Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Todd Herr <[e-mail]>]

On Tue, Jul 19, 2022 at 9:32 PM Richard Clayton <[e-mail]>
wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> Hash: SHA1
>
> In message <[e-mail]1
> 4.prod.outlook.com>, Tim Hollebeek <tim.hollebeek=40digicert.com@dmarc.i
> etf.org> writes
>
> >    I’m a bit concerned about the discussion of attempting to perform
> >    the checks at any other time, and I’m even more concerned about
> >    what seems to be assertions that it’s ok if the quality of the
> >    checks “degrades over time” as if this were a natural or
> >    unavoidable state.  I think everything possible should be done to
> >    avoid that outcome.
>
> there appears to be an assumption in some of the discussion that
> although all sorts of other information might degrade over time (or be
> hard for an MUA to establish post hoc) that the image itself is still
> magically available for fetching ...
>
>
I'm not clear on what you mean by the phrase "magically available for
fetching" here.

The current draft of the BIMI specification describes a "BIMI Assertion
Record" (
https://datatracker.ietf.org/doc/html/draft-brand-indicators-for-message-identification#section-4.2)
as a relatively straightforward DNS TXT record, one making use of a
tag-value syntax, not unlike a DMARC policy record.

One of the two possible tags in the BIMI Assertion record is "l="
(lowercase ell), defined as:

   location (URI; REQUIRED).  The value of this tag is either empty
   indicating declination to publish, or a single URI representing the
   location of a Brand Indicator file.  The only supported transport is
   HTTPS.


The "Brand Indicator file" is the SVG file containing the image to be shown
if the message meets requirements for doing so.

What's magic about that?

-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [e-mail]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.