BIMI — Publishing Your Logo Next to Authenticated Mail
BIMI lets a domain publish a logo that participating mail clients display beside authenticated messages. This checks that the DNS record exists, that the image it references is retrievable and in the constrained SVG profile the specification requires, and that any accompanying verification certificate is valid.
Why run it
BIMI has a prerequisite that catches most people out: it only takes effect if your DMARC policy is at enforcement. Publishing the record while DMARC sits at none produces no error and no logo — the configuration is simply ignored, and teams conclude the mail client does not support it. The image requirements are similarly strict, and an SVG exported from a design tool will usually fail them while looking perfectly fine in a browser.
Why automate it
The dependency chain is the reason. BIMI depends on DMARC enforcement, which depends on SPF and DKIM being correct, and any weakening anywhere in that chain silently removes your logo. If DMARC is rolled back during an incident, BIMI stops working and nothing reports it. A scheduled check that validates the record, the image and the DMARC precondition together tells you the display is still working, which is otherwise only observable by sending yourself mail and looking.
What it gives you
Confirmation that a visible trust signal is actually being displayed, along with continuous verification of the DMARC enforcement it depends on. The check is worth as much for what it says about your authentication as for the logo.