I have reviewed this document as part of the security directorate's ongoing effort to review all IETF documents being processed by the IESG. These comments were written primarily for the benefit of the security area directors. Document editors and WG chairs should treat these comments just like any other last call comments. This document defines a data model for mail over JMAP. JMAP is a JSON-based protocol for synchronization of data between clients and servers. - Section 9, the Security Considerations section, generally refers to draft-ietf-jmap-core for security considerations. I would agree with this. I wonder for a new protocol like this though, if TLS 1.3 should be required? - Also, for draft-ietf-jmap-core, it would be nice if Basic Auth could be disallowed for a new protocol like this - trying to move away from passwords - The rest of the Security Considerations section seems fine to me. - Editorial; Section 9.3: "Milter protocol" - I understand this is short-hand for "mail filter protocol," but perhaps this should be written out, maybe with some reference? I also could not find the term defined in draft-ietf-jmap-core. - Also in 9.3, should "the Milter protocol" be "a Milter protocol"? Not sure. Thanks. -- Magnus