[Bimi] BIMI headers that an MTA must delete

[Andrew C Aitchison <[e-mail]>]

I was re-reading the list archive and came across this from May 2024:
   AFAIK No MUAs actually implement it using those two headers, feel to
   list any. Current implementations seem to use Authentication-Results (or
   equivalent) but usable implementations seem to be limited to a specific
   pairings of MTA+MUA. This is in theory because some MTAs might be
   grossly insecure and do not remove/replace the AR header properly. (But
   at that point I'd say the MUA has bigger problems than forged BIMI.)
https://mailarchive.ietf.org/arch/msg/bimi/zSwqK5yyTuEYnuumvUv1NZEqSQs/

1. Could the draft-RFC be updated to say that the AR header MUST be 
removed/replaced, as well as (instead of ?) BIMI-Location, BIMI-Indicator
or BIMI-Logo-Preference ?

https://datatracker.ietf.org/doc/html/draft-brotman-ietf-bimi-guidance 
5.2.1 does suggest removing all BIMI-* headers but not 
Authentication-Results, upon receipt - but only a "should" not a "MUST" or 
"must".

https://datatracker.ietf.org/doc/html/draft-brand-indicators-for-message-identification
only disusses removing BIMI-Location, BIMI-Indicator and 
BIMI-Logo-Preference

2. You cannot really blame a non-BIMI-supporting MTA for *not* removing 
any of these headers. Calling them "grossly insecure" is not appropriate.
If you wish them to remove unsafe incoming headers, please make the 
(draft) standard clear on what they MUST do.

It is *not* satisfactory that we have a protocol currently in use across
the internet whose standard says that certain things MUST be done
*by third parties* to make it secure,
but does not accurately say what these things are.

-- 
Andrew C. Aitchison                      Kendal, UK
                    [e-mail]