certificate and public files. The issuer workflow also distinguishes account types and approval prerequisites. Do not treat the request interface described for Enterprise, Partner and Legacy accounts as the same flow for every subscription account.

  • Old and new legal entity, mark owner and approved logo revision: pending.
  • Issuer case, applicable account flow and verified-contact approval: pending.
  • Retained mail identity, new identity and migration owner: pending.
  • Certificate coverage, public asset URLs and matching file digests: pending.
  • Controlled receiver observations and unresolved surfaces: pending.
  • Former administrator access review and residual-mail retirement decision: pending.

[ Takeaway ]

A new SVG does not resolve changed brand rights or certificate coverage.

[ By role ]

What this means for you

Choose your role for practical next steps.

IT / Mail Admin

Release a consistent asset set

The logo and certificate must remain associated with the intended identity.

Next steps

  1. Inventory old and new URLs.
  2. Test each sender path.
  3. Retain previous release records.

CISO / SecOps

Review authority after ownership changes

Corporate changes can leave stale administrative access.

Next steps

  1. Review issuer contacts.
  2. Review DNS and hosting access.
  3. Resolve rights before publication.

Founder / Non-technical

Separate the brand launch from mail readiness

A visual deadline should not force an untested sending identity.

Next steps

  1. Approve the transition scope.
  2. Keep support mail owned.
  3. Allow staged retirement.

[ FAQs ]

Frequently asked questions

Can a rebrand be handled by overwriting the SVG?

Not safely without checking certificate association, domain identity and rights.

Does domain control prove mark ownership?

No. Domain administration and rights to a mark are different matters.

Must all mail move on launch day?

No. A staged identity transition can preserve tested operational mail flows.

Who resolves acquisition-related mark rights?

The authorised organisation, appropriate legal advisers and certificate issuer must establish the relevant evidence.

Can an old brand domain remain active?

Yes, when its continuing mail use, ownership and required controls are maintained.

Why test each mail system?

Applications and employee mail may use different authentication and sending routes.

Will every inbox change logos simultaneously?

Do not assume so. Provider behavior and cached state can differ.

Was a real acquisition evaluated?

No. The example is synthetic and does not establish legal rights or live eligibility.

[ Sources ]

Sources

  1. DigiCert: Request mark certificate

    Sections Relevant setup, lifecycle or display guidance

  2. BIMI Group implementation guide

    Sections Relevant setup, lifecycle or display guidance

[ Glossary ]

Glossary

Brand transition
A coordinated change to the identities and assets representing an organisation.
Asset set
The related logo, certificate and public URLs used for one BIMI deployment.
Residual mail flow
Mail still sent from an identity after its main migration or rebrand.

Enterprise provenance

Why top financial institutions and governments retired their email security dashboards.

Traditional email authentication platforms sell you a dashboard and ask your engineers to do the labour. In high-stakes environments, manual oversight means delayed enforcement, configuration drift and unmonitored shadow domains.

EmailAuth is the agentic email provenance platform. Our agents enforce p=reject, keep third-party senders aligned and move your domains to full RFC 9989 compliance, the new DMARC standard,, with human-in-the-loop auditability.

Governments Large enterprises Tier-1 financial institutions

SaaS · Dedicated tenancy · Air-gapped on-prem · BYOK encryption

Knowledge Base