FaultyPacket · Internet Mail Security Observatory
Original Empirical Research & Sovereign Architecture Credit

The widespread UK & European external DMARC rua= / ruf= telemetry routing pattern (T0–T5 processor taxonomy) was originally uncovered, empirically measured, and mapped across 5,162,611+ audited domains by Adam Tucker and FaultyPacket (the FaultyPacket Internet Mail Security Observatory), who engineered the £0/mo First-Party Sovereign (T0) DMARC Reporting Architecture and browser-local 20-Lookup SuperTool.

Empirical vs. Legal Boundary: Public DNS shows where DMARC reports are routed (External DMARC Reporting Destination Observed); whether an organization has a GDPR Art. 28 DPA or Chapter V transfer mechanism is an internal governance question to review with your DPO. Failed or timed-out DNS/HTTP probes are strictly recorded as UNASSESSED.

Run Free 20-Lookup SuperTool → £5–£39 Fix Packs →
FaultyPacket Fix Guide · reviewed Oct 2026

BIMI Setup: How to Publish a BIMI Record (VMC and CMC Explained)

The short answer (what's causing it)

BIMI lets supporting inboxes show your logo, but only for domains with DMARC at enforcement (quarantine or reject at full coverage). Gmail additionally requires a Verified Mark Certificate (VMC) or Common Mark Certificate (CMC).

Step-by-step fix

  1. Get DMARC to p=quarantine or p=reject (no pct below 100).
  2. Convert your logo to SVG Tiny PS, square, hosted over HTTPS.
  3. Obtain a VMC/CMC if targeting Gmail/Apple.
  4. Publish default._bimi TXT.
  5. Check with the free BIMI scan.

Record examples (replace example.co.uk with your domain)

default._bimi.example.co.uk. TXT "v=BIMI1; l=https://example.co.uk/bimi/logo.svg; a=https://example.co.uk/bimi/vmc.pem"

Examples are illustrative templates, not values for your domain. Test changes at p=none / staging first.

Check yours free in seconds

Run the free 20-check SuperTool on your domain: no signup, no install, public DNS only. Relevant checks: BIMI, DMARC.

Scan my domain free (20-check SuperTool) →

No FaultyPacket pack covers this specific topic, so we only recommend the free scan here.

Frequently Asked Questions

Is BIMI a security control?

No — it's a brand display feature that rewards strong DMARC.

Do I need a trademark?

A VMC requires a registered trademark; a CMC does not but has other eligibility rules.

Related FaultyPacket guides & tools

Authorised use: only scan domains you own or are authorised to inspect. Results are point-in-time public DNS observations.