BIMI, MTA-STS & TLS-RPT
Audit brand logo, enforced-TLS policy and TLS reporting records end to end.
Enter a target
e.g. example.com — press ⏎ / ⌘⏎
What is BIMI, MTA-STS & TLS-RPT?
This tool audits the three modern records the SPF/DKIM/DMARC trio doesn't cover: BIMI (brand logo in the inbox), MTA-STS (enforced TLS for inbound SMTP) and TLS-RPT (reporting when that TLS fails).
MTA-STS solves a concrete problem: STARTTLS in SMTP is opportunistic, and an attacker in the middle can strip the advertisement so the sender silently falls back to plaintext. MTA-STS makes that downgrade impossible. The check goes beyond DNS — it fetches the policy file and confirms its mx patterns match your live MX records.
BIMI's precondition is DMARC: the policy must be quarantine or reject at pct=100. If that isn't met, no provider shows the logo even with a valid record, and the tool says so explicitly.
Frequently Asked Questions
11 questionsWhat problem does MTA-STS actually solve?
STARTTLS in SMTP is opportunistic: an attacker in the middle can strip the STARTTLS advertisement and the sending server silently falls back to plaintext with nobody noticing. MTA-STS tells senders "only deliver to this domain over TLS with a valid certificate", making that downgrade impossible.
What do I need to deploy MTA-STS?
Two pieces: a TXT record at _mta-sts.<domain> containing v=STSv1, and a policy file served as text/plain at https://mta-sts.<domain>/.well-known/mta-sts.txt. The policy must be served over HTTPS with a valid certificate, and redirects are not followed.
What's the difference between enforce and testing?
In testing, violations are only reported via TLS-RPT and mail is still delivered. In enforce, non-compliant delivery is refused. Start in testing and switch to enforce once reports come back clean.
What is TLS-RPT for?
Sending servers send you daily summaries when TLS fails while delivering to you. Without it, problems like an expired certificate or an MTA-STS policy drifting out of sync with your MX records stay completely invisible — mail just quietly stops arriving.
What does BIMI require?
Three things: a DMARC policy of quarantine or reject at pct=100; a logo in SVG Tiny Portable/Secure served over HTTPS; and, for Gmail and Apple Mail, a Verified Mark Certificate. If DMARC isn't enforcing, no provider shows the logo even with a valid record.
Is a VMC mandatory?
Not by the spec, but effectively yes: Gmail and Apple Mail only display the logo with one. A VMC is a paid certificate that verifies a registered trademark, so you need a registered mark to get it.
Does MTA-STS require a subdomain?
Yes, and the name is fixed: the policy must be served from exactly mta-sts.<yourdomain>. That name needs its own A/CNAME record and a valid certificate; pointing it at your existing web server is usually enough.
What do I do when I change the policy?
Change the id value in the DNS TXT record too. Senders detect a policy change only by a different id; leave it the same and they keep using the cached policy for the whole max_age.
MTA-STS versus DANE?
Both enforce TLS but rest on different trust chains: MTA-STS uses the web PKI (certificate authorities) and HTTPS, DANE uses DNSSEC-signed TLSA records. DANE is stronger but requires DNSSEC; MTA-STS works without it.
How do TLS-RPT reports arrive?
Senders email daily summaries as compressed JSON to the rua address. A small domain gets a few per day. They're readable by hand, but a report-analysis service is more practical for ongoing tracking.
Why is my BIMI logo still not showing?
Three common reasons: DMARC isn't yet at quarantine/reject, there's no VMC, or the provider doesn't consider your sending reputation established. BIMI is reputation-gated — a correct record on a new domain may not display right away.