Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Todd Herr <[e-mail]>]

On Tue, Jul 19, 2022 at 3:20 PM Dave Crocker <[e-mail]> wrote:

> On 7/19/2022 12:14 PM, Todd Herr wrote:
> > To me, BIMI's reliance on DMARC passing (and being at something other
> > than p=none) means that the condition at time of message receipt is
> > the only one that matters.
>
> So if the message is displayed much later, and the BIMI certification
> has become invalid, it is ok to still display the mark that was
> associated at the original time of validation?
>

One of the bits of information available to be included in the recorded
results is policy.authority-uri, which would be the URI of the evidence
document checked at the time of the message receipt, so I would expect an
MUA to know that the certification is now invalid.

Note also that BIMI certification is not currently a universal concept for
MBPs that support BIMI. Gmail requires them (in the form of VMCs) but Yahoo
does not.

Now, let me turn your question on its head...

If the consensus lands on the idea of the MUA doing its own checks, how
would the MUA answer these questions:

   - What was the DMARC policy for the RFC5322.From domain at the time the
   message was sent?
   - What was the SPF record for the RFC5321.MailFrom domain at the time
   the message was sent?
   - Did a BIMI Assertion Record exist for the domain at the time the
   message was sent?

Put another way, is it ok to display the mark for the message now even if
it wasn't when it was received or even if it wasn't because BIMI didn't
exist for the domain at the time the message was received?

-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [e-mail]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.