# DNS record examples for BIMI on Amazon SES

Replace `example.com`, selector tokens, and URLs with your values. Quotes shown as published in most UIs.

## SPF (custom MAIL FROM subdomain)

**Name:** `mail.example.com` (or your MAIL FROM)  
**Type:** TXT  
**Value:**

```txt
v=spf1 include:amazonses.com ~all
```

Also publish the SES-provided **MX** for the MAIL FROM domain (console shows the exact feedback host).

Root domain SPF (if you also SPF the organizational domain):

```txt
v=spf1 include:amazonses.com ~all
```

## DKIM (Easy DKIM — three CNAMEs)

SES gives three tokens. Example shape:

| Name | Type | Value |
| --- | --- | --- |
| `abc123._domainkey.example.com` | CNAME | `abc123.dkim.amazonses.com` |
| `def456._domainkey.example.com` | CNAME | `def456.dkim.amazonses.com` |
| `ghi789._domainkey.example.com` | CNAME | `ghi789.dkim.amazonses.com` |

## DMARC (enforcement required for BIMI)

**Name:** `_dmarc.example.com`  
**Type:** TXT  

Quarantine at 100%:

```txt
v=DMARC1; p=quarantine; pct=100; rua=mailto:dmarc-agg@example.com; fo=1
```

Reject:

```txt
v=DMARC1; p=reject; pct=100; rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-forensic@example.com; fo=1
```

## BIMI

**Name:** `default._bimi.example.com`  
**Type:** TXT  

With mark certificate:

```txt
v=BIMI1;l=https://bimi.example.com/logo.svg;a=https://bimi.example.com/certificate.pem
```

Logo only (limited mailbox support):

```txt
v=BIMI1;l=https://bimi.example.com/logo.svg;
```

Subdomain sender (`marketing.example.com`):

**Name:** `default._bimi.marketing.example.com`

```txt
v=BIMI1;l=https://bimi.example.com/marketing.svg;a=https://bimi.example.com/marketing.pem
```

---

## Provider UI notes

### Amazon Route 53

1. Hosted zone → Create record  
2. Record name: `default._bimi` (zone apex supplies `example.com`)  
3. Record type: TXT  
4. Value: paste the BIMI string **without** wrapping quotes in the console (Route 53 adds them)  
5. TTL: 300–3600 during rollout

CLI:

```bash
# Requires AWS CLI v2, credentials for the account that owns the hosted zone
aws route53 change-resource-record-sets --hosted-zone-id ZXXXXXXXX \
  --change-batch '{
    "Changes": [{
      "Action": "UPSERT",
      "ResourceRecordSet": {
        "Name": "default._bimi.example.com",
        "Type": "TXT",
        "TTL": 300,
        "ResourceRecords": [{"Value": "\"v=BIMI1;l=https://bimi.example.com/logo.svg;a=https://bimi.example.com/certificate.pem\""}]
      }
    }]
  }'
```

### Cloudflare

1. DNS → Add record → TXT  
2. Name: `default._bimi`  
3. Content: `v=BIMI1;l=https://...;a=https://...`  
4. Proxy status: DNS only (gray cloud) — TXT is never proxied

### GoDaddy

1. DNS Management → Add → TXT  
2. Host: `default._bimi`  
3. TXT Value: full BIMI string  
4. TTL: 1 Hour (or Custom 300)

### Namecheap

1. Advanced DNS → Add New Record → TXT  
2. Host: `default._bimi`  
3. Value: full BIMI string

### Google Domains / Squarespace Domains

1. DNS → Custom records → TXT  
2. Host name: `default._bimi`  
3. Data: full BIMI string

### DNS Made Easy

1. Managed DNS → Records → + TXT  
2. Name: `default._bimi.example.com` (or relative `default._bimi` depending on UI)  
3. Value: full BIMI string

---

## Validation commands

```bash
dig TXT default._bimi.example.com +short
dig TXT _dmarc.example.com +short
dig TXT mail.example.com +short
curl -sI https://bimi.example.com/logo.svg | grep -i content-type
```