What are these three records?
BIMI lets senders with enforced DMARC (quarantine/reject) show an SVG logo. The record is selector._bimi (usually default._bimi) TXT: v=BIMI1; l=https://…svg. Gmail typically wants a= (VMC); l= alone is not an inbox logo.
MTA-STS stops receivers from falling back to cleartext SMTP. You need both _mta-sts TXT (v=STSv1; id=…) and https://mta-sts.domain/.well-known/mta-sts.txt (version, mode, mx, max_age). mode: enforce requires TLS; testing/none only monitor.
TLS-RPT sends XML reports of SMTP TLS failures to rua= mailto: or https. The TXT lives at _smtp._tls. It can exist without MTA-STS; together they make more sense.
Green / amber / red
A missing record is amber: BIMI, STS and TLS-RPT are optional. Red means you published something broken — wrong v=, http l=, STS TXT without a policy file, or enforce while MX is not in mx: lines.
BIMI green needs v=BIMI1 + HTTPS l= + DMARC p=quarantine/reject. Without a VMC the card can still be green while Gmail will not show the logo; the note says so.
How to publish
BIMI: SVG Tiny PS, HTTPS, crawlable. Put DMARC on quarantine/reject first. VMCs come from a commercial CA; this tool does not validate the certificate.
MTA-STS: a valid HTTPS cert on mta-sts.domain (SNI). Policy is plain text under 8 KB. Changing id= makes receivers refetch. Wildcard mx: *.example.com does not cover the apex.
TLS-RPT: v=TLSRPTv1; rua=mailto:tlsrpt@domain. Read the reports and fix STARTTLS failures.