bimi: support BIMI declination records

nemunaire · nemunaire · commit 6737e33fcbb9 · 2026-04-28T17:59:38.000+07:00
The BIMI draft lets a domain explicitly opt out of BIMI by publishing
a record with v=BIMI1 and an empty l= tag. Surface that in the editor
and treat it as a first-class case in compliance.
diff --git a/web/src/lib/components/services/editors/svcs.BIMI.svelte b/web/src/lib/components/services/editors/svcs.BIMI.svelte
@@ -22,11 +22,18 @@
 -->
 
 <script lang="ts">
+    import { FormGroup, Input } from "@sveltestrap/sveltestrap";
+
     import type { Domain } from "$lib/model/domain";
     import BasicInput from "$lib/components/inputs/basic.svelte";
     import type { dnsResource } from "$lib/dns_rr";
     import { getRrtype, newRR } from "$lib/dns_rr";
-    import { parseBIMI, stringifyBIMI } from "$lib/services/bimi";
+    import {
+        isBIMIDeclination,
+        parseBIMI,
+        stringifyBIMI,
+        stringifyBIMIDeclination,
+    } from "$lib/services/bimi";
 
     interface Props {
         dn: string;
@@ -40,14 +47,20 @@
         value["txt"] = newRR("default._bimi", getRrtype("TXT")) as any;
     }
 
-    let val = $state(parseBIMI(value["txt"]!.Txt || ""));
+    let initialTxt = value["txt"]!.Txt || "";
+    let val = $state(parseBIMI(initialTxt));
     let selector = $state(
         value["txt"]!.Hdr?.Name?.replace("._bimi", "") || "default",
     );
+    let decline = $state(isBIMIDeclination(initialTxt));
 
     $effect(() => {
         const txt = value["txt"]!;
-        txt.Txt = stringifyBIMI(val, txt.Txt || "");
+        if (decline) {
+            txt.Txt = stringifyBIMIDeclination(val.v || "BIMI1");
+        } else {
+            txt.Txt = stringifyBIMI(val, txt.Txt || "");
+        }
         if (txt.Hdr) {
             txt.Hdr.Name = selector + "._bimi";
         }
@@ -86,43 +99,57 @@
             bind:value={selector}
         />
 
-        <BasicInput
-            edit
-            index="l"
-            specs={{
-                id: "l",
-                label: "Logo",
-                placeholder: "https://example.com/logo.svg",
-                type: "string",
-                description: "HTTPS URL of the SVG Tiny Portable/Secure logo.",
-            }}
-            bind:value={val.l}
-        />
-
-        <BasicInput
-            edit
-            index="a"
-            specs={{
-                id: "a",
-                label: "Authority",
-                placeholder: "https://example.com/vmc.pem",
-                type: "string",
-                description: "HTTPS URL of the Verified Mark Certificate (PEM). Required by Gmail and Yahoo.",
-            }}
-            bind:value={val.a}
-        />
-
-        <BasicInput
-            edit
-            index="e"
-            specs={{
-                id: "e",
-                label: "Evidence",
-                placeholder: "https://example.com/evidence",
-                type: "string",
-                description: "HTTPS URL of an evidence document (optional).",
-            }}
-            bind:value={val.e}
-        />
+        <FormGroup>
+            <Input
+                id="bimi-decline"
+                type="checkbox"
+                label="Decline to participate in BIMI"
+                bind:checked={decline}
+            />
+            <small class="form-text text-muted">
+                Publishes an explicit empty record so receivers know your domain has chosen not to participate in BIMI.
+            </small>
+        </FormGroup>
+
+        {#if !decline}
+            <BasicInput
+                edit
+                index="l"
+                specs={{
+                    id: "l",
+                    label: "Logo",
+                    placeholder: "https://example.com/logo.svg",
+                    type: "string",
+                    description: "HTTPS URL of the SVG Tiny Portable/Secure logo.",
+                }}
+                bind:value={val.l}
+            />
+
+            <BasicInput
+                edit
+                index="a"
+                specs={{
+                    id: "a",
+                    label: "Authority",
+                    placeholder: "https://example.com/vmc.pem",
+                    type: "string",
+                    description: "HTTPS URL of the Verified Mark Certificate (PEM). Required by Gmail and Yahoo.",
+                }}
+                bind:value={val.a}
+            />
+
+            <BasicInput
+                edit
+                index="e"
+                specs={{
+                    id: "e",
+                    label: "Evidence",
+                    placeholder: "https://example.com/evidence",
+                    type: "string",
+                    description: "HTTPS URL of an evidence document (optional).",
+                }}
+                bind:value={val.e}
+            />
+        {/if}
     </form>
 </div>
diff --git a/web/src/lib/locales/en.json b/web/src/lib/locales/en.json
@@ -896,6 +896,10 @@
                 "title": "No Verified Mark Certificate (a=)",
                 "detail": "Gmail and Yahoo require a VMC to display the BIMI logo."
             },
+            "declination": {
+                "title": "Declination to participate in BIMI",
+                "detail": "This record explicitly tells receivers that the domain has chosen not to participate in BIMI."
+            },
             "no-dmarc": {
                 "title": "No DMARC record published",
                 "detail": "BIMI requires a DMARC record with an enforcing policy (quarantine or reject)."
diff --git a/web/src/lib/locales/fr.json b/web/src/lib/locales/fr.json
@@ -667,6 +667,10 @@
                 "title": "Pas de Verified Mark Certificate (a=)",
                 "detail": "Gmail et Yahoo nécessitent un VMC pour afficher le logo BIMI."
             },
+            "declination": {
+                "title": "Déclaration de non-participation à BIMI",
+                "detail": "Cet enregistrement indique explicitement aux destinataires que le domaine a choisi de ne pas participer à BIMI."
+            },
             "no-dmarc": {
                 "title": "Aucun enregistrement DMARC publié",
                 "detail": "BIMI nécessite un enregistrement DMARC avec une politique stricte (quarantine ou reject)."
diff --git a/web/src/lib/services/bimi.test.ts b/web/src/lib/services/bimi.test.ts
@@ -20,7 +20,7 @@
 // along with this program.  If not, see <https://www.gnu.org/licenses/>.
 
 import { describe, it, expect } from "vitest";
-import { parseBIMI, stringifyBIMI } from "./bimi";
+import { isBIMIDeclination, parseBIMI, stringifyBIMI, stringifyBIMIDeclination } from "./bimi";
 
 describe("parseBIMI", () => {
     it("parses a minimal BIMI record", () => {
@@ -97,6 +97,24 @@ describe("stringifyBIMI", () => {
     });
 });
 
+describe("isBIMIDeclination", () => {
+    it("recognises v=BIMI1;l= as declination", () => {
+        expect(isBIMIDeclination("v=BIMI1;l=")).toBe(true);
+    });
+    it("recognises v=BIMI1; l= ; a= as declination", () => {
+        expect(isBIMIDeclination("v=BIMI1; l= ; a=")).toBe(true);
+    });
+    it("rejects a regular BIMI record", () => {
+        expect(isBIMIDeclination("v=BIMI1;l=https://example.com/logo.svg")).toBe(false);
+    });
+    it("rejects a non-BIMI record", () => {
+        expect(isBIMIDeclination("v=DMARC1;l=")).toBe(false);
+    });
+    it("recognises stringifyBIMIDeclination output", () => {
+        expect(isBIMIDeclination(stringifyBIMIDeclination())).toBe(true);
+    });
+});
+
 describe("parseBIMI and stringifyBIMI roundtrip", () => {
     it("preserves all fields through a full roundtrip", () => {
         const original =
diff --git a/web/src/lib/services/bimi.ts b/web/src/lib/services/bimi.ts
@@ -38,6 +38,20 @@ export function parseBIMI(val: string): BIMIValue {
     };
 }
 
+/**
+ * Detects a BIMI declination record. Per the BIMI draft, a domain that does
+ * not wish to participate publishes a record with v=BIMI1 and an explicitly
+ * empty l= tag.
+ */
+export function isBIMIDeclination(val: string): boolean {
+    if (!/(?:^|;)\s*v\s*=\s*BIMI\d+/i.test(val)) return false;
+    return /(?:^|;)\s*l\s*=\s*(?:;|$)/i.test(val);
+}
+
+export function stringifyBIMIDeclination(version: string = "BIMI1"): string {
+    return `v=${version};l=`;
+}
+
 export function stringifyBIMI(val: BIMIValue, existingTxt: string = ""): string {
     const sep = existingTxt.indexOf("; ") >= 0 ? "; " : ";";
 
diff --git a/web/src/lib/services/bimi/compliance.test.ts b/web/src/lib/services/bimi/compliance.test.ts
@@ -144,6 +144,37 @@ describe("BIMI compliance: authority & evidence", () => {
     });
 });
 
+describe("BIMI compliance: declination", () => {
+    it("emits only the declination info for v=BIMI1;l= (no zone)", () => {
+        const issues = run("default._bimi", "v=BIMI1;l=");
+        expect(ids(issues)).toEqual(["bimi.declination"]);
+    });
+    it("declination skips URL/VMC checks but keeps DMARC cross-checks", () => {
+        const zone = zoneWith();
+        const issues = run("default._bimi", "v=BIMI1;l=", zone);
+        expect(ids(issues)).toContain("bimi.declination");
+        expect(ids(issues)).toContain("bimi.no-dmarc");
+        expect(ids(issues)).not.toContain("bimi.missing-location");
+        expect(ids(issues)).not.toContain("bimi.missing-vmc");
+    });
+    it("declination flags weak DMARC policy", () => {
+        const zone = zoneWith(dmarcService("v=DMARC1; p=none"));
+        const issues = run("default._bimi", "v=BIMI1;l=", zone);
+        expect(ids(issues)).toContain("bimi.declination");
+        expect(ids(issues)).toContain("bimi.weak-dmarc-policy");
+    });
+    it("declination is fully clean with an enforcing DMARC", () => {
+        const zone = zoneWith(dmarcService("v=DMARC1; p=reject"));
+        const issues = run("default._bimi", "v=BIMI1;l=", zone);
+        expect(ids(issues)).toEqual(["bimi.declination"]);
+    });
+    it("still flags an invalid selector in declination mode", () => {
+        const issues = run("bad selector._bimi", "v=BIMI1;l=");
+        expect(ids(issues)).toContain("bimi.invalid-selector");
+        expect(ids(issues)).toContain("bimi.declination");
+    });
+});
+
 describe("BIMI compliance: DMARC cross-checks", () => {
     it("warns when no DMARC is published", () => {
         const zone = zoneWith();
diff --git a/web/src/lib/services/bimi/compliance.ts b/web/src/lib/services/bimi/compliance.ts
@@ -24,7 +24,7 @@ import {
     type ComplianceIssue,
     registerValidators,
 } from "$lib/services/compliance";
-import { parseBIMI } from "$lib/services/bimi";
+import { isBIMIDeclination, parseBIMI } from "$lib/services/bimi";
 import { parseDMARC } from "$lib/services/dmarc";
 
 const SELECTOR_LABEL_RE = /^[A-Za-z0-9_-]+$/;
@@ -88,32 +88,50 @@ function bimiSync(raw: Record<string, any>, ctx: ComplianceContext): ComplianceI
         });
     }
 
-    // l= (Location) is mandatory.
-    if (!val.l) {
+    // Declination: a domain that does not wish to participate publishes
+    // v=BIMI1 with an empty l= tag. The URL/VMC checks no longer apply,
+    // but the DMARC cross-check still does: a declining domain still has
+    // to back the declination with an enforcing DMARC policy, otherwise
+    // an attacker could spoof the domain and override the declination.
+    const declination = isBIMIDeclination(txtValue);
+    if (declination) {
         issues.push({
-            id: "bimi.missing-location",
-            severity: "error",
-            field: "l",
-            docUrl: DRAFT,
-        });
-    } else if (!isHttps(val.l)) {
-        issues.push({
-            id: "bimi.location-not-https",
-            severity: "error",
-            field: "l",
-            docUrl: DRAFT,
-        });
-    } else if (!/\.svg(\?|#|$)/i.test(val.l)) {
-        issues.push({
-            id: "bimi.location-not-svg",
-            severity: "warning",
-            field: "l",
+            id: "bimi.declination",
+            severity: "info",
             docUrl: DRAFT,
         });
     }
 
+    // l= (Location) is mandatory outside of declination.
+    if (!declination) {
+        if (!val.l) {
+            issues.push({
+                id: "bimi.missing-location",
+                severity: "error",
+                field: "l",
+                docUrl: DRAFT,
+            });
+        } else if (!isHttps(val.l)) {
+            issues.push({
+                id: "bimi.location-not-https",
+                severity: "error",
+                field: "l",
+                docUrl: DRAFT,
+            });
+        } else if (!/\.svg(\?|#|$)/i.test(val.l)) {
+            issues.push({
+                id: "bimi.location-not-svg",
+                severity: "warning",
+                field: "l",
+                docUrl: DRAFT,
+            });
+        }
+    }
+
     // a= (Authority / VMC) is optional but strongly recommended.
-    if (val.a) {
+    if (declination) {
+        // No-op: VMC is meaningless on a declination record.
+    } else if (val.a) {
         if (!isHttps(val.a)) {
             issues.push({
                 id: "bimi.authority-not-https",
@@ -139,7 +157,7 @@ function bimiSync(raw: Record<string, any>, ctx: ComplianceContext): ComplianceI
     }
 
     // e= (Evidence) optional, must be HTTPS if present.
-    if (val.e && !isHttps(val.e)) {
+    if (!declination && val.e && !isHttps(val.e)) {
         issues.push({
             id: "bimi.evidence-not-https",
             severity: "warning",
