[Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Trent Adams <[e-mail]>]

Having reviewed the conversational threads on the topic, I believe we've reached a reasonable consensus on how to clarify the role of MUAs in evaluating BIMI.  Here's where I think we landed:


  *   MUAs affiliated with MBPs can (typically) rely upon the authentication and BIMI evaluation performed by the MBPs.
  *   MUAs unaffiliated with MBPs from which they retrieve email shouldn't rely upon the BIMI evaluation performed by the MBPs.
  *   There are some methods (e.g. DKIM verification + DMARC alignment) that could enable an MUA to locally authenticate email and evaluate BIMI.

The following suggested update to "Section 4.1 MUA Obligations" (renaming it "Role of the MUA in BIMI Evaluation") attempts to describe the situation:

-----
Section 4.1. Role of the MUA in BIMI Evaluation

An MUA displaying BIMI indicators SHOULD rely on the authentication and BIMI evaluation performed by an affiliated MBP, or the MUA MAY perform the required verification using the information contained within the email.  MUAs affiliated with an MBP SHOULD rely upon the evaluation performed by the email evaluated by MBP by using the BIMI-Location header inserted by the MTA.  MUAs that are not affiliated with the MBP from which they retrieve the email MUST perform their own evaluation.  For example, the MUA MAY verify an intact DKIM signature and use the result to validate DMARC alignment prior to evaluating BIMI.  An MUA SHOULD NOT rely on the Authentication-Results or BIMI-Indicator headers inserted into the email by MTAs that the MUA cannot verify to be authentic.

When evaluating BIMI, the MUA SHOULD make a best-effort attempt to adhere to the Domain Owner's published BIMI policy. It is understood, however, that MUAs have final control over the user interface published to their end users, and MAY use alternate Indicators than those specified in the BIMI Assertion Record or display no Indicator at all.
-----

Similarly, it might make sense to also add the following to the "Security Considerations" section:

-----
Some MUAs can retrieve email from multiple MBPs, some of which are affiliated with the MUA, others are not.  In some cases, the MUA may be affiliated with an MBP that evaluates BIMI while the MUA may also retrieve email from another unaffiliated MBP that may or may not evaluate BIMI.  While the MUA may leverage the BIMI-Indicator header inserted by the affiliated MBP, the MUA should not rely on the same header inserted by unaffiliated MBPs.  There is a risk that an MBP may be inserting headers that are malicious in nature or are the result of verification procedures the MUA finds less than adequate.  For example, an MUA may not know if the MBP strips wayward headers during initial evaluation upon receipt, potentially leaving errant BIMI-Indicator headers in place.
-----
How does this proposed update sit with folks?

- Trent

--
J. Trent Adams
Director, Ecosystem Security
Proofpoint

[e-mail]
https://www.linkedin.com/in/jtrentadams