RFC 5248
A Registry for SMTP Enhanced Mail System Status Codes
RFC 5248: A Registry for SMTP Enhanced Mail System Status Codes ✨
Okay bestie, here's the deal with this one. 💅
- Number: RFC 5248
- Series: BCP 138 🎀
- Category: Best Current Practice
- Date: June 2008 🌸
- Authors: T. Hansen (AT&T Laboratories) and J. Klensin
- Updates: RFC 3463, RFC 4468, and RFC 4954 🔥
- Obsoletes: nothing is listed in the header
- Stream: Network Working Group 🦋
Status of This Memo ✨
This doc is an Internet Best Current Practice for the Internet Community, and it's basically asking everyone to chat about it and suggest improvements 🫶 Distribution of this memo is unlimited, so share it with everyone you know 💖
Abstract
So RFC 3463 is the spec for enhanced mail system status codes 📬 It came with a brand new code model and a list of codes, and it expected more codes would show up later. The problem? It never gave us a real way to register those codes or keep track of them 😭 This document sets up an IANA registry for mail system enhanced status codes, and it starts that registry off with the codes already established in standards-track documents, plus other codes that became established in the industry ✨
1. Introduction
Okay so enhanced status codes for SMTP were first defined in [RFC1893], and then [RFC3463] replaced them 🧚 RFC 3463 expected more codes to get added over time (see section 2 of [RFC3463]), but again, no explicit way to register and track them. Since then, a bunch of RFCs and internet drafts have come out defining extra status codes, and honestly? Without a registry, the definitions have started clashing 💀
So this RFC creates that IANA registry, and it's written to stop future conflicts before they start 🛡️ It fills the registry with the established standards-track enhanced status codes from [RFC3463], [RFC3886], [RFC4468], and [RFC4954]. On top of that, it adds a few codes that came from various internet drafts that expired but still became super common in real life 🌈
Now the wildcard situation, which is a little bit of a vibe 🙈 As specified in [RFC3463], an enhanced status code is a three-part code. Each part is numeric, and they're separated by a period. The three parts are the class sub-code, the subject sub-code, and the detail sub-code. In the tables, a wildcard for the class sub-code is written as X, a wildcard for a subject sub-code is written as XXX, and a wildcard for a detail sub-code is written as YYY. For example, 3.XXX.YYY has an unspecified subject sub-code and an unspecified detail sub-code, and X.5.0 has an unspecified class sub-code. (This is a change from [RFC3463], which uses XXX for both the subject sub-code and detail sub-code wildcards.) 👑
2. IANA Considerations
2.1. SMTP Enhanced Status Codes Registry
IANA has made the registry "SMTP Enhanced Status Codes" 🎀 It's going to have three tables:
- Class Sub-Codes: Each entry here is a class sub-code, and each one has an unspecified subject sub-code and an unspecified detail sub-code.
- Subject Sub-Codes: Each entry here is a subject sub-code, and each one has an unspecified class sub-code and an unspecified detail sub-code.
- Enumerated Status Codes: Each entry here is a combo of a subject sub-code and a detail sub-code. All of them have an unspecified class sub-code, plus a specified subject sub-code and a specified detail sub-code.
Every entry in the tables includes the stuff below. (The sub-code tables won't have the Associated Basic Status Code entries, so don't look for them there 🙃)
- Code: The status code. For example,
3.XXX.YYYis a class sub-code with an unspecified subject sub-code and an unspecified detail sub-code, andX.5.0is an enumerated status code with an unspecified class sub-code. - Summary or Sample Text: For class and subject sub-codes, this is the summary of what the sub-code is used for, which is shown in section 2 of [RFC3463]. For enumerated status codes, this is an example of a message that might get sent along with the code 💌
- Associated Basic Status Code: For enumerated status codes, this is the basic status code(s) from [RFC2821] that it's usually paired with. It can also say something like "Any" or "Not given". NOTE: This is a non-exclusive list 👀 The entries that list some basic status codes might allow for other basic status codes, while the entries marked "Not given" can get filled in by updating the IANA registry, either through updates to this document or at the direction of the IESG.
- Description: A short description of the code. ✨
- Reference: A reference to the document where the code is defined. This reference should say whether the spec is standards-track, best current practice, or neither, using one of "(Standards track)", "(Best current practice)" or "(Not standards track)" 📚
- Submitter: The identity of the submitter, which is usually the document author 🦋
- Change Controller: The identity of the change controller for the spec. For IETF-produced documents, this will be "IESG" 👑
Here's what an entry in the enumerated status code table looks like:
Code: X.0.0
Sample Text: Other undefined Status
Associated basic status code: Any
Description: Other undefined status is the only undefined
error code. It should be used for all errors for
which only the class of the error is known.
Reference: RFC 3463 (Standards track)
Submitter: G. Vaudreuil
Change controller: IESG.2.2. Review Process for New Values
Entries in this registry are expected to follow the "Specification Required" model ([RFC5226]). In practice though, most entries are expected to come from standards-track documents 🧐 Non-standards-track documents that specify codes to be registered should be readily available. The main purpose of this registry is to avoid confusion and conflicts among different definitions or uses of the same code 🫶
2.3. Registration Updates
Standards-track registrations may be updated if the relevant standards get updated as a result of that action 🔥 Non-standards-track entries may be updated by the listed change controller. Only the entry's short description or references can be changed this way, not the code or the associated text 🙅♀️ In exceptional cases, any aspect of any registered entry may be updated at the direction of the IESG (for example, to fix a conflict) 🚨
2.4. Initial Values ✨
okay so bestie, this is where the registry gets its starter pack 🎀 The class and subject sub-code tables get seeded from section 2 of [RFC3463]. For the Class Sub-Code table that means the 2.XXX.YYY, 4.XXX.YYY, and 5.XXX.YYY values, and for the Subject Sub-Code table it's X.0.YYY through X.7.YYY. The code, sample text, and description for every entry come straight from [RFC3463] 💅 Each entry uses [RFC3463] as its reference, was submitted by G. Vaudreuil, and is change controlled by the IESG. And there are no detail sub-code values for the class and subject tables, so nothing extra to see there 🙈
The Enumerated Status Code table gets populated from a few sources, and honestly it's giving buffet 🍓
- sections 3.1 through 3.8 of [RFC3463], (X.0.0, X.1.0 through X.1.8, X.2.0 through X.2.4, X.3.0 through X.3.5, X.4.0 through X.4.7, X.5.0 through X.5.5, X.6.0 through X.6.5, and X.7.0 through X.7.7),
- section 3.3.4 of [RFC3886] (X.1.9),
- X.6.6 found in section 5 of [RFC4468], (but not X.7.8 found in the same section),
- and X.5.6, X.7.8, X.7.9, X.7.11, and X.7.12, found in section 6 of [RFC4954] (using the text from X.5.6, 5.7.8, 5.7.9, 5.7.11, and 4.7.12).
Each entry is designated as defined in its corresponding RFC, submitted by that RFC's author, and change controlled by the IESG. Each of the above RFCs is a standards-track document ✨
The Associated Basic Status Code for each of those starter enhanced codes is in the table below. Heads up though, this table is incomplete 🥺 The entries with some basic status codes might allow for other detail sub-status codes, while the ones marked "Not given" can be filled in by updating the IANA registry through updates to this document or at the direction of the IESG 🌸
+--------+---------------+--------+----------+--------+-------------+
| Enh. | Assoc. Basic | Enh. | Assoc. | Enh. | Assoc. |
| Status | Status Code | Status | Basic | Status | Basic |
| Code | | Code | Status | Code | Status Code |
| | | | Code | | |
+--------+---------------+--------+----------+--------+-------------+
| X.0.0 | Any | X.1.0 | Not | X.1.1 | 451, 550 |
| | | | given | | |
| X.1.2 | Not given | X.1.3 | 501 | X.1.4 | Not given |
| X.1.5 | 250 | X.1.6 | Not | X.1.7 | Not given |
| | | | given | | |
| X.1.8 | 451, 501 | X.1.9 | Not | X.2.0 | Not given |
| | | | given | | |
| X.2.1 | Not given | X.2.2 | 552 | X.2.3 | 552 |
| X.2.4 | 450, 452 | X.3.0 | 221, | X.3.1 | 452 |
| | | | 250, | | |
| | | | 421, | | |
| | | | 451, | | |
| | | | 550, 554 | | |
| X.3.2 | 453 | X.3.3 | Not | X.3.4 | 552, 554 |
| | | | given | | |
| X.3.5 | Not given | X.4.0 | Not | X.4.1 | 451 |
| | | | given | | |
| X.4.2 | 421 | X.4.3 | 451, 550 | X.4.4 | Not given |
| X.4.5 | 451 | X.4.6 | Not | X.4.7 | Not given |
| | | | given | | |
| X.5.0 | 220, 250, | X.5.1 | 430, | X.5.2 | 500, 501, |
| | 251, 252, | | 500, | | 502, 550, |
| | 253, 451, | | 501, | | 555 |
| | 452, 454, | | 503, | | |
| | 458, 459, | | 530, | | |
| | 501, 502, | | 550, | | |
| | 503, 554 | | 554, 555 | | |
| X.5.3 | 451 | X.5.4 | 451, | X.5.5 | Not given |
| | | | 501, | | |
| | | | 502, | | |
| | | | 503, | | |
| | | | 504, | | |
| | | | 550, 555 | | |
| X.5.6 | 500 | X.6.0 | Not | X.6.1 | Not given |
| | | | given | | |
| X.6.2 | Not given | X.6.3 | 554 | X.6.4 | 250 |
| X.6.5 | Not given | X.6.6 | 554 | X.7.0 | 220, 235, |
| | | | | | 450, 454, |
| | | | | | 500, 501, |
| | | | | | 503, 504, |
| | | | | | 530, 535, |
| | | | | | 550 |
| X.7.1 | 451, 454, | X.7.2 | 550 | X.7.3 | Not given |
| | 502, 503, | | | | |
| | 533, 550, 551 | | | | |
| X.7.4 | 504 | X.7.5 | Not | X.7.6 | Not given |
| | | | given | | |
| X.7.7 | Not given | X.7.8 | 535, 554 | X.7.9 | 534 |
| X.7.10 | 523 | X.7.11 | 524, 538 | X.7.12 | 422, 432 |
| X.7.13 | 525 | X.7.14 | 535, 554 | | |
+--------+---------------+--------+----------+--------+-------------+Table 1
The following additional definitions have been registered in the enumerated status code table. These entries have been used in the industry without any published specification 👑
Code: X.7.10
Sample Text: Encryption Needed
Associated basic status code: 523
Description: This indicates that an external strong privacy
layer is needed in order to use the requested
authentication mechanism. This is primarily
intended for use with clear text authentication
mechanisms. A client that receives this may
activate a security layer such as TLS prior to
authenticating, or attempt to use a stronger
mechanism.
Reference: RFC 5248 (Best current practice)
Submitter: T. Hansen, J. Klensin
Change controller: IESG
Code: X.7.13
Sample Text: User Account Disabled
Associated basic status code: 525
Description: Sometimes a system administrator will have to
disable a user's account (e.g., due to lack of
payment, abuse, evidence of a break-in attempt,
etc.). This error code occurs after a successful
authentication to a disabled account. This
informs the client that the failure is permanent
until the user contacts their system
administrator to get the account re-enabled. It
differs from a generic authentication failure
where the client's best option is to present the
passphrase entry dialog in case the user simply
mistyped their passphrase.
Reference: RFC 5248 (Best current practice)
Submitter: T. Hansen, J. Klensin
Change controller: IESG
Code: X.7.14
Sample Text: Trust relationship required
Associated basic status code: 535, 554
Description: The submission server requires a configured trust
relationship with a third-party server in order
to access the message content. This value
replaces the prior use of X.7.8 for this error
condition, thereby updating [RFC4468].
Reference: RFC 5248 (Best current practice)
Submitter: T. Hansen, J. Klensin
Change controller: IESG3. Security Considerations 🔐
okay this part is serious, bestie, so listen up 🚨 As stated in [RFC1893], using enhanced status codes may disclose additional information about how an internal mail system is implemented, beyond what you can get from the SMTP status codes alone 😬
Lots of the proposed additions to the response code list are security related, so having them all registered in one place to prevent collisions makes them way more valuable ✨ Security error responses can leak information to active attackers. Like, the difference between "user not found" and "bad password" during authentication is a full-on gift to attackers 💀 Documents defining security error codes should make it clear when this is the case, so SMTP server software facing these threats can add the right controls to restrict exposure 🛡️
4. Acknowledgements 🫶
the need for this registry should have become clear shortly after [RFC3463] was approved, but the growth of the code table through additional documents and the work done as part of email internationalization and [RFC2821] updating efforts made the requirement way more obvious 🌈 Huge thank-yous to everyone who participated in those efforts, especially the members of the ietf-smtp@imc.org mailing list 💜 Chris Newman and Randy Gellens also gave useful comments and some text for early versions of the document 🦋
5. References 📚
5.1. Normative References
[RFC2821] Klensin, J., "Simple Mail Transfer Protocol", RFC 2821,
April 2001.
[RFC3463] Vaudreuil, G., "Enhanced Mail System Status Codes",
RFC 3463, January 2003.
[RFC3886] Allman, E., "An Extensible Message Format for Message
Tracking Responses", RFC 3886, September 2004.
[RFC4468] Newman, C., "Message Submission BURL Extension", RFC 4468,
May 2006.
[RFC4954] Siemborski, R. and A. Melnikov, "SMTP Service Extension
for Authentication", RFC 4954, July 2007.5.2. Informative References
[RFC1893] Vaudreuil, G., "Enhanced Mail System Status Codes",
RFC 1893, January 1996.
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
IANA Considerations Section in RFCs", BCP 26, RFC 5226,
May 2008.Authors' Addresses 📮
Tony Hansen
AT&T Laboratories
200 Laurel Ave.
Middletown, NJ 07748
USA
EMail: tony+mailesc@maillennium.att.com
John C Klensin
1770 Massachusetts Ave, Ste 322
Cambridge, MA 02140
USA
Phone: +1 617 245 1457
EMail: john+ietf@jck.comFull Copyright Statement ✨
Okay so the legal bit is up next 💅 Copyright (C) The IETF Trust (2008). Basically the IETF Trust owns the copyright on this one 🎀
This document is subject to the rights, licenses and restrictions in BCP 78, and except for what's set out there, the authors keep all their rights 🦋
The lawyers want this next part in ALL CAPS so you know they really mean it 😭 This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property 🌈
Okay, this one is about who owns what 🧚 The IETF doesn't take a position on whether any Intellectual Property Rights (or other rights) that someone might claim over the technology in this document are valid, or how far they reach. It also doesn't say whether any license under those rights is actually available. And it hasn't independently tried to find any of these rights either 🙈 If you want the procedures for rights in RFC documents, check out BCP 78 and BCP 79 📚
Copies of IPR disclosures sent to the IETF Secretariat are available, along with any assurances that licenses will be made available. The same goes for the results of any attempt to get a general license or permission to use these proprietary rights, for implementers or users of this specification. You can find all of that in the IETF online IPR repository at http://www.ietf.org/ipr 🔥
The IETF also invites anyone who's interested to flag any copyrights, patents, patent applications, or other proprietary rights that might cover technology needed to implement this standard. Send that information to the IETF at ietf-ipr@ietf.org 💜
📦 where this page comes from
- ietf: rfc5248 2008-06
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms