[Bimi] Re: Improvements on BIMI specification

["Brotman, Alex" <[e-mail]>]

I would be okay changing the avatar preference from “bimi” to “brand”.  It’s more clear as to which should be applied.   We’re also going to change (in the next version) the tag for avatar preference to be “avp” to avoid confusion with the umpteen other single character tags used today in authentication.

I’ve shown a document a few times on this list intended to allow the MUA to have knowledge from a BIMI-aware MUA.  As I haven’t gotten a lot of feedback, it’s not part of the BIMI roster of documents.
https://mailarchive.ietf.org/arch/msg/bimi/mhPqlUN0wtBZX3v4NL0HBDZw9S8/

--
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast

From: Taavi Eomäe <taavi=[e-mail]>
Sent: Monday, January 27, 2025 9:46 AM
To: [e-mail]
Subject: [Bimi] Re: Improvements on BIMI specification

On 27/01/2025 16:38, Andrew C Aitchison wrote:
BIMI cannot use exisiting headers for this, because they can be added by any MTA that the message passes through.
7.8 says that BIMI-Location and BIMI-Indicator headers MUST be removed
upon reciept, otherwise the security of BIMI is compromised.
If an existing header such as Authentication-Results were used instead,
then removing it would destroy possibly needed information
(eg. it could break confirmation of DKIM signatures).

That's the thing, "BIMI-Location" and "BIMI-Indicator" will not be removed by a BIMI-unaware MTA. It doesn't matter where it is, it's untrustworthy and the MUA doesn't know it (or would have to reverify everything). You can't use the new headers like that either.

But when the MTA is already BIMI-aware, then it actually doesn't matter, it might as well add it to the A-R it is going to add anyways, a proper MTA is supposed to remove/rename any previous A-R headers anyways. (If and how it would help a MUA is a different client, letting the MUA know it's BIMI-aware is still a missing link or a configuration option, I guess.)