BIMI Asset Retrieved Only After Retrying Without User-Agent

What Does “BIMI Asset Retrieved Only After Retrying Without User-Agent” Mean?

The checker requested a BIMI asset — the VMC or CMC at the a= location, or the SVG logo at the l= location — and the request failed. The checker then sent the same request again without a User-Agent header, and that second request succeeded.

The checker validates the recovered asset as normal, so the rest of the report still describes your real logo and certificate. This result tells you that the first download failed, not that the asset is invalid. Brand Indicators for Message Identification draft 14 requires both assets to be served over HTTPS.

Why Does “BIMI Asset Retrieved Only After Retrying Without User-Agent” Appear?

The difference between the two requests is the User-Agent header, so the usual cause is a rule that filters on it:

• A CDN or web application firewall bot rule that blocks or challenges unknown User-Agent values.
• A hosting rule that allows only browser User-Agent strings.
• A rate limit that applies to one User-Agent and not to requests without one.

A transient failure on the first request can give the same result. One occurrence is not proof of filtering.

How Do You Fix “BIMI Asset Retrieved Only After Retrying Without User-Agent”?

Find the rule that rejected the first request. Examine the CDN, firewall and web server logs for the asset URL at the time of the check, and look for a block, a challenge page or a rate-limit response.

Allow automated GET requests to the exact logo and certificate URLs. Mailbox providers fetch these assets with their own User-Agent values, and you cannot list all of them, so an allow rule for the asset path is more reliable than an allow list of clients.

What Should You Verify After Fixing “BIMI Asset Retrieved Only After Retrying Without User-Agent”?

Fetch each asset URL from outside your network with a non-browser User-Agent and confirm a 200 response with the correct content type. Then run the check again and confirm this result is gone.

If the result comes back on some checks but not others, look for an intermittent rule such as a rate limit or a challenge that triggers on traffic volume.

Key Takeaways

• The asset downloaded only on a retry without a User-Agent header.
• The checker still validated the asset, so other results on the report are real.
• Look for a CDN, firewall or hosting rule that filters on User-Agent.
• Mailbox providers that do not retry may fail to fetch the asset and show no logo.