[Bimi] Interpreting SANs according to draft-fetch-validation-vmc-wchuang-05

[Taavi Eomäe <[e-mail]>]

Hi,

I think I have stumbled upon an inconsistency between various BIMI/VMC 
implementations, how VMC SANs are expected to be defined and used. I'd 
really appreciate your opinion and advice.

The current draft says:

 > A Verified Mark Certificate MUST define one or more Subject 
Alternative Name (SAN) extension dNSName domain as defined by [RFC5280] 
that identifies the location of the BIMI Assertion record that was used 
to fetch the VMC. There may be stronger properties that can be said 
about the relationship between the VMC and the Assertion record 
depending on the validation done on dNSName, but that is outside the 
scope of this document. The domain name may either be the author or 
organizational name [...]

Consider the following scenario. A letter is sent using a domain 
(example.com), it passes both DKIM and DMARC alignment checks for the 
same domain (example.com). The BIMI TXT record is fetched using the 
default selector under that domain. Now the VMC certificate is also 
served from that same domain (example.com) but contains a subdomain in 
the SAN (www.example.com).

The SAN aligns with the sender domain if the same domain validation 
logic is used as one would for DMARC. It's the same organizational name, 
it provides organizational (name) alignment. Most implementations out 
there currently find this acceptable and display a logo.

Is there a reason why a mail client shouldn't consider the VMC valid and 
display the BIMI logo? Would it be possible to make this section of the 
draft more concise and easier to interpret?



Best Regards,
Taavi Eomäe
Zone Media OÜ
https://zone.ee