Add-ons
BIMI Result Viewer for Thunderbird 1.0.7
by Teru_Homma
Displays BIMI-related authentication results for the currently displayed message in a toolbar popup. This version uses only standard Thunderbird MailExtension APIs.
About this Add-on
Main Features
BIMI PASS Conditions
The add-on reports BIMI as PASS when all of the following conditions are met:
Brand Logo Display
The popup attempts to load a logo when an HTTPS URL is available in "policy.indicator-uri" or the "BIMI-Indicator" header. Only HTTPS image URLs are allowed. Logo display is separate from the BIMI PASS assessment; a displayed logo alone does not indicate successful authentication.
Limitations and Security Considerations
This add-on evaluates information locally using the headers of received messages. It relies on authentication results supplied by the receiving mail server and does not independently perform BIMI DNS lookups or validate VMC certificates.
<p>The reliability of the displayed authentication results and logos depends on the security measures implemented by the receiving mail server. Misleading or fraudulent logos may be displayed in the following environments:</p>
Brand logos are displayed in the add-on popup. This add-on does not add logos to the message list (thread pane) or replace the sender avatar in the message header.
A logo may not appear if its URL is missing, uses HTTP instead of HTTPS, is invalid, or cannot be loaded.
- Displays sender domain authentication results and brand logos in a Thunderbird popup.
- Shows SPF, DKIM, DMARC, and BIMI authentication results.
BIMI PASS Conditions
The add-on reports BIMI as PASS when all of the following conditions are met:
- The "Authentication-Results" header contains "bimi=pass".
- "policy.authority=pass" is also present.
- The domain specified by "header.d" matches the domain of the Header-From email address.
- A "BIMI-Indicator" header is present.
Brand Logo Display
The popup attempts to load a logo when an HTTPS URL is available in "policy.indicator-uri" or the "BIMI-Indicator" header. Only HTTPS image URLs are allowed. Logo display is separate from the BIMI PASS assessment; a displayed logo alone does not indicate successful authentication.
Limitations and Security Considerations
This add-on evaluates information locally using the headers of received messages. It relies on authentication results supplied by the receiving mail server and does not independently perform BIMI DNS lookups or validate VMC certificates.
<p>The reliability of the displayed authentication results and logos depends on the security measures implemented by the receiving mail server. Misleading or fraudulent logos may be displayed in the following environments:</p>
- The receiving mail server does not remove forged "Authentication-Results" headers.
- Forged "BIMI-Indicator" headers are not removed.
- The email service does not support BIMI.
- A relay server preserves forged authentication headers.
- An email gateway or forwarding service does not properly update authentication results.
Brand logos are displayed in the add-on popup. This add-on does not add logos to the message list (thread pane) or replace the sender avatar in the message header.
A logo may not appear if its URL is missing, uses HTTP instead of HTTPS, is invalid, or cannot be loaded.
