feat: add BIMI posture readiness checks

docs/milestones.md

@@ -221,7 +221,7 @@ Goal: turn DMARQ into a broader email authentication posture console (still priv
 Planned:
 - MTA-STS posture: delivered cached `_mta-sts` TXT checks, HTTPS policy validation, domain-detail evidence, and operator guidance for missing, invalid, or non-enforcing policies. Optional helper tooling remains a future enhancement.
 - TLS reporting posture: delivered authenticated TLS-RPT upload for `.json`, `.json.gz`, and `.zip` attachments; duplicate-safe persistence by report ID and policy domain; daily session trends; top failure-cause grouping; affected-domain summaries; and explicit privacy controls that avoid storing message content or recipient data.
-- BIMI posture: record validation + readiness checks + operator guidance.
+- BIMI posture: delivered default-selector BIMI TXT validation, HTTPS logo/certificate URL checks, DMARC enforcement readiness checks, domain-detail evidence, and operator guidance for missing or blocked BIMI prerequisites.
 - Extended DNS checks that support the posture surface (e.g., MX/BIMI; optional DANE/TLSA where relevant).
 
 Exit criteria:

docs/reference/api.md

@@ -96,6 +96,15 @@ Returns details for a specific domain.
 }
 ```
 
+#### Get BIMI Posture
+
+```
+GET /domains/{domain_id}/dns/bimi
+```
+
+Returns the cached BIMI TXT posture for the default selector, including the
+queried DNS name, record text, logo URL, certificate URL, warnings, and errors.
+
 #### Add Domain
 
 ```

docs/user_guide/domains.md

@@ -71,6 +71,21 @@ DMARQ marks the check healthy when the TXT record contains `v=STSv1` with an `id
 
 MTA-STS posture uses the same cached DNS refresh behavior as the existing DNS health checks. Use the DNS refresh action when you publish or update a policy and need DMARQ to re-check immediately.
 
+### BIMI Readiness
+
+The domain detail page checks the default BIMI selector at
+`default._bimi.<domain>`.
+
+DMARQ validates that the BIMI TXT record starts with `v=BIMI1`, includes an
+HTTPS `l=` SVG logo URL, and uses HTTPS for the optional `a=` certificate URL.
+The readiness guidance also checks whether DMARC is ready for BIMI: the domain
+must use `p=quarantine` or `p=reject`, `pct` must be `100` or omitted, and any
+published `sp=` subdomain policy must also enforce.
+
+BIMI posture is read-only. Findings link back to the BIMI TXT record, logo URL,
+certificate URL, and DMARC policy evidence so operators can see which
+prerequisite is blocking readiness.
+
 ## Domain Groups
 
 If you manage multiple domains, you can organize them into groups: