BIMI implementationWhat it checks and how to fix it

What it checks

Skips domains without an MX record. Otherwise looks for a BIMI TXT record at default._bimi.<domain>: passes when the record names a Verified Mark Certificate (a= tag), warns when it only gives a logo (l=) without a certificate, and fails when there is no BIMI record.

Why it matters

BIMI lets mailbox providers such as Gmail, Yahoo and Apple Mail show your logo next to your messages, which makes legitimate mail easier to recognize and spoofed mail easier to spot. Gmail and Apple Mail only display the logo when a Verified Mark Certificate (or Common Mark Certificate) backs it, and every provider requires DMARC at enforcement first.

How to fix it

1. Put DMARC at enforcement: p=quarantine or p=reject (see the DMARC check).
2. Prepare your logo as an SVG in the SVG Tiny Portable/Secure (SVG Tiny PS) profile, square, and host it over HTTPS.
3. Get a Verified Mark Certificate (VMC, needs a registered trademark) or a Common Mark Certificate (CMC) from a CA such as DigiCert or Sectigo, and host the PEM file over HTTPS.
4. Publish the BIMI record:

default._bimi.example.com.  3600  IN  TXT  "v=BIMI1; l=https://example.com/bimi/logo.svg; a=https://example.com/bimi/vmc.pem"

In Cloudflare DNS, the record name is default._bimi.

dig +short TXT default._bimi.example.com