Re: [Bimi] MUA Evaluation of BIMI

[Jakub Olexa <[e-mail]>]

Hi Trent,

FairMail does a very good job at checking the Authentication-Result 
headers to make a decision about whether should be displayed or not. MUA 
should be able to take advantage of the Authentication-Result headers 
and do this. Discouraging BIMI would mean limiting adoption.

Jakub Olexa
Founder & CEO
E-mail: [e-mail]
Tel: [phone] <tel:[phone]>

Mailkit - Closing the circle between Deliverability and Engagement 
<https://www.mailkit.com>

On 12.03.2022 0:35, Trent Adams wrote:
>
> I'm looking for clarity about what folks think about whether or not 
> MUAs alone can evaluate BIMI (or be discouraged from doing so).  
> Either way… I think the next draft of the specification needs to be 
> more clear (as its currently ambiguous).
>
> To provide context… most of the MUAs supporting BIMI today are 
> operated by major mailbox providers that control their clients.  That 
> means that the MUAs (whether they're desktop, mobile, or web clients) 
> are designed to inherently trust the MTAs validation of BIMI and the 
> underlying AuthN requirements.  So, this question is really more aimed 
> at addressing the issues of "independent" MUAs (i.e. email clients 
> that are developed by folks without ties to specific mailbox 
> providers)… something like FairEmail <https://email.faircode.eu/>.
>
> On the one hand, it's the MTA that's performing the underlying 
> validation required by BIMI (e.g. SPF, DKIM, and DMARC).  And since 
> the MUA may not have access to the necessary information in order to 
> perform the validations (e.g. SPF), it relies upon the evaluation 
> performed by the MTA.  Without a close coupling between the evaluating 
> MTA and the MUA… perhaps BIMI validation should be discouraged.
>
> On the other hand, even if an independent MUA doesn't have access to 
> the initial conditions available to the MTA, there are signals they 
> can use for BIMI.  For example, perhaps they can forego SPF and only 
> rely upon DKIM (which may survive all the way to the MUA).  So, maybe 
> there's a path there (albeit with diminished returns).
>
> So, that's what I'm wondering about… how can the next draft of the 
> specification be improved to clarify whether MUAs can (or should not) 
> implement BIMI.
>
> Thoughts?
>
> - Trent
>
> -- 
>
> *J. Trent Adams*
>
> /Director, Ecosystem Security/
>
> *Proofpoint*
>
> [e-mail]
>
> https://www.linkedin.com/in/jtrentadams
>
>