bonus.bimi.missing

BIMI Not Configured

What we check

We query DNS for a TXT record at default._bimi.<domain>. BIMI (Brand Indicators for Message Identification) displays your brand logo next to authenticated mail in supporting inboxes. This finding means no BIMI record was found.

What this finding means

The domain publishes no BIMI record. That is not a security problem — BIMI is an optional display feature, not an authentication mechanism. It shows your logo in the inbox; it does not improve deliverability or filter spam.

BIMI is the cosmetic finishing touch on top of strong authentication, worth adding only once the fundamentals are solid. It has two hard prerequisites, and the second one costs money.

Is BIMI worth setting up?

DMARC must be at enforcement. p=quarantine or p=reject on the organizational domain and subdomains, at 100% — a monitoring-only policy (p=none) or a partial pct is not accepted. If you're not there yet, that's the priority, not BIMI.
The logo generally needs a paid certificate. At Gmail, Apple Mail, and Yahoo the logo effectively appears only with a VMC (Verified Mark Certificate, which requires a registered trademark) or a CMC (Common Mark Certificate, no trademark but narrower support). Both are paid annual certificates from a Mark Verifying Authority. A self-asserted record with no certificate has limited support and typically won't display at the major providers.
Worth it if you already run DMARC at p=reject, have (or will register) a trademark or budget for a CMC, and value visible branding — usually larger brands and newsletter senders. Probably not if you're not yet at enforcement or have no certificate budget.

How to fix

Get DMARC to p=quarantine or p=reject at 100% first.
Create an SVG Tiny PS logo and host it at a stable HTTPS URL.
Obtain a VMC or CMC if you want the logo to display at Gmail/Apple/Yahoo.
Publish the BIMI record at default._bimi.<domain>:
```
default._bimi.example.com.  IN  TXT  "v=BIMI1; l=https://example.com/logo.svg; a=https://example.com/vmc.pem"
```
The l= tag points to the logo; a= points to the certificate. Drop a= for a self-asserted record — but expect the major providers not to show the logo.

How it's graded

A missing BIMI record is informational and carries no deduction — BIMI is an optional bonus, so its absence simply means you don't earn the bonus, not that you're penalized. See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT default._bimi.example.com
(empty — no BIMI record published)

References

RFC 7489 — Domain-based Message Authentication, Reporting, and Conformance (DMARC)