3 ms·
Perhaps I missed it in the linked tweets. Is there a technical write-up on how they are spoofing BIMI? Are they not using BIMI DNS lookups and only trusting S
by LinuxBender 3y ago
Perhaps I missed it in the linked tweets. Is there a technical write-up on how they are spoofing BIMI? Are they not using BIMI DNS lookups and only trusting SMTP header contents? Gmail is purported to have a VMC requirement. [1]
[1] - https://www.fastmail.help/hc/en-us/articles/7002542139663-Using-BIMI-in-Fastmail https://www.fastmail.help/hc/en-us/articles/7002542139663-Us...
- egberts1 3y agowhile not an article about spoofing BIMI, it shows that anyone can BIMI'fied their mail server. I suspect that GMail is going to have to start caching of verified CA chain links ... at browser-level ... in JavaScript. https://egbert.net/blog/tags/bimi.html https://egbert.net/blog/tags/bimi.html