Do not use or implement BIMI

BIMI is a highly problematic standard to display logos in e-mails.

I may create a webpage with an overview of BIMI's problems here in the future. For now, I am collecting some links of things I wrote elsewhere.

• 2024-05-26: Verified Mark Certificates with SVGs not compliant with the Tiny PS (Portable/Secure) profile / Script to validate SVGs in VMCs
• 2024-05-18: Presentation at miniDebConf Berlin (video recording will be available soon)
• 2024-05-12: No cryptographic connection between VMC and DKIM key
• 2024-05-12: 16 years of CVE-2008-0166 - Debian OpenSSL Bug - Breaking DKIM and BIMI in 2024
• 2024-05-08: "CGI scripts in Indicator payload" / how the BIMI spec is confusing and unclear
• 2024-05-05: Security flaw in BIMI spec / interaction of BIMI-supporting MUA with non-BIMI-supporting MTA

Information elsewhere:

• BIMI: An Analysis of the Top 1 Million Domains (43% had one or more issues)

Hanno Böck