Check · Domain & email identity · default severity info
Brand indicators (BIMI)
What Kavach checks
BIMI shows your verified logo next to your mail in supporting inboxes.
Why it matters
Optional. It requires enforcing DMARC first, so it doubles as proof of strong email identity.
How to fix it
After DMARC p=reject, publish default._bimi TXT with your SVG logo (and a VMC if you want Gmail support).
Stack-specific fixes: nginx · Apache · Caddy · Express / Node · Cloudflare
Limitations
This is a read-only observation of publicly reachable configuration at scan time. It can produce false positives/negatives (caching layers, geo-specific responses, bot defences) and does not test application logic or authenticated areas. Rule version 1.