BIMI, MTA-STS & TLS-RPT Generator
Eliminate SMTP downgrade attacks and display your verified brand logo in Gmail and Apple Mail inboxes. Generate MTA-STS policies, TLS-RPT telemetry records, and BIMI SVG strings.
1. MTA-STS Policy Configuration (RFC 8461)
2. SMTP TLS Reporting (RFC 8460)
3. BIMI Brand Logo Indicator
; 1. MTA-STS DNS TXT Record (RFC 8461) _mta-sts.example.com. 3600 IN TXT "v=STSv1; id=2026110601;" ; 2. SMTP TLS Reporting (TLS-RPT) DNS TXT Record (RFC 8460) _smtp._tls.example.com. 3600 IN TXT "v=TLSRPTv1; rua=mailto:[email protected];" ; 3. BIMI Brand Indicator DNS TXT Record default._bimi.example.com. 3600 IN TXT "v=BIMI1; l=https://example.com/brand/bimi-logo.svg; a=https://example.com/brand/vmc-cert.pem;" ; ------------------------------------------------------------ ; 4. Hosted Policy File at https://mta-sts.example.com/.well-known/mta-sts.txt ; ------------------------------------------------------------ version: STSv1 mode: enforce mx: *.google.com mx: *.googlemail.com max_age: 604800
Defending Against SMTP STARTTLS Downgrades & BIMI Prerequisites
Historically, SMTP opportunistic encryption (STARTTLS) was vulnerable to active man-in-the-middle stripping attacks. MTA-STS (Mail Transfer Agent Strict Transport Security) enforces mandatory TLS encryption and certificate validation between mail servers.
Dual-Mechanism Verification
MTA-STS pairs a DNS TXT bootstrap record (_mta-sts.domain.com) with an HTTPS-hosted policy file at https://mta-sts.domain.com/.well-known/mta-sts.txt. Whenever you update the policy file, you must increment the DNS id= serial string to trigger cache invalidation.
BIMI Requires DMARC Enforcement
Inbox providers (Gmail, Apple Mail, Yahoo) will ignore your BIMI record unless your domain's DMARC policy is strictly set to p=quarantine; pct=100; or p=reject;. A permissive p=none policy disqualifies BIMI logo rendering.
SVG Tiny Portable/Secure (SVG-P/S)
Standard Adobe Illustrator or Figma SVG exports fail BIMI validation. The BIMI logo must conform to the SVG Tiny 1.2 PS profile: square aspect ratio, solid background, under 32 KB, and stripped of all interactive scripts or external links.