Skip to main content
Security Auditor — checks the BIMI assertion record published at default._bimi.<domain>: that it exists, starts with v=BIMI1, points at an https:// logo and is the only BIMI record at that name.

Protection

Your logo in the inbox tells recipients at a glance that a message really comes from you, which makes look-alike phishing easier to spot.

Standards

Follows the IETF draft Brand Indicators for Message Identification (BIMI), draft-brand-indicators-for-message-identification-14.
BIMI (Brand Indicators for Message Identification) lets a domain that enforces DMARC publish a DNS TXT record pointing at its brand logo. Mailbox providers that support BIMI (Gmail, Apple Mail, Yahoo and others) fetch that logo and show it next to messages that pass DMARC, so authenticated mail from the domain is recognizable in the inbox. This auditor reads the record at default._bimi.<domain> and checks its shape; it does not fetch the logo or the Verified Mark Certificate.

​
How it works

  1. Domain — takes the hostname of the audited URL and strips one leading www.: https://www.example.com/ is audited as example.com. A URL without a hostname ends the audit with 501.
  2. Lookup — asks DNS for the TXT records at default._bimi.<domain> (the default selector). The auditor never fetches the audited page. A resolver failure (SERVFAIL, timeout) ends the audit with 500; a name with no record is a finding, not an error.
  3. Rules — no TXT record at the name warns (300, BIMI is optional). Every TXT value that does not start with v=BIMI1 (case-insensitive) warns once (301). The first v=BIMI1 record must carry an l= tag with an https:// URL (302). More than one v=BIMI1 record warns (303), because mailbox providers expect exactly one.
  4. Aggregate — any warning makes the audit WARNING; when every rule passes the audit is SUCCESS (200) and the message quotes the record and its logo URL.
  5. Specification pin — every run emits 37A-DnsMailBimiAuditor-100 (INFORMATION), naming the IETF BIMI draft revision this auditor implements. It does not change the overall status.

​
What it audits

Every row maps to one checkRule* method and one CheckCode, in the order the auditor runs them. CheckCode suffixes use status ranges: 100 information, 200 success, 300–399 warning, 400–499 fail, 500–599 error.

​
Output documentation

​
Risks and considerations

​
What BIMI needs besides this record

  • Mailbox providers only honor BIMI for domains whose DMARC policy is p=quarantine or p=reject (with pct=100). A correct BIMI record on a domain with p=none shows no logo; run the DNS Mail DMARC auditor alongside this one.
  • The logo must be an SVG Tiny PS file served over HTTPS, and Gmail and Apple Mail also require a Verified Mark Certificate (a= tag). This auditor checks neither the logo file nor the certificate.

​
Selector and subdomains

  • Only the default selector is read. Mail sent with a BIMI-Selector header naming another selector is published elsewhere and is not seen here.
  • The record is read for the hostname of the audited URL (minus www.); mail sent from a subdomain or the organizational domain may use a different BIMI record.

​
Changes from the previous version of this auditor

  • A null, empty or malformed URL, or one without a hostname, used to be reported as FAIL with no check code; it is now ERROR with 37A-DnsMailBimiAuditor-501, because a bad input is not a defect of the domain.
  • A DNS failure or timeout used to be reported as “No BIMI record found”; it is now ERROR with 37A-DnsMailBimiAuditor-500, since the record may exist and the audit could not tell.
  • A record without an https:// logo URL in l= (302) and more than one BIMI record at the name (303) are new warnings; the previous version only looked at the first TXT record’s v=BIMI1 prefix.
  • The v=BIMI1 check is now case-insensitive.