What are these three records?
BIMI lets senders with enforced DMARC (quarantine/reject) show an SVG logo. The record is selector._bimi (usually default._bimi) TXT: v=BIMI1; l=https://…svg; a=https://…pem. This tool validates the SVG Tiny PS profile and parses the VMC/CMC PEM (subject, issuer, dates, mark OID).
MTA-STS stops receivers from falling back to cleartext SMTP. You need both _mta-sts TXT (v=STSv1; id=…) and https://mta-sts.domain/.well-known/mta-sts.txt (version, mode, mx, max_age). mode: enforce requires TLS; testing/none only monitor.
TLS-RPT sends XML reports of SMTP TLS failures to rua= mailto: or https. The TXT lives at _smtp._tls. It can exist without MTA-STS; together they make more sense.
Examples
- BIMI
default._bimi TXTl= SVG Tiny PS; a= VMC; DMARC enforce.- MTA-STS
mode: enforceHTTPS policy file required.
Green / amber / red
A missing record is amber: BIMI, STS and TLS-RPT are optional. Red means you published something broken — wrong v=, http l=, scripts in the SVG, expired VMC, or STS TXT without a policy file.
BIMI “Ready”: v=BIMI1 + HTTPS SVG Tiny PS + valid Mark VMC + DMARC p=quarantine/reject (pct=100). The inbox decision is still the receiver’s.
How to publish
BIMI: SVG Tiny PS (baseProfile=tiny-ps, square viewBox, title) on HTTPS. Put DMARC on quarantine/reject first. Publish a DigiCert/Entrust VMC PEM chain on a=; the tool reads the leaf PEM.
MTA-STS: a valid HTTPS cert on mta-sts.domain (SNI). Policy is plain text under 8 KB. Changing id= makes receivers refetch. Wildcard mx: *.example.com does not cover the apex.
TLS-RPT: v=TLSRPTv1; rua=mailto:tlsrpt@domain. Read the reports and fix STARTTLS failures.