Re: [Bimi] Proposal to Clarify Role of MUA in BIMI Evaluation

[Todd Herr <[e-mail]>]

On Tue, Jul 19, 2022 at 3:40 PM Dave Crocker <[e-mail]> wrote:

> On 7/19/2022 12:30 PM, Todd Herr wrote:
>
>
>    - What was the DMARC policy for the RFC5322.From domain at the time
>    the message was sent?
>    - What was the SPF record for the RFC5321.MailFrom domain at the time
>    the message was sent?
>    - Did a BIMI Assertion Record exist for the domain at the time the
>    message was sent?
>
> Put another way, is it ok to display the mark for the message now even if
> it wasn't when it was received or even if it wasn't because BIMI didn't
> exist for the domain at the time the message was received?
>
>
> DMARC, DKIM and SPF (in this use) are strictly for authentication.  And
> the latter two were only designed for transit-time evaluation.  (Arguably
> this also applies to DMARC.)
>
Moreover, they have nothing to do with trust of substance, other than a
> domain name.
>
> Presumably authorization to use a BIMI mark is more than that, pertaining
> to some matter(s) of business and display trust.  That level of trust that
> presumably could be withdrawn after initial validation, even as domain name
> authorization remains.
>

The current version of the draft BIMI spec mandates that a message receive
a DMARC 'pass' verdict (or the equivalent in ARC headers) in order for BIMI
processing to even take place.

This says to me that any scheme requiring the MUA to do its own BIMI
validation be one that takes into account the DMARC validation result at
time of message receipt.

-- 

*Todd Herr * | Technical Director, Standards and Ecosystem
*e:* [e-mail]
*m:* 703.220.4153

This email and all data transmitted with it contains confidential and/or
proprietary information intended solely for the use of individual(s)
authorized to receive it. If you are not an intended and authorized
recipient you are hereby notified of any use, disclosure, copying or
distribution of the information included in this transmission is prohibited
and may be unlawful. Please immediately notify the sender by replying to
this email and then delete it from your system.