bonus.bimi.vmc_unreachable

BIMI Evidence Certificate Not Reachable

What we check

When the BIMI record carries an a= tag, we fetch the referenced evidence document (Verified Mark Certificate) over HTTPS. This finding means the fetch failed: the URL is not HTTPS, does not resolve, refuses connections, answers with an error status, or answers with a redirect — the evidence URL must serve the document directly (redirects are not followed, as fetching operator-named URLs safely requires).

What this finding means

The a= tag points at a document nobody can retrieve. Mail providers that require a VMC before displaying the BIMI logo (notably Gmail and Apple Mail) fetch this URL themselves — an unreachable evidence document means the logo will not be displayed there, even if the rest of the BIMI setup is correct.

How to fix

  1. Confirm the a= URL is exact — a typo in the path is the most common cause.
  2. Serve the document over HTTPS with a routable, publicly reachable host; internal hostnames and plain HTTP are rejected.
  3. Check that the web server answers the URL with 200 OK and the PEM file as the body — not a 301/302 to another location; point the a= tag at the final URL instead.

How it's graded

Informational — the VMC checks carry no score weight. See Grading Methodology for the full scoring model.

Evidence example

default._bimi.example.com. TXT "v=BIMI1; l=https://example.com/logo.svg;
                                a=https://example.com/vmc.pem"
→ GET https://example.com/vmc.pem: 404 Not Found

References