[Bimi] BIMI & the MUA

["Brotman, Alex" <[e-mail]>]

Hey folks,

Over the past few months, we've been having some discussions about how the MTA may transfer information about the validation process to the user MUA.  We feel this is necessary so that providers who do not maintain their own (mobile) client can attempt to impart that information in a usable way, or so that those who do can allow users to employ third-party clients without loss of this ability.  While discussing this, we had a few criteria we thought should be met, where some of these are reasonable attempt at ensuring the information is reliable, q reasonable attempt at prevention of replay, and revocation (by the MBP).

We've come up with two methods:

One would be to create something akin to the A-R, but focused more on BIMI with specific data points for that goal.  This would also employ a DKIM-ish signature for that header, and the MUA would then be able to use this information when evaluating the message.  We haven't yet added this method to the core document, but that's where we believe it would reside.  For the alternate proposal, I've attached a document which was initially created nearly a year ago, but not generally circulated as it was being discussed (along with alternatives). This is a more complicated method, though, more complete as it relates to goals.

Thanks for your comments and time.

-- 
Alex Brotman
Sr. Engineer, Anti-Abuse & Messaging Policy
Comcast