> ## Documentation Index
> Fetch the complete documentation index at: https://docs.37audits.com/llms.txt
> Use this file to discover all available pages before exploring further.
# DNS Mail BIMI
> Checks the BIMI DNS record that lets mailbox providers show your brand logo next to authenticated email.
**Security Auditor** — checks the BIMI assertion record published at `default._bimi.`: that it exists, starts with `v=BIMI1`, points at an `https://` logo and is the only BIMI record at that name.
Your logo in the inbox tells recipients at a glance that a message really comes from you, which makes look-alike phishing easier to spot.
Follows the IETF draft Brand Indicators for Message Identification (BIMI), `draft-brand-indicators-for-message-identification-14`.
BIMI (Brand Indicators for Message Identification) lets a domain that enforces DMARC publish a DNS TXT record pointing at its brand logo. Mailbox providers that support BIMI (Gmail, Apple Mail, Yahoo and others) fetch that logo and show it next to messages that pass DMARC, so authenticated mail from the domain is recognizable in the inbox. This auditor reads the record at `default._bimi.` and checks its shape; it does not fetch the logo or the Verified Mark Certificate.
## How it works
1. **Domain** — takes the hostname of the audited URL and strips one leading `www.`: `https://www.example.com/` is audited as `example.com`. A URL without a hostname ends the audit with `501`.
2. **Lookup** — asks DNS for the TXT records at `default._bimi.` (the `default` selector). The auditor never fetches the audited page. A resolver failure (SERVFAIL, timeout) ends the audit with `500`; a name with no record is a finding, not an error.
3. **Rules** — no TXT record at the name warns (`300`, BIMI is optional). Every TXT value that does not start with `v=BIMI1` (case-insensitive) warns once (`301`). The first `v=BIMI1` record must carry an `l=` tag with an `https://` URL (`302`). More than one `v=BIMI1` record warns (`303`), because mailbox providers expect exactly one.
4. **Aggregate** — any warning makes the audit `WARNING`; when every rule passes the audit is `SUCCESS` (`200`) and the message quotes the record and its logo URL.
5. **Specification pin** — every run emits `37A-DnsMailBimiAuditor-100` (`INFORMATION`), naming the [IETF BIMI draft](https://datatracker.ietf.org/doc/draft-brand-indicators-for-message-identification/) revision this auditor implements. It does not change the overall status.
## What it audits
Every row maps to one `checkRule*` method and one `CheckCode`, in the order the auditor runs them. CheckCode suffixes use status ranges: `100` information, `200` success, `300–399` warning, `400–499` fail, `500–599` error.
| CheckCode | Status | When it fires | Recommendation | Why it matters |
| - | - | - | - | - |
| `37A-DnsMailBimiAuditor-100` | `INFORMATION` | Always. Records the BIMI draft revision this auditor implements. | — (recommendation is `null`; nothing for the site to change) | — |
| `37A-DnsMailBimiAuditor-300` | `WARNING` | No TXT record exists at `default._bimi.{domain}`. | Once `{domain}` enforces DMARC (p=quarantine or p=reject), publish a TXT record at `default._bimi.{domain}` such as "v=BIMI1; l=https\://`{domain}`/bimi/logo.svg" pointing at your SVG Tiny PS logo. | Without BIMI, mailbox providers show no brand logo next to your messages, so your email is less recognizable in the inbox and competes harder for opens. |
| `37A-DnsMailBimiAuditor-301` | `WARNING` | A TXT record at the BIMI name does not start with `v=BIMI1` (one check per such record). | Rewrite "`{record}`" at `default._bimi.{domain}` so it starts with "v=BIMI1;" followed by the logo URL, for example "v=BIMI1; l=[https://example.com/bimi/logo.svg](https://example.com/bimi/logo.svg)", or remove it from the zone. | Mailbox providers ignore a record they cannot parse, so no logo appears while the DNS entry gives the impression that BIMI is in place. |
| `37A-DnsMailBimiAuditor-302` | `WARNING` | The BIMI record has no `l=` tag, or its value is not an `https://` URL. | Add an l= tag with the HTTPS URL of your SVG Tiny PS logo to "`{record}`" at `default._bimi.{domain}`, for example "v=BIMI1; l=[https://example.com/bimi/logo.svg](https://example.com/bimi/logo.svg)". | Mailbox providers only fetch the logo over HTTPS; without a usable l= URL the record shows nothing and the brand stays invisible in the inbox. |
| `37A-DnsMailBimiAuditor-303` | `WARNING` | More than one `v=BIMI1` TXT record answers at the BIMI name. | Keep a single v=BIMI1 TXT record at `default._bimi.{domain}` and delete the other `{count - 1}` of "`{records}`". | When several BIMI records answer the same name, mailbox providers treat the lookup as invalid and show no logo at all. |
| `37A-DnsMailBimiAuditor-200` | `SUCCESS` | All rules passed. Message quotes the BIMI record and its logo URL. | — | — |
| `37A-DnsMailBimiAuditor-500` | `ERROR` | The resolver could not answer the TXT query for `default._bimi.{domain}` (SERVFAIL, timeout). The record may well exist. | Check that the DNS zone serving `default._bimi.{domain}` answers TXT queries, then run the audit again. Last error: `{error}`. | — |
| `37A-DnsMailBimiAuditor-501` | `ERROR` | The audited URL is null, empty, malformed or has no hostname. | Provide an absolute URL with a hostname, such as [https://example.com/](https://example.com/), instead of "`{url}`". | — |
## Output documentation
| Status | Description | Test logic |
| - | - | - |
| **SUCCESS** | One valid BIMI record with an HTTPS logo | Exactly one `v=BIMI1` TXT record at `default._bimi.` whose `l=` tag is an `https://` URL (`200`). |
| **WARNING** | BIMI is missing or will not show a logo | No record (`300`); a TXT value not starting with `v=BIMI1` (`301`); no `https://` logo URL in `l=` (`302`); more than one BIMI record (`303`). |
| **FAIL** | — | This auditor emits no FAIL: BIMI is optional. |
| **ERROR** | The auditor could not run the check | DNS lookup failed (`500`); the URL has no usable hostname (`501`). |
| **INFORMATION** | Specification pin | Always emitted (`100`); does not change overall status. |
## Risks and considerations
### What BIMI needs besides this record
* Mailbox providers only honor BIMI for domains whose DMARC policy is `p=quarantine` or `p=reject` (with `pct=100`). A correct BIMI record on a domain with `p=none` shows no logo; run the DNS Mail DMARC auditor alongside this one.
* The logo must be an SVG Tiny PS file served over HTTPS, and Gmail and Apple Mail also require a Verified Mark Certificate (`a=` tag). This auditor checks neither the logo file nor the certificate.
### Selector and subdomains
* Only the `default` selector is read. Mail sent with a `BIMI-Selector` header naming another selector is published elsewhere and is not seen here.
* The record is read for the hostname of the audited URL (minus `www.`); mail sent from a subdomain or the organizational domain may use a different BIMI record.
### Changes from the previous version of this auditor
* A null, empty or malformed URL, or one without a hostname, used to be reported as `FAIL` with no check code; it is now `ERROR` with `37A-DnsMailBimiAuditor-501`, because a bad input is not a defect of the domain.
* A DNS failure or timeout used to be reported as "No BIMI record found"; it is now `ERROR` with `37A-DnsMailBimiAuditor-500`, since the record may exist and the audit could not tell.
* A record without an `https://` logo URL in `l=` (`302`) and more than one BIMI record at the name (`303`) are new warnings; the previous version only looked at the first TXT record's `v=BIMI1` prefix.
* The `v=BIMI1` check is now case-insensitive.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.