bonus.bimi.vmc_expired
BIMI Evidence Certificate Outside Validity Window
What we check
When the BIMI record carries an a= tag, we fetch the evidence document (Verified Mark Certificate), parse its leaf certificate, and compare the current time against the certificate's notBefore/notAfter window.
What this finding means
The VMC leaf certificate is expired — or, more rarely, not yet valid. Mail providers that require a VMC re-validate it when deciding whether to display the BIMI logo; a certificate outside its validity window is rejected, and the logo disappears from those clients even though the DNS record and logo are fine.
How to fix
- Request a renewed Verified Mark Certificate from your mark-verifying authority (typically DigiCert or Entrust).
- Replace the document at the
a=URL with the renewed full PEM chain. - VMCs are typically valid for one year — put the renewal on the same calendar as your TLS certificates.
How it's graded
Informational — the VMC checks carry no score weight. See Grading Methodology for the full scoring model.
Evidence example
→ fetched vmc.pem: PEM chain parses,
leaf notAfter 2026-02-01 09:00:00 UTC — expired 204 days ago