Analysis console for system administrators

BIMI, MTA-STS & TLS-RPT

Audit brand logo, enforced-TLS policy and TLS reporting records end to end.

GET/api/mail-security

Enter a target

e.g. example.com — press ⏎ / ⌘⏎

About

What is BIMI, MTA-STS & TLS-RPT?

This tool audits the three modern records the SPF/DKIM/DMARC trio doesn't cover: BIMI (brand logo in the inbox), MTA-STS (enforced TLS for inbound SMTP) and TLS-RPT (reporting when that TLS fails).

MTA-STS solves a concrete problem: STARTTLS in SMTP is opportunistic, and an attacker in the middle can strip the advertisement so the sender silently falls back to plaintext. MTA-STS makes that downgrade impossible. The check goes beyond DNS — it fetches the policy file and confirms its mx patterns match your live MX records.

BIMI's precondition is DMARC: the policy must be quarantine or reject at pct=100. If that isn't met, no provider shows the logo even with a valid record, and the tool says so explicitly.

Frequently Asked Questions

11 questions
What problem does MTA-STS actually solve?

STARTTLS in SMTP is opportunistic: an attacker in the middle can strip the STARTTLS advertisement and the sending server silently falls back to plaintext with nobody noticing. MTA-STS tells senders "only deliver to this domain over TLS with a valid certificate", making that downgrade impossible.

What do I need to deploy MTA-STS?

Two pieces: a TXT record at _mta-sts.<domain> containing v=STSv1, and a policy file served as text/plain at https://mta-sts.<domain>/.well-known/mta-sts.txt. The policy must be served over HTTPS with a valid certificate, and redirects are not followed.

What's the difference between enforce and testing?

In testing, violations are only reported via TLS-RPT and mail is still delivered. In enforce, non-compliant delivery is refused. Start in testing and switch to enforce once reports come back clean.

What is TLS-RPT for?

Sending servers send you daily summaries when TLS fails while delivering to you. Without it, problems like an expired certificate or an MTA-STS policy drifting out of sync with your MX records stay completely invisible — mail just quietly stops arriving.

What does BIMI require?

Three things: a DMARC policy of quarantine or reject at pct=100; a logo in SVG Tiny Portable/Secure served over HTTPS; and, for Gmail and Apple Mail, a Verified Mark Certificate. If DMARC isn't enforcing, no provider shows the logo even with a valid record.

Is a VMC mandatory?

Not by the spec, but effectively yes: Gmail and Apple Mail only display the logo with one. A VMC is a paid certificate that verifies a registered trademark, so you need a registered mark to get it.

Does MTA-STS require a subdomain?

Yes, and the name is fixed: the policy must be served from exactly mta-sts.<yourdomain>. That name needs its own A/CNAME record and a valid certificate; pointing it at your existing web server is usually enough.

What do I do when I change the policy?

Change the id value in the DNS TXT record too. Senders detect a policy change only by a different id; leave it the same and they keep using the cached policy for the whole max_age.

MTA-STS versus DANE?

Both enforce TLS but rest on different trust chains: MTA-STS uses the web PKI (certificate authorities) and HTTPS, DANE uses DNSSEC-signed TLSA records. DANE is stronger but requires DNSSEC; MTA-STS works without it.

How do TLS-RPT reports arrive?

Senders email daily summaries as compressed JSON to the rua address. A small domain gets a few per day. They're readable by hand, but a report-analysis service is more practical for ongoing tracking.

Why is my BIMI logo still not showing?

Three common reasons: DMARC isn't yet at quarantine/reject, there's no VMC, or the provider doesn't consider your sending reputation established. BIMI is reputation-gated — a correct record on a new domain may not display right away.