[Bimi] Re: Improvements on BIMI specification

[Andrew C Aitchison <[e-mail]>]

On Mon, 27 Jan 2025, Ben van Hartingsveldt | Yocto wrote:

> Taavi Eomäe schreef op 2025-01-27 13:45:
>> On 27/01/2025 15:07, Ben van Hartingsveldt | Yocto wrote:
>>> - Section 2:
> You want BIMI to work only on real emails from that company, indeed, not the 
> spoofed ones. It seems that those 3 headers are now in the spec because the 
> server is more knowledgable on what is fake and what is not, and only adding 
> the headers to the mail when it validated the mail being authentic. I'm not 
> against adding headers, but a simple "BIMI-Validated: 1" would do the same 
> thing, I guess, without having breakable URLs within its headers. Also, there 
> may be some already existing headers like "Authentication-Results" that can 
> be used instead of introducing a new header like "BIMI-Validated".

BIMI cannot use exisiting headers for this, because they can be added by 
any MTA that the message passes through.
7.8 says that BIMI-Location and BIMI-Indicator headers MUST be removed
upon reciept, otherwise the security of BIMI is compromised.
If an existing header such as Authentication-Results were used instead,
then removing it would destroy possibly needed information
(eg. it could break confirmation of DKIM signatures).

-- 
Andrew C. Aitchison                      Kendal, UK
                    [e-mail]