RFC 4405

SMTP Service Extension for Indicating the Responsible Submitter of an E-Mail Message

📅 published April 2006, from ietf

RFC 4405: SMTP Service Extension for Indicating the Responsible Submitter of an E-Mail Message 💌

Okay bestie, RFC 4405 is an Experimental doc from the Network Working Group, published in April 2006. It was written by E. Allman (Sendmail, Inc.) and H. Katz (Microsoft Corp.). The copyright is The Internet Society's (2006). The header doesn't list any RFCs that it obsoletes or updates, so it's a standalone experiment. 🧪✨

Status of This Memo

This memo defines an Experimental Protocol for the Internet community. It is not an Internet standard of any kind 🫶 The authors are asking for discussion and suggestions for improvement, and distribution of this memo is unlimited.

Copyright Notice

IESG Note

Okay, this part is the tea ☕ RFC 4405, RFC 4406, RFC 4407, and RFC 4408 were all published at the same time as Experimental RFCs. There's no general technical consensus, and attempts to reconcile the two approaches have failed. These documents didn't get full IETF review. They're published "AS-IS" so people can see the different approaches the MARID working group considered. 🔍

The IESG doesn't pick a favourite. It warns that each approach has serious open issues, and that using them together is a concern. The IESG believes that documenting the different approaches does less harm than not documenting them 💅

Also, the Sender ID experiment may use DNS records that were made for the current SPF experiment or earlier versions in this set of experiments. Depending on what's in the record, Sender-ID heuristics could get applied incorrectly to a message 😬 Depending on what the recipient does with those heuristics, the message might not be delivered, or it might get discarded when it arrives.

People relying on Sender ID experiment DNS records are warned that they may lose valid messages in these situations. People publishing SPF experiment DNS records should think about the advice in section 3.4 of RFC 4406, and they may want to publish both v=spf1 and spf2.0 records to avoid the conflict. 🌸

Participants in the Sender-ID experiment also need to know that the way Resent-* header fields are used will cause failures to receive legitimate email when talking to standards-compliant systems. Two examples are automatic forwarders that follow the standards by not adding Resent-* headers, and systems that follow RFC 822 but haven't implemented RFC 2822 Resent-* semantics yet. It would be inappropriate to advance Sender-ID on the standards track without solving this interoperability problem 🚫

Finally, the community is invited to watch how the two approaches do during the two years after publication, so a community consensus can be reached in the future 🦋

Abstract

This memo defines an extension to the Simple Mail Transfer Protocol (SMTP) service. It lets an SMTP client say who the responsible submitter of an e-mail message is. The responsible submitter is the e-mail address of the entity that most recently introduced a message into the transport stream. The point of all this is to help receiving e-mail servers efficiently figure out whether the SMTP client is allowed to send mail on behalf of the responsible submitter's domain 💖

   1. Introduction ....................................................3
      1.1. Conventions Used in This Document ..........................4
   2. The SUBMITTER Service Extension .................................4
   3. The SUBMITTER Keyword of the EHLO Command .......................5
   4. The SUBMITTER Parameter of the MAIL Command .....................5
      4.1. Setting the SUBMITTER Parameter Value ......................5
      4.2. Processing the SUBMITTER Parameter .........................5
      4.3. Transmitting to a Non-SUBMITTER-Aware SMTP Server ..........6
   5. Examples ........................................................6
      5.1. Mail Submission ............................................7
      5.2. Mail Forwarding ............................................7
      5.3. Mobile User ................................................8
      5.4. Guest E-Mail Service .......................................9
      5.5. SUBMITTER Used on a Non-Delivery Report ...................11
   6. Security Considerations ........................................11
   7. Acknowledgements ...............................................12
   8. IANA Considerations ............................................12
   9. References .....................................................12
      9.1. Normative References ......................................12

1. Introduction ✨

Spoofing is when someone fakes the identity of the sender of an e-mail message. It's a super common trick used by people who send unsolicited commercial e-mail, aka spam 🙄 This abuse is the reason we need better ways to identify the "responsible submitter" of an e-mail message.

In this spec, the responsible submitter is the entity that most recently injected a message into the e-mail transport stream. Its e-mail address is called the Purported Responsible Address (PRA) of the message. The Purported Responsible Domain (PRD) is just the domain part of that address 🎀

This spec sets the rules for putting the purported responsible address into the SMTP transport protocol. That lets receiving SMTP servers efficiently check whether the SMTP client is allowed to send mail on behalf of the responsible submitter's domain.

There are basically two ways to figure out the purported responsible address. You can use the RFC 2821 [SMTP] protocol data, or you can use the RFC 2822 [MSG-FORMAT] message headers. Each one has pros and cons 🍓

Using RFC 2821 data has the big perk that validation can happen before the SMTP client sends the message body. If spoofing is detected, the SMTP server can reject the message before it's ever transmitted, depending on local policy. The downside is the risk of false positives, meaning wrongly deciding the sender's e-mail address was spoofed. There are legit reasons today for the Internet domain names in RFC 2821 commands to be different from the sender's domain in an e-mail message.

Using RFC 2822 headers has the perk that validation can usually be based on the identity that existing Mail User Agents (MUAs) show recipients as the sender. This helps catch a especially nasty kind of spoofing called "phishing," where a bad actor tries to trick a recipient into thinking a message comes from an entity they know well 😤 This approach has a lower risk of false positives, since there are fewer legit reasons for RFC 2822 headers to differ from the true sender. The downside is that it has to parse and analyze message headers. In practice, much if not all of the message body also gets transmitted, because the SMTP protocol in RFC 2821 has no way to stop message transmission once the DATA command has been issued.

It would be great to combine the two approaches so you get the benefits of both while cutting down on the disadvantages of each 🌈

This spec does exactly that with a unified approach. It uses the mechanism described in [SMTP] to define an extension to the SMTP protocol. With this extension, an SMTP client can give the e-mail address of the entity that most recently submitted the message to the SMTP client, using a new SUBMITTER parameter on the SMTP MAIL command. SMTP servers can use that info to check that the SMTP client is allowed to send e-mail on behalf of the Internet domain in the SUBMITTER parameter 👑

1.1. Conventions Used in This Document

In examples, "C:" and "S:" mean lines sent by the client and server, respectively 💜

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [KEYWORDS]. These are the official requirement words, so they're in caps on purpose 🫶

2. The SUBMITTER Service Extension

Here's the SMTP service extension being defined:

(1) The name of this SMTP service extension is "Responsible Submitter";
(2) The EHLO keyword value associated with this extension is "SUBMITTER";
(3) The SUBMITTER keyword has no parameters;
(4) No additional SMTP verbs are defined by this extension;
(5) An optional parameter is added to the MAIL command using the esmtp-keyword "SUBMITTER", and is used to specify the e-mail address of the entity responsible for submitting the message for delivery;
(6) This extension is appropriate for the submission protocol [SUBMIT].

3. The SUBMITTER Keyword of the EHLO Command

An SMTP server includes the SUBMITTER keyword in its EHLO response to tell the SMTP client that the SUBMITTER service extension is supported 🧚

The SUBMITTER keyword has no parameters.

4. The SUBMITTER Parameter of the MAIL Command

Here's the syntax of the SUBMITTER parameter:

   "SUBMITTER=" Mailbox

Mailbox is the Augmented Backus-Naur Form (ABNF) [ABNF] production defined in Section 4.1.2 of [SMTP]. Characters like SP, "+", and "=" can show up in Mailbox but aren't allowed in ESMTP parameter values. Those characters MUST be encoded as "xtext", as described in Section 4 of [DSN] 🔐

4.1. Setting the SUBMITTER Parameter Value

The whole point of the SUBMITTER parameter is to let the SMTP client tell the server the purported responsible address of the message, right inside the RFC 2821 protocol 💖

So SMTP clients that support the Responsible Submitter extension MUST include the SUBMITTER parameter on all messages. That includes messages with a null reverse-path in the MAIL command ✨

SMTP clients MUST set the SUBMITTER parameter value to the purported responsible address of the message, as defined in [PRA]. This applies to messages with a null reverse-path too 🎀

In some circumstances, described in Section 7 of [SENDER-ID], SMTP clients may need to add RFC 2822 headers to the message so the correct SUBMITTER parameter value can be set. This is the part where it gets a little extra, so pay attention bestie 🙈

4.2. Processing the SUBMITTER Parameter ✨

okay bestie, this is where receivers get to be the detectives 🕵️‍♀️💅 when a message comes in with the SUBMITTER parameter, the receiver SHOULD take the domain part of the SUBMITTER address and treat it as the purported responsible domain of the message 🎀 then it SHOULD run whatever checks it needs to figure out if the connecting SMTP client is actually allowed to send mail for that domain, including the ones defined in [SENDER-ID] 🔍

if those checks say the connecting SMTP client is NOT authorized to send on behalf of the SUBMITTER domain, the receiving SMTP server SHOULD reject the message, and when it does, it MUST use 550 5.7.1 Submitter not allowed. 🙅‍♀️ literally the most dramatic little rejection ever 💀

if the receiving SMTP server does let the client send the message data, the server SHOULD work out the purported responsible address by looking at the RFC 2822 message headers, the way [PRA] describes 📨 and if that address does NOT match the address in the SUBMITTER parameter, the receiving SMTP server MUST reject the message, and when rejecting it MUST use 550 5.7.1 Submitter does not match header. 😭 no match, no entry, no cap

if [PRA] can't find any purported responsible address at all, the SMTP server SHOULD reject the message, and when it does, it MUST use 554 5.7.7 Cannot verify submitter address. 🥀

Verifying Mail Transfer Agents (MTAs) are strongly urged to check the SUBMITTER parameter against the RFC 2822 headers 🫶 bc if they don't, an attacker can trivially defeat the whole algorithm 🙈 not on my watch lol

now, big rule 👑 the SUBMITTER parameter on the MAIL command MUST NOT change the effective reverse-path of a message 🛑 delivery status notifications still go to the reverse-path, if there is one, as per Section 3.7 of [SMTP], no matter whether a SUBMITTER parameter showed up 📬 and if the reverse-path is null, delivery status notifications MUST NOT be sent to the SUBMITTER address. no sneaking them over there 🚫

same energy for replies 💖 the SUBMITTER parameter MUST NOT change the effective reply address of a message either. replies MUST be sent to the From address or the Reply-To address, if one is present, as described in Section 3.6.2 of [MSG-FORMAT], regardless of whether a SUBMITTER parameter was used 🌸

4.3. Transmitting to a Non-SUBMITTER-Aware SMTP Server 🦋

ok so even though Section 4.1 above sets the rules, there's a plot twist 🎭 when an MTA is passing a message along to another MTA that doesn't support the SUBMITTER extension, the forwarding MTA MUST send the message WITHOUT the SUBMITTER parameter 🫣 the good news is it shouldn't lose any info, since the SUBMITTER parameter is supposed to be built from the message headers anyway 🧚 nothing important gets left behind, so it's fine fr fr ✨

5. Examples 🎀

this section shows how the SUBMITTER parameter would actually get used 💅 meet the cast first, bestie 👯‍♀️

alice@example.com: the original sender of each e-mail message. the OG 💖

bob@company.com.example: the final recipient of each e-mail 📬

bob@almamater.edu.example: an e-mail address Bob uses, which he has set up to forward mail to his office account at bob@company.com.example 🎓

alice@mobile.net.example: an e-mail account her mobile e-mail network carrier gave her 📱

5.1. Mail Submission 🌷

normally, Alice would set up her MUA so it submits her message to the mail system using the SUBMIT protocol [SUBMIT] 💌 the MUA sends the message WITHOUT the SUBMITTER parameter 🙃 the SUBMIT server then checks that the MUA is allowed to submit, through some outside scheme, maybe SMTP Authentication [SMTPAUTH] 🔐 most of the time it just looks like a normal, authenticated SMTP transaction, so nothing dramatic 💤 then the SUBMIT server pulls her name out of the RFC 2822 headers to use in the SUBMITTER parameters of any later transmissions of the message 🧁

5.2. Mail Forwarding 🦄

when Alice sends a message to Bob at his almamater.edu.example account, the SMTP session from her SUBMIT server might look something like this:

S: 220 almamater.edu.example ESMTP server ready
C: EHLO example.com
S: 250-almamater.edu.example
S: 250-DSN
S: 250-AUTH
S: 250-SUBMITTER
S: 250 SIZE
C: MAIL FROM:<alice@example.com> SUBMITTER=alice@example.com
S: 250 <alice@example.com> sender ok
C: RCPT TO:<bob@almamater.edu.example>
S: 250 <bob@almamater.edu.example> recipient ok
C: DATA
S: 354 okay, send message
C: (message body goes here)
C: .
S: 250 message accepted
C: QUIT
S: 221 goodbye

the almamater.edu.example MTA now has to forward this to bob@company.com.example 📨 even though Alice is the original sender, she is NOT responsible for this latest retransmission 🙅‍♀️ that job goes to bob@almamater.edu.example, since he set up the forwarding to bob@company.com.example 🎀 so the almamater.edu.example MTA works out a new purported responsible address for the message, which is bob@almamater.edu.example, and sets the SUBMITTER parameter to match ✨ the forwarding MTA also adds a Resent-From header to the message so the purported responsible address from the RFC 2822 headers lines up with the SUBMITTER address 🫶

S: 220 company.com.example ESMTP server ready
C: EHLO almamater.edu.example
S: 250-company.com.example
S: 250-DSN
S: 250-AUTH
S: 250-SUBMITTER
S: 250 SIZE
C: MAIL FROM:<alice@example.com>
        SUBMITTER=bob@almamater.edu.example
S: 250 <alice@example.com> sender ok
C: RCPT TO:<bob@company.com.example>
S: 250 <bob@company.com.example> recipient ok
C: DATA
S: 354 okay, send message
C: Resent-From: bob@almamater.edu.example
C: Received By: ...
C: (message body goes here)
C: .
S: 250 message accepted
C: QUIT
S: 221 goodbye

5.3. Mobile User 📱💜

Alice is at the airport 🛫 sending a message to Bob from her phone 💅 the message goes through the carrier network run by mobile.net.example, BUT Alice uses her example.com address on the From line of every message, so replies land in her office mailbox 📥

here's the SMTP session between the MTAs at mobile.net.example and almamater.edu.example:

S: 220 almamater.edu.example ESMTP server ready
C: EHLO mobile.net.example
S: 250-almamater.edu.example
S: 250-DSN
S: 250-AUTH
S: 250-SUBMITTER
S: 250 SIZE
C: MAIL FROM:<alice@example.com>
        SUBMITTER=alice@mobile.net.example
S: 250 <alice@example.com> sender ok
C: RCPT TO:<bob@almamater.edu.example>
S: 250 <bob@almamater.edu.example> recipient ok
C: DATA
S: 354 okay, send message
C: Sender: alice@mobile.net.example
C: Received By: ...
C: (message body goes here)
C: .
S: 250 message accepted
C: QUIT
S: 221 goodbye

mobile.net.example uses the SUBMITTER parameter to name alice@mobile.net.example as the responsible submitter for this message 🎯 it also adds a Sender header 🪄 so the purported responsible address from the RFC 2822 headers matches the SUBMITTER address, nice and tidy 🧹

ISPs in general can also use the SUBMITTER parameter to name the user's address on the ISP's network as the responsible submitter, as long as that address is different from the MAIL FROM address 🌐 this is especially handy for ISPs that host several domains or share MTAs across domains 🙌

when the almamater.edu.example MTA forwards the message later, it swaps the SUBMITTER parameter for bob@almamater.edu.example, like in Section 5.2, and adds its own Resent-From header 🔁

5.4. Guest E-Mail Service 🏨

Alice is on a business trip 🧳 and uses the broadband at the Exemplar Hotel to get online and send mail 💻 the hotel sends all outbound e-mail through its own SMTP server, email.hotel.com.example 🛎️

the SMTP session for Alice's message to Bob from the Exemplar Hotel would look like this:

S: 220 almamater.edu.example ESMTP server ready
C: EHLO email.hotel.com.example
S: 250-almamater.edu.example
S: 250-DSN
S: 250-AUTH
S: 250-SUBMITTER
S: 250 SIZE
C: MAIL FROM:<alice@example.com>
        SUBMITTER=guest.services@email.hotel.com.example
S: 250 <alice@example.com> sender ok
C: RCPT TO:<bob@almamater.edu.example>
S: 250 <bob@almamater.edu.example> recipient ok
C: DATA
S: 354 okay, send message
C: Resent-From: guest.services@email.hotel.com.example
C: Received By: ...
C: (message body goes here)
C: .
S: 250 message accepted
C: QUIT
S: 221 goodbye

email.hotel.com.example uses the SUBMITTER parameter to name the generic account guest.services@email.hotel.com.example as the responsible submitter address for this message 🏷️ it's a generic account because Alice doesn't have her own account at that domain 🤷‍♀️ this client also adds a Resent-From header so the purported responsible address from the RFC 2822 headers matches the SUBMITTER address 🫶

same as before 🔁 when the almamater.edu.example MTA forwards the message later, it replaces the SUBMITTER parameter with bob@almamater.edu.example, like in Section 5.2, and adds its own Resent-From header ✨

5.5. SUBMITTER Used on a Non-Delivery Report 💀

Alice sends an address that's wrong 😬 and gets a non-delivery report from a SUBMITTER-compliant server 📭

S: 220 example.com ESMTP server ready
C: EHLO almamater.edu.example
S: 250-example.com
S: 250-DSN
S: 250-AUTH
S: 250-SUBMITTER
S: 250 SIZE
C: MAIL FROM:<> SUBMITTER=mailer-daemon@almamater.edu.example
S: 250 OK
C: RCPT TO:<alice@example.com>
S: 250 OK
C: DATA
S: 354 OK, send message
C: (message body goes here)
C: .
S: 250 message accepted
C: QUIT
S: 221 goodbye

6. Security Considerations 🚨

okay this part is SERIOUS 🥹 the extension lets an SMTP client name the responsible submitter of an e-mail message right there in the SMTP protocol, and lets SMTP servers check that identity efficiently before the message contents are sent 💫

BUT 😱 it's totally possible for an attacker to forge the value of the SUBMITTER parameter 🎭 and it's also possible for an attacker to send a message whose SUBMITTER parameter doesn't match the purported responsible address derived from the RFC 2822 headers 🙃 so the SUBMITTER parameter gives NO assurance on its own about whether the message or the responsible submitter is authentic 🛑 its real job is to give receiving e-mail systems extra info, so they can quickly tell whether the responsible submitter is valid, and specifically whether the SMTP client is allowed to send e-mail on behalf of the purported responsible submitter's domain 🔍 Section 4.2 explains how receiving e-mail systems should process the SUBMITTER parameter 📖💖

7. Acknowledgements ✨

okay so the idea of an ESMTP extension that tells everyone who the responsible sender of an email is has SO many parents 🍼 Nick Shelness suggested it in a private chat with one of the authors 💬, Pete Resnick dropped a variant of it on the MARID mailing list 🦋, and it got talked about on the Anti-Spam Research Group (ASRG) mailing list too. iconic teamwork 🫶

the authors also want to thank the MARID working group folks and these amazing people, whose comments and suggestions made this doc so much better 💖:

Robert Atkinson, Simon Attwell, Roy Badami, Greg Connor, Dave Crocker, Matthew Elvey, Tony Finch, Ned Freed, Mark Lentczner, Jim Lyon, Bruce McMillan, Sam Neely, Daryl Odnert, Margaret Olson, Pete Resnick, Hector Santos, Nick Shelness, Rand Wacker, and Meng Weng Wong 🌸

8. IANA Considerations

the IANA has registered the SUBMITTER SMTP service extension 🎀✨

9. References

9.1. Normative References

[ABNF] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", RFC 4234, October 2005. 📐
[DSN] Moore, K., "Simple Mail Transfer Protocol (SMTP) Service Extension for Delivery Status Notifications (DSNs)", RFC 3461, January 2003. 📬
[KEYWORDS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. 🔑
[MSG-FORMAT] Resnick, P., "Internet Message Format", RFC 2822, April 2001. 💌
[PRA] Lyon, J., "Purported Responsible Address in E-Mail Messages", RFC 4407, April 2006. 🕵️‍♀️
[SENDER-ID] Lyon, J. and M. Wong, "Sender ID: Authenticating E-Mail", RFC 4406, April 2006. 🆔
[SUBMIT] Gellens, R. and J. Klensin, "Message Submission for Mail", RFC 4409, April 2006. 📤
[SMTP] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821, April 2001. ✉️
[SMTPAUTH] Myers, J., "SMTP Service Extension for Authentication", RFC 2554, March 1999. 🔐

Authors' Addresses

here's where you can find the authors 🦋

Eric Allman
Sendmail, Inc.
6425 Christie Ave, Suite 400
Emeryville, CA 94608
USA

EMail: eric@sendmail.com

Harry Katz
Microsoft Corp.
1 Microsoft Way
Redmond, WA 98052
USA

EMail: hkatz@microsoft.com

Full Copyright Statement

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property

the IETF doesn't take a side on whether any IPR or other rights claimed around this tech are valid or how far they reach 🤷‍♀️ it also doesn't claim it went looking for them. if you want the rules for RFC documents, check BCP 78 and BCP 79 📚

copies of IPR disclosures sent to the IETF Secretariat, any assurances of licenses, and the results of any attempt to get a general license or permission for implementers or users are available from the IETF's online IPR repository at http://www.ietf.org/ipr. 🔍

the IETF invites anyone to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. send that info to the IETF at ietf-ipr@ietf.org. 📨

Acknowledgement

funding for the RFC Editor function comes from the IETF Administrative Support Activity (IASA). 💅

📦 where this page comes from

ietf: rfc4405 2006-04
💖 girlified by claude-haiku-5-5 on 2026-10-16: a language model's rewrite of the original, under its terms