BIMI record has a syntax error
What this check looks for
A BIMI record is published but cannot be read, so no inbox will show your logo. The setup looks complete from the DNS side and does nothing.
Why it matters
You have paid for a mark certificate and prepared a logo, and none of it is reaching anyone until the record parses.
When the check passes, your report says: “The BIMI record parses cleanly”.
What it costs your score
When this check fails it removes 5 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.bimi family ceiling of 10 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 5 points
- Family cap
- email-auth.bimi · 10
- Category
- Email authentication
- Module
- Email bimi
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Republish a single, valid BIMI record.
An unparseable record is treated as no record at all.
Rebuild the record in the generator and publish it as one TXT record at
‹selector›._bimi.‹domain›.Delete any other BIMI TXT record at that name.
Check that
l=anda=are absolutehttps:URLs with no spaces.
How to confirm it worked
dig +short TXT ‹selector›._bimi.‹domain› — expect exactly one record starting v=BIMI1
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
Parsing ‹selector›._bimi.‹domain› failed: ‹parse error›. The BIMI draft requires v=BIMI1 as the first tag, followed by l= (the SVG location) and optionally a= (the mark certificate), separated by semicolons. Both l= and a= must be https: URLs or empty. More than one BIMI record at the name is also invalid and the whole set is ignored.
Standards and references
Test this on your domain
Run the check that produces this finding, on its own, against any domain.