Re: [Bimi] MUA Evaluation of BIMI (Marcel Bokhorst)

[Trent Adams <[e-mail]>]

Marcel -

Apologies if the code answers this… but how does FairEmail handle the situation where a domain publishes a BIMI record (which can be retrieved and validated), but a malicious actor sends an email impersonating the domain to an address at a mailbox provider that doesn't evaluate DMARC?

Unless the MUA can either authenticate the message on its own (e.g. via DKIM + DMARC alignment), or it can rely upon the MTA to perform the necessary evaluation of SPF, DKIM, and DMARC… then it seems possible the MUA can be tricked into displaying a BIMI logo.

… but perhaps you're doing something clever (that we might want to consider specifying).

- Trent

PS - Thanks, by the way, for helping us shine a light on how independent email clients can join the conversation!


From: bimi <[e-mail]> on behalf of Marcel Bokhorst <marcel=[e-mail]>
Date: Tuesday, March 22, 2022 at 10:42 AM
To: "[e-mail]" <[e-mail]>
Subject: Re: [Bimi] MUA Evaluation of BIMI (Marcel Bokhorst)

What I am wondering is if it wouldn't be simpler to just verify the certificate the BIMI record refers to and skip DMARC altogether. What are the benefits of checking DMARC? As a reference, see here about how FairEmail verifies the BIMI certificate.


What I am wondering is if it wouldn't be simpler to just verify the certificate the BIMI record refers to and skip DMARC altogether. What are the benefits of checking DMARC?



As a reference, see here about how FairEmail verifies the BIMI certificate.



https://urldefense.com/v3/__https://github.com/M66B/FairEmail/blob/master/app/src/main/java/eu/faircode/email/Bimi.java*L155__;Iw!!ORgEfCBsr282Fw!rkmciHccuFw_iUGaYB120yc37Woosombf1nhpPPXpA4mRkUplQwGVg7ZX6PV3YeCYnDokRZwyXXur4Hs9Hj_LkfCIYNHZSzN$



Basically, the domain name of the email address is the start point. The connection needs to be secure (https, etc), the certificate needs to be valid (dates, etc), the certificate needs to match the domain name, and the purpose needs to be "BIMI", and finally the certificate needs to chain to an installed root certificate.



The app still checks the DMARC record, but is that really necessary? The certificate matches the email address already after all. What am I missing?



Mar 22, 2022 5:20:28 PM [e-mail]:



> Send bimi mailing list submissions to

>     [e-mail]

>

> To subscribe or unsubscribe via the World Wide Web, visit

>     https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/bimi__;!!ORgEfCBsr282Fw!rkmciHccuFw_iUGaYB120yc37Woosombf1nhpPPXpA4mRkUplQwGVg7ZX6PV3YeCYnDokRZwyXXur4Hs9Hj_LkfCIQxwRY9l$

> or, via email, send a message with subject or body 'help' to

>     [e-mail]

>

> You can reach the person managing the list at

>     [e-mail]

>

> When replying, please edit your Subject line so it is more specific

> than "Re: Contents of bimi digest..."

> Today's Topics:

>

>    1. Re: MUA Evaluation of BIMI (Trent Adams)

> bimi mailing list

> [e-mail]

> https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/bimi__;!!ORgEfCBsr282Fw!rkmciHccuFw_iUGaYB120yc37Woosombf1nhpPPXpA4mRkUplQwGVg7ZX6PV3YeCYnDokRZwyXXur4Hs9Hj_LkfCIQxwRY9l$



--

bimi mailing list

[e-mail]

https://urldefense.com/v3/__https://www.ietf.org/mailman/listinfo/bimi__;!!ORgEfCBsr282Fw!rkmciHccuFw_iUGaYB120yc37Woosombf1nhpPPXpA4mRkUplQwGVg7ZX6PV3YeCYnDokRZwyXXur4Hs9Hj_LkfCIQxwRY9l$