Re: [Bimi] Thoughts about MUA/BIMI

[Todd Herr <[e-mail]>]

On Thu, Aug 11, 2022 at 10:21 AM Brotman, Alex <Alex_Brotman=
[e-mail]> wrote:

> In thinking more about the MUA proposal, we are trying to find a solution
> for the case where an unaffiliated[1] MUA would like to be able to either
> independently validate message authentication details (to support DMARC),
> or rely upon the validation process from the MBP.
>
>
>
> [snip]
>

I've got a long-standing bias toward the idea that the only
authentication/validation results that matter are the ones that were
arrived at when the message was written to the mailbox, because results can
be different upon subsequent checks, mainly due to potential differences in
the resolvability and content of the various DNS records retrieved during
the validation processes.

In this case, my bias would argue for the unaffiliated MUA to do no
validation, and instead rely on signals inserted in the message by the MBP
at the time of delivery.

I recognize, however, that this method is fraught with peril, specifically
due to the possibility of forged headers inserted by abusers and ignored by
MBPs that are not BIMI-aware. I also recognize that the idea of results
changing due to new information being available is not always a bad thing,
as I recall some MBPs in the past talking about automatically moving
messages from the Inbox to the Spam folder based on new information learned
after the message was written to the mailbox (assuming, of course, that the
message had not yet been seen by the recipient).

On the other hand, I also recognize that attempts by an MUA to perform
authentication/validation checks on messages are perhaps not as thorough
(Alex's message recommends against doing any SPF check) and that the DKIM
result might erroneously be "fail" due to changes made by the MBP during
writing of the message to the mailbox, even if it passed DKIM checks
performed by the MBP.

I'm trying to talk myself out of my bias, but I can't get there yet,
because I can't yet see a way for the unaffiliated MUA to get the same
results as the MBP got at the time of delivery.



-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [e-mail]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.