Re: [Bimi] MUA Evaluation of BIMI

[Jakub Olexa <[e-mail]>]

Hi Trent,

my concern with this approach is that it would essentially prevent MUAs 
from implementing BIMI support.

a) ARC would essentially become a requirement for BIMI outside the BIMI 
standard itself
b) MBPs would have to implement ARC, which would result in reduced 
support for BIMI
c) MUAs would have to do way more complex checks then they do at the 
moment... involving DNS lookups, signature validation etc. - this could 
be a problem when logos are displayed in the message list

For example when using Fairmail on our mailserver via IMAP I'm getting 
all the info about authentication from the headers added by our MTA and 
FairMail will display BIMI where available. We haven't had to do any 
changes to our MTA to get BIMI working. This will most likely apply to a 
large number of mail servers. Having an ARC requirement would break 
it... and for what good?

Jakub Olexa
Founder & CEO
E-mail: [e-mail]
Tel: [phone] <tel:[phone]>

Mailkit - Closing the circle between Deliverability and Engagement 
<https://www.mailkit.com>

On 15.03.2022 16:14, Trent Adams wrote:
>
> OK… what if we start from the premise that an MUA **MAY** evaluate 
> BIMI, but in order to do is it **MUST** be able to trust the 
> Authentication-Results header supplied by the mailbox provider (read: 
> it there's no trusted A-R header, the MUA **MUST NOT** display the 
> BIMI logo)…
>
> Given that… What if the specification calls for the mailbox provider 
> performing BIMI validation to ARC sign the messages they receive? 
>  Would that be a useful way to preserve the A-R results such that the 
> MUA can verify them?
>
> Curious,
>
> Trent
>
> *From: *"Brotman, Alex" <Alex_Brotman=[e-mail]>
> *Date: *Monday, March 14, 2022 at 2:56 PM
> *To: *Ken O'Driscoll <[e-mail]>, Trent Adams 
> <[e-mail]>
> *Cc: *"[e-mail]" <[e-mail]>
> *Subject: *RE: MUA Evaluation of BIMI
>
> > It’s really up to the user of the MUA to determine whether or not to trust upstream 
> authentication headers. There are already plugins for the likes 
> Roundcube and Thunderbird that are parsing the current AR headers. ‍ ‍ 
> ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍ ‍
>
> > It’s really up to the user of the MUA to determine whether or not to trust upstream authentication headers. 
> There are already plugins for the likes Roundcube and Thunderbird that 
> are parsing the current AR headers.
>
> I feel like an item that needs to be considered is that if you’re to 
> rely on these headers, you need to have a reasonable assurance they 
> came from the MBP for which the message was intended.  Do we need 
> notes to describe how it is that the MUA is meant to evaluate that 
> header and its origin?  Or is that beyond our scope?
>
> --
>
> Alex Brotman
>
> Sr. Engineer, Anti-Abuse & Messaging Policy
>
> Comcast
>
>