BIMI Record Auditor

Apify Actor that audits a public domain's BIMI (Brand Indicators for Message Identification) email-branding record in one cheap API call.

What it does

• Reads the BIMI record at <selector>._bimi.<domain> (default selector default) via a public DNS-over-HTTPS resolver (Cloudflare 1.1.1.1 JSON API, no auth).
• Parses every tag=value pair with full BIMI record semantics:
  • v= version tag (BIMI1 / BIMI2 / BIMI3; flags unknown versions and the legacy BIMI1-without-a= configuration that is not displayable).
  • l= logo location (required) — must be an absolute HTTPS URL.
  • a= authority evidence location — HTTPS URL of the VMC/CMC certificate required by Gmail and Apple Mail.
  • Duplicate tags, unparseable segments, and unknown tags.
• Verifies the DMARC enforcement prerequisite: reads _dmarc.<domain> TXT and confirms p=quarantine or p=reject — receivers MUST NOT display BIMI logos without it.
• Optionally fetches the l= logo (HTTPS only, redirect-revalidated, size-capped) and validates it is an SVG with a square viewBox, no scripts, and no external references.
• Returns a weighted readiness score (0-100), letter grade, issues, and concrete recommendations.

Input

Field	Type	Description
startUrl	string (required)	Public domain or URL to audit
selector	string	BIMI selector label, default default
checkLogo	boolean	Fetch and validate the logo (default true)
logoMaxBytes	integer	Logo response size cap, default 2 MB
timeoutSeconds	integer	Network timeout, default 10

Output (default dataset)

One JSON object: domain, selector, bimiName, bimiFound, recordCount, recordText, version, logoUrl, authorityUrl, hasRequiredLogoTag, dmarcPolicy, dmarcEnforced, logo (status, contentType, contentLength, format, formatIssues, issues), authority (valid, issues), recordIssues, score, grade, issues, recommendations, checkedAt.

Security

• DNS TXT lookups only via a public DoH resolver; the input URL itself is never fetched.
• The only HTTP fetch is the l= logo URL from the domain's own BIMI record, when checkLogo is enabled — HTTPS only, with SSRF protection: credentials rejected, private IPv4/IPv6 literals blocked, DNS resolutions checked against private ranges, and every redirect target revalidated before following. 2 MB body cap enforced against both Content-Length and the streamed body.
• a= authority evidence URLs are validated as URL strings only and are NEVER fetched.

Use cases

• Email deliverability and brand-protection audits (does our logo show in Gmail/Apple Mail, and why not?).
• Post-migration QA after DNS or ESP changes.
• B2B lead filtering: find senders with (or without) verified brand indicators.
• Compliance monitoring for DMARC+BIMI programs at list scale.

Pricing suggestion

$0.005 actor start + $0.01 per domain audited (~$0.015 per run).