[Bimi] Re: BIMI headers that an MTA must delete

[Taavi Eomäe <[e-mail]>]

Hi,

I think we actually agree on quite a few points here, I'll try to 
clarify a bit.

On 16.06.2025 19:02, John C Klensin wrote:
> RFC 5321 and, more important, the Internet Standard
> draft-ietf-emailcore-rfc5321bis-43 (for which a Protocol Action
> Notice was posted at the end of April), strongly discourage MTAs from
> looking at header fields at all, much less tampering with them.

The current draft does instruct to tamper with BIMI-* headers. My 
suggestions were exactly to avoid that, to take what's there and provide 
an assessment in an header (A-R). Like it is done with DMARC, SPF and DKIM.

In some previous thread it has been said that it might be possible to 
forge AR (or BIMI-*) when it's not added by the last hop/recipient. I 
presume in the case of some old MTA that does not know about the 
header(s), does not do DMARC, SPF or DKIM, certainly not BIMI. BIMI 
obviously can't dictate what they should be doing. But such a system 
would also not be advertising BIMI support to a MUA downstream.

This would basically be your case number 1. To avoid having to dictate 
anything to any MTAs that are unaware, avoid creating situations where 
the entire chain has to be aware, avoid all that complexity. When all 
that could matter is that an aware MTA taking part in the final delivery 
validates signed headers, records that in the headers and that the MUA 
is signaled somehow that "that last hop was BIMI-aware".


Best,
Taavi