search

authindicators / rfc-brand-indicators-for-message-identification

Other
19 stars 6 forks source link

BIMI location in the message headers - guaranteed DKIM break #2

Closed Lockhead closed 7 years ago

Lockhead commented 7 years ago

As soon as a mail already has an BIMI-Location Header that is also included in the DKIM signed headers list, the MTA that replaces this header will break DKIM and a MUA can not validate DKIM anymore.

tzink7 commented 7 years ago

BIMI-Location should not be included in the message headers. If it is, the MTA should either strip it or rename it. If DKIM-signed, then any downstream agent that tries to reverify DKIM will not be able to.

Lockhead commented 7 years ago

But the wording in the Document currently suggests that this is a possability. I would suggest that the wording should be changed to a more strict handling, like "if a BIMI location header already exists and there is no BIMI entry in the Authentication-Results Header, it is considered a BIMI fail."

Lockhead commented 7 years ago

closing this, as I try to remark this wis the pull request #6