BIMI status
Checked daily for every monitored domain: the default._bimi record, logo URL
reachability (with basic SVG Tiny P/S sanity checks), VMC certificate parseability + expiry, and the
DMARC-enforcement prerequisite (BIMI never renders under p=none). A VMC expiring within 30 days,
or a published-but-broken setup, alerts through the same engine as everything else. No record = not
participating — never alerted.
Hosted BIMI
Hosts the logo (and, when you have one, the VMC/CMC certificate) publicly from this
service — like the hosted MTA-STS, minus the per-domain routes: BIMI puts no constraints on the asset
hostname, so one shared public host covers every domain. Publishing the generated default._bimi
record stays a manual DNS step. Without a certificate, Yahoo and Fastmail display the logo (self-asserted
BIMI); Gmail and Apple Mail require a VMC or CMC from DigiCert/Entrust — a per-organisation purchase this
service can host but not obtain. DMARC enforcement (p=quarantine/reject) is a prerequisite
everywhere.