Certificate Not Valid for the Domain

What Does “Certificate Not Valid for the Domain” Mean?

“Certificate not valid for the domain” means none of the Verified Mark Certificate’s Subject Alternative Name (SAN) dNSName entries matches a domain permitted for the evaluated BIMI assertion. The VMC may be structurally valid and trusted but still lack the required relationship to the domain using it.

This output concerns the VMC in the PEM file referenced by the BIMI record’s a= tag. It does not refer to the TLS certificate for the web server hosting that file.

Which Domain Names Can a BIMI VMC Match?

For SAN names that do not contain the _bimi label, a BIMI VMC can match the message’s Author Domain or Organizational Domain. The current VMC draft also defines selector-qualified domain forms, subject to the certificate-profile conflict described below. The Author Domain comes from the visible From address, while the Organizational Domain is determined using the applicable domain-suffix rules.

For a message from mail.example.com, the ordinary domain forms can include:

A VMC can contain multiple SAN dNSName entries, and one permitted exact match is sufficient. Domain comparisons are case-insensitive after the canonicalization described by RFC 5280 section 7.2.

The current VMC validation draft also describes selector-specific names such as campaign._bimi.example.com. Current Mark Certificate Requirements, however, prohibit underscores in SAN dNSName entries. Under current Mark Certificate Requirements version 1.8, use an ordinary Author Domain or Organizational Domain SAN; the selector-qualified draft forms cannot be issued in a compliant Mark Certificate while that underscore prohibition remains.

Why Does a BIMI Certificate Fail the Domain Check?

A BIMI certificate fails the domain check when all usable SAN domain names differ from every domain form permitted for the evaluated BIMI assertion.

• The VMC was issued for an unrelated domain.
• The VMC covers one subdomain while mail uses a different sibling subdomain and the certificate omits their Organizational Domain.
• A new sending domain was introduced after issuance.
• The validator evaluates a different visible From domain than expected.
• A certificate intended for another brand or business unit was published accidentally.

The certificate’s common name, organization name and PEM-hosting URL do not replace a matching SAN dNSName.

How Do You Fix a Certificate that is Not Valid for the BIMI Domain?

Fix a VMC domain mismatch by obtaining a reissued certificate whose SAN includes a permitted domain name—normally the appropriate Author Domain or Organizational Domain given the current certificate-profile conflict. Certificate fields are cryptographically signed, so you cannot safely add or edit a SAN in the existing PEM file.

1. Identify the visible From domain for an affected message.
2. Determine its Organizational Domain and the BIMI assertion record evaluated.
3. Inspect the end-entity VMC SAN entries with openssl x509 -in mark-certificate.pem -noout -ext subjectAltName.
4. Compare each DNS: entry with the Author and Organizational Domains.
5. If none matches, ask the issuing Mark Verifying Authority to validate the required domain and reissue the certificate.
6. Publish the replacement chain and update a= if its location changed.
7. Rerun complete BIMI validation.

Do not move BIMI records or change sending domains merely to fit an incorrect certificate unless that is an intentional architecture decision. Correcting the SAN relationship clears only the domain-match condition; the replacement VMC must still pass chain, validity, revocation, profile and embedded-logo checks.

What Happens When the VMC Does Not Match the Domain?

A VMC domain mismatch causes evidence validation to return an error, so the receiver cannot treat that VMC as successfully validated evidence. A receiver reporting BIMI results can record bimi=fail and an authority status of fail.

Fixing the mismatch does not guarantee logo display. Mailbox providers can apply additional authentication, reputation, certificate-support and display policies.

What Should You Check After Correcting the Domain Match?

After correcting the domain match, validate the complete VMC, served certificate chain and BIMI configuration. Separate failures can remain when the a= URL is inaccessible, the PEM is malformed, the chain is incomplete or untrusted, the certificate is expired or revoked, the hosted SVG differs from the embedded indicator, or authentication requirements are unmet.

Key Takeaways

• For a certificate issued under current Mark Certificate Requirements version 1.8, the VMC SAN must exactly match an allowed Author Domain or Organizational Domain; selector-qualified _bimi forms remain an unresolved draft/profile conflict.
• A sibling subdomain, wildcard or PEM-hosting domain does not satisfy the specified equality check.
• A domain change requires certificate reissuance when neither the new Author Domain nor its Organizational Domain is already covered by a permitted SAN; manual PEM editing cannot add signed coverage.
• A successful domain match does not prove complete VMC validity or guarantee display.

Frequently Asked Questions About BIMI Certificate Domain Matching

### Does the BIMI VMC Need to Cover the Hostname in the a= URL?

No, the BIMI VMC does not need to cover the hostname serving the a= URL. The VMC SAN is compared with permitted assertion domains, while the hosting server presents a separate TLS certificate for its hostname.

### Can One BIMI VMC Cover Multiple Sending Domains?

Yes, one BIMI VMC can contain multiple SAN dNSName entries. Each sending domain must match at least one permitted Author or Organizational Domain entry, and the issuer must validate every included domain.

### Can a Wildcard SAN Cover BIMI Subdomains?

No, the specified VMC domain-verification procedure does not expand wildcard SAN entries. It uses a case-insensitive exact comparison of the complete canonical domain name.