# BIMI readiness benchmark (first-party)

Not a cited client. Lab pattern used to size the SES → DMARC → BIMI path and the free Readiness Checker scoring weights.

## Scenario silhouette

| Dimension | Value |
| --- | --- |
| Send path | Amazon SES API v2, Easy DKIM, custom MAIL FROM |
| Volume assumption | **1.2M emails/month** transactional (OTP + receipts) |
| Starting auth | DKIM Successful; apex SPF present; DMARC **`p=none`** |
| Logo host | Private S3 + CloudFront OAC (`PriceClass_100`) |
| Mark cert | VMC PEM on same distribution (optional for Yahoo-only tests) |

## Measured checklist (lab)

| Step | Before | After | Notes |
| --- | --- | --- | --- |
| DMARC policy | `p=none` | `p=quarantine; pct=100` | BIMI gate |
| Readiness Checker score | **38 / 100** | **92 / 100** | Public DNS + HTTPS probes |
| `dig TXT default._bimi` | NXDOMAIN | `v=BIMI1;l=…;a=…` | Generator + Route 53 UPSERT |
| `curl -sI` logo Content-Type | `binary/octet-stream` | `image/svg+xml` | S3 metadata + CF invalidation |
| Steady-state AWS hosting | — | **~$1.50–6 / mo** | From [tco-worksheet.csv](./tco-worksheet.csv) (S3+CF+R53) |
| VMC amortized | — | **~$80–150 / mo** | CA list price / 12 — shop quotes |

## Reproduce

1. Clone artifacts under `examples/architecture-blog-2026/ses-bimi/`.
2. Run `cli/ses-bimi-setup.sh` with `DOMAIN` + `REGION`.
3. Publish DNS from `dns-record-examples.md` (DMARC enforce only when rua is clean).
4. Deploy Terraform/CDK hosting; upload SVG/PEM with explicit Content-Type.
5. Score with https://www.factualminds.com/tools/bimi-readiness-checker/ — expect DMARC + BIMI + logo checks to dominate the score delta.
6. Validate SVG with https://www.factualminds.com/tools/bimi-svg-validator/.

## What broke in the lab path

Day-of logo publish: object uploaded via console without `Content-Type: image/svg+xml`. CloudFront returned `binary/octet-stream`. Readiness Checker and inbox-side fetches treated the asset as invalid until CLI re-upload + invalidation. Detection: `curl -sI` Content-Type mismatch. Fix: `aws s3 cp … --content-type image/svg+xml` then `create-invalidation` for `/logo.svg`.