Thanks for your request.

I have read and accepted the Terms and Conditions and Privacy Policy and consent to receive Red Sift communications.

{count} matching items are hidden by your filters.

There were no results matching your search criteria.

Become a partner

Become a Partner

Paste the exact error your validator reported and find out what it means, what causes it, and how to fix it. Covering BIMI, SPF, DKIM, DMARC and more.

Look up any SPF, DKIM, DMARC or BIMI validator error: what it means, what causes it, and how to resolve it.

Email authentication error glossary | Red Sift

No errors match your search. Try pasting the exact message your validator reported.

The BIMI SVG logo has a DOCTYPE declaration, which SVG Tiny 1.2 does not use and a certificate authority can reject.

SVG Logo Has a DOCTYPE Declaration

The validator cannot read the character encoding of the BIMI SVG logo, so it cannot check the logo.

SVG Logo Uses an Unsupported Character Encoding

The BIMI logo or certificate failed to download with the checker's User-Agent header and downloaded only when the checker retried without one.

BIMI Asset Retrieved Only After Retrying Without User-Agent

The BIMI SVG logo is not well-formed XML, so no validator or mailbox provider can read it.

SVG Logo Is Not Well-Formed XML

The BIMI SVG logo has an element that the SVG Tiny P/S schema does not declare, such as clipPath, mask or filter.

SVG Logo Has an Element That SVG Tiny P/S Does Not Allow

An element or text in the BIMI SVG logo is inside a parent that the SVG Tiny P/S schema does not allow it in.

SVG Logo Has an Element at a Position That SVG Tiny P/S Does Not Allow

A path in the BIMI SVG logo uses a command that SVG Tiny 1.2 does not allow, usually the arc commands A and a.

SVG Logo Path Uses a Command That SVG Tiny 1.2 Does Not Allow

An attribute in the BIMI SVG logo has a value that the SVG Tiny P/S schema does not allow, or a required attribute is missing.

SVG Logo Has an Attribute Value That SVG Tiny P/S Does Not Allow

“Timed out fetching the BIMI asset” means the checker exceeded its time limit before a BIMI logo or evidence fetch completed. BIMI assets must be retrievable, but the protocol does not define one univ

Timed Out Fetching the BIMI Asset

“Authority URL scheme is not HTTPS” means the BIMI record's non-empty a= authority URI does not use HTTPS. The BIMI draft requires a non-empty a= URI to specify HTTPS. Brand Indicators for Message Ide

Authority URL Scheme is Not HTTPS

“Both 'l' and 'a' tags missed” means the checker found a record containing neither an l= tag nor an a= tag. The current BIMI draft requires l= and makes a= optional, so the error name must not be read

Both 'l' and 'a' Tags Missed

“BIMI Record validation errors” means the checker found one or more structural or semantic validation errors in the BIMI record. The BIMI draft defines exact tag-value syntax and required-field behavi

BIMI Record Validation Errors

“Invalid record” means the candidate BIMI TXT value cannot be parsed as the required tag-value record. The BIMI draft says receivers must not repair syntax or capitalization errors. Brand Indicators f

Invalid Record

“SVG logo dimensions use non-pixel values” means the validator found a root SVG width or height value that does not meet Gmail's absolute-pixel requirement. Google requires absolute pixel dimensions f

SVG Logo Dimensions Use Non-pixel Values

“Certificate can't be accessed automatically” means an automated client is denied, challenged, or otherwise prevented from downloading the published certificate. The BIMI and VMC drafts describe the e

Certificate Can't Be Accessed Automatically

“SVG logo dimensions below 96x96 pixel minimum” means the checker found numeric root width and height values, but at least one dimension is below Gmail's documented 96-pixel minimum. A file with width

SVG Logo Dimensions Below 96x96 Pixel Minimum

“No BIMI record found and DMARC policy is insufficient” means the checker found neither a usable BIMI record nor sufficient DMARC enforcement. The BIMI draft requires DMARC eligibility before assertio

No BIMI Record Found and DMARC Policy is Insufficient

“BIMI record found on organizational domain” means the BIMI record was selected from the organizational domain after the author-domain lookup returned no usable record. The BIMI draft explicitly defin

BIMI Record Found on Organizational Domain

“Connection to the BIMI asset host failed” means the asset hostname resolved, but the checker could not establish the network connection. The published HTTPS resource must be reachable before BIMI can

Connection to the BIMI Asset Host Failed

“VMC PEM bundle omits the root CA certificate” means the served PEM contains the VMC and at least one intermediate but no terminal root certificate. The VMC draft permits omission of the root, while G

VMC PEM Bundle Omits the Root CA Certificate

“Non-HTTPS URL encountered while fetching the VMC certificate” means certificate retrieval encountered a non-HTTPS authority URL at fetch time. The VMC validation algorithm requires the a= retrieval U

Non-HTTPS URL Encountered While Fetching the VMC Certificate

“VMC leaf certificate selection is ambiguous” means the fetched PEM does not resolve to exactly one parseable end-entity VMC and its issuer chain. The VMC draft requires a single valid VMC certificate

VMC Leaf Certificate Selection is Ambiguous

“Logo validation errors” means the retrieved logo failed one or more SVG or BIMI indicator validation checks. The BIMI draft requires indicator validation, and the BIMI Group publishes an executable S

Logo Validation Errors

“No record” means the checker found no BIMI record for the evaluated domain. The BIMI draft queries the author domain first, then the organizational domain, and stops when no record remains. Brand Ind

No Record

“Certificate not valid for the domain” means none of the Verified Mark Certificate’s Subject Alternative Name (SAN) dNSName entries matches a domain permitted for the evaluated BIMI assertion. The VMC

Certificate Not Valid for the Domain

“Failed to fetch logo” means the checker found a logo location in the BIMI record but could not retrieve the referenced SVG over HTTPS. It is a retrieval failure, not proof that the SVG content itself

Failed to Fetch Logo

“No version in record” means the checker found that the BIMI record is missing its v= version tag. The BIMI draft requires v=BIMI1 to be first and says records without the current version are discarde

No Version in Record

“Missing l= tag” means the BIMI Assertion Record published in DNS has no lowercase l tag. When a record publishes its logo through l=, a nonempty value identifies the HTTPS location of the BIMI indica

Missing l= Tag

“VMC certificate chain ordering does not match expected issuance order” means the PEM certificate blocks do not follow leaf-to-root issuance order. The VMC draft says the download should be ordered fr

VMC Certificate Chain Ordering Does Not Match Expected Issuance Order

“Multiple BIMI records found on target domain” means more than one current-version BIMI TXT record remains at the selected lookup name. The BIMI draft stops assertion discovery when the remaining set

Multiple BIMI Records Found on Target Domain

“VMC PEM bundle contains only the leaf certificate” means the fetched PEM bundle contains one end-entity VMC and no issuer certificate. The VMC draft requires every intermediate certificate but makes

VMC PEM Bundle Contains Only the Leaf Certificate

“BIMI asset host could not be resolved” means DNS resolution returned no usable address for the hostname in a BIMI asset URL. HTTPS retrieval depends on resolving the URI host through DNS. Domain Name

BIMI Asset Host Could Not Be Resolved

“VMC PEM starts with UTF-8 BOM” means the served PEM bytes begin with the UTF-8 byte-order-mark sequence before the first certificate boundary. RFC 7468 permits data before an encapsulation boundary a

VMC PEM Starts with UTF-8 BOM

“VMC certificate chain signature verification failed” means at least one certificate signature does not verify against the next issuer in the intended VMC path. The VMC draft requires signature and pa

VMC Certificate Chain Signature Verification Failed

“VMC certificate chain does not terminate at a trusted BIMI root CA” means the constructed VMC path does not end at a root in the receiver's trusted BIMI root set. The VMC draft requires the path to l

VMC Certificate Chain Does Not Terminate at a Trusted BIMI Root CA

“No VMC in record” means the checker reports that VMC evidence is missing from the BIMI record. The BIMI draft makes a= optional, while Gmail's current setup requires a VMC or CMC. Brand Indicators fo

No VMC in Record

“Failed to fetch authority certificate” means the checker could not retrieve the evidence document referenced by the BIMI record's a= URI. The VMC draft requires the evidence document to be fetched ov

Failed to Fetch Authority Certificate

“VMC validation errors” means the referenced VMC failed at least one certificate parsing, profile, path, validity, revocation, transparency, domain, or logo check. The VMC draft defines an ordered val

VMC Validation Errors

“TLS handshake failed fetching the BIMI asset” means the checker could not establish the secure HTTPS connection needed to retrieve the logo at l= or the authority evidence at a=. Because the connecti

TLS Handshake Failed Fetching the BIMI Asset

“SVG logo missing width or height attributes” means the validator found that the root SVG lacks width, height, or both under Gmail's explicit-dimension requirement. Google requires explicit absolute d

SVG Logo Missing Width or Height Attributes

“Valid record, but DMARC isn't ready” means the BIMI record parses, but the evaluated domain does not meet BIMI's DMARC enforcement boundary. The BIMI draft requires quarantine or reject on both relev

Valid Record, but DMARC Isn't Ready

“Declination to publish” means the selected BIMI record explicitly declines publication with an empty l= and an empty or omitted a=. The BIMI draft treats an omitted a= as empty, so an empty l= plus a

Declination to Publish

“Logo URL scheme is not HTTPS (missing VMC in record)” means the checker found a logo URI that does not use HTTPS. The BIMI draft requires the l= URI to use HTTPS; its a= evidence tag is optional at t

Logo URL Scheme is Not HTTPS (Missing VMC in Record)

“Duplicate tag detected in BIMI record” means one tag name appears more than once inside a single BIMI record. BIMI uses DKIM-derived tag-value syntax, where duplicate tag handling must not create amb

Duplicate Tag Detected in BIMI Record

Why choose Certificates

Protect against phishing and BEC attacks.

Stop brand abuse, fraud, and lookalike attacks.

Real-time discovery and seamless monitoring for certificates.

Discover and manage external facing and cloud assets.

The skilled up LLM that finds and fixes security issues 10x faster.

Products

Features

Why choose OnDMARC

Why choose Brand Trust

Why choose Radar

Why choose ASM

Partner Programs

MSPs

Distis & Resellers

Alliance partners

Resources

Company

Check and validate DMARC, SPF, DKIM and other protocols.

Check to see if your brand could display a BIMI logo.

Create and prepare a BIMI-compliant logo and certificate package.

Check if you are protected against sender address forgery.

Quickly determine if your email setup is ready for Microsoft's new high-volume email sender requirements.

Check whether poisoned domains exist inside your SPF configuration.

Email Security

Get free expiration monitoring for up to 250 certificates.

Web & PKI Security

Benchmark your TLS, SPF, DKIM and DMARC setup against industry standards and get clear guidance on what to fix first.

Email authentication error glossary

BIMI

Record & policy

Logo & SVG

Certificate & VMC

Asset fetch & network

DNS & lookup

Alignment & authentication