RFC 5518

Vouch By Reference

📅 published April 2009, from ietf

Vouch By Reference 🦋

Part 1 of 2, bestie! 🧚

Okay so this is RFC 5518, called Vouch By Reference 💌. It came out of the Network Working Group in April 2009 and sits in the Standards Track category, so it's an actual protocol spec. P. Hoffman, J. Levine, and A. Hathcock wrote it. Levine is with the Domain Assurance Council, and Hathcock is with Alt-N Technologies. Hoffman's affiliation isn't listed. The title block doesn't say it obsoletes or updates any other RFCs, so this one stands on its own ✨

Status of This Memo

This doc specifies an Internet standards track protocol for the Internet community, and it's asking for discussion and suggestions for improvements 🫶 For the standardization state and status of this protocol, check the current edition of the "Internet Official Protocol Standards" (STD 1). Distribution of this memo is unlimited 🌈

Copyright Notice

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents, which were in effect on the date it was published. You can find them at http://trustee.ietf.org/license-info. Please read them carefully, because they spell out your rights and restrictions for this document 📜

This document may contain material from IETF Documents or IETF Contributions that were published or made publicly available before November 10, 2008. The people who control the copyright in some of that material may not have given the IETF Trust permission to allow modifications outside the IETF Standards Process. Unless you get an adequate license from the people who control the copyright in those materials, this document can't be modified outside the IETF Standards Process, and derivative works of it can't be created outside the IETF Standards Process either. The one exceptions are formatting it for publication as an RFC and translating it into languages other than English 🙈

Abstract

This doc describes the Vouch By Reference (VBR) protocol 🎀 VBR is a protocol for adding third-party certification to email. It lets independent third parties certify the owner of a domain name that's associated with received mail ✨

   1. Introduction ....................................................3
      1.1. Definitions ................................................4
   2. Use of the VBR-Info Header Field ................................4
   3. Validation Process ..............................................4
   4. The VBR-Info Header Field .......................................5
      4.1. Syntax of VBR-Info Header Fields ...........................5
   5. DNS Query .......................................................6
   6. Types of Message Content ........................................7
      6.1. All ........................................................8
      6.2. List .......................................................8
      6.3. Transaction ................................................8
   7. Obtaining a Useful Domain Name ..................................8
      7.1. DKIM .......................................................8
      7.2. DomainKeys .................................................9
      7.3. SPF ........................................................9
      7.4. Sender ID .................................................10
   8. Security Considerations ........................................10
   9. IANA Considerations ............................................10
   10. References ....................................................11
      10.1. Normative References .....................................11
      10.2. Informative References ...................................11
   Appendix A.  Acknowledgements .....................................12

1. Introduction ✨

Vouch By Reference, or VBR, is a protocol for adding third-party certification to email 💅 Specifically, VBR lets independent third parties certify the owner of a domain name that's associated with received mail. VBR can happen anywhere along the email transit path, by any capable receiving module, either inside the handling service or in end-user software 🧚

VBR gets this done with a two-part protocol:

In the first part, a sender attaches VBR information to email messages. The VBR information says which domain certification services the sender believes will vouch for email traffic associated with that sender 💖
In the second part, the receiver queries one or more certification services to get information about the identity that's been associated with a received message. This part uses the DNS to distribute the certification information 🌸

A sender gives certification attestations through a brand-new RFC 5322 ([RFC5322]) mail header field, "VBR-Info:". This header field has the names of services the sender claims will vouch for the message, plus the particular type of content in it. A queried, third-party, DNS-based certification service can reply with a list of the types of message content it'll vouch for, like "transactional mail from somebank.example" and/or "all mail from anotherbank.example" 🔥

Valid identity is a prerequisite for VBR to work. VBR is built on domain names as identifiers, and it allows several ways of getting and validating domain names. The validation methods are covered in the "Obtaining a Useful Domain Name" section below 🫶

The sender does two things:

Adds a VBR-Info header field to its message
Protects the message, as appropriate

Lowkey, if a recipient uses the results of vouching to adjust spam scores on incoming email, that recipient is putting a huge amount of operational trust and power in the vouching service 😭 So recipients need to choose these services with care. Also, those recipients may want to pick more than one vouching service so there's no single point of failure for setting spam scores 💀

1.1. Definitions

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 📖

2. Use of the VBR-Info Header Field 🌈

A sender uses VBR to say which domain certification services it thinks will vouch for a particular piece of mail. The certification service uses VBR to state which signatures it'll vouch for. This protocol uses the DNS to distribute the certification information ✨

A message can have multiple VBR-Info header fields. In the terminology of RFC 5322, that makes VBR-Info a "trace header field", and it SHOULD be added at the top of the header fields 💜

The content of the VBR-Info header field is a list of three elements:

The accountable domain
The type of content in the message
A list of domain names of services that the sender expects to vouch for that kind of content

The accountable domain is written as md= followed by a domain name. The content type is written as mc= followed by a string, and the defined values of that string are listed below. The list of services is written as mv= followed by a colon-separated list of domain names 🎀

The formal syntax of the header field is defined in Section 4 🧚

3. Validation Process 🔍

A message receiver uses VBR to figure out certification status by following these steps:

Extracts the domain to certify and the type of message content
Verifies legitimate use of that domain using one or more authentication mechanisms as described herein
Obtains the name of a vouching service that it trusts, either from among the set supplied by the sender or from a locally defined set of preferred vouching services
Queries the vouching service to determine whether the vouching service actually vouches for that type of content for that domain 👑

4. The VBR-Info Header Field 🦋

The VBR-Info header field has this format:

   VBR-Info: md=<domain>; mc=<type-string>; mv=<certifier-list>;

Here, <domain> is the domain that vouching is offered for, <type-string> is the content type of the message, and <certifier-list> is a list of domain names of certification providers that the sender asserts will vouch for this particular message. The <certifier-list> is one or more domain names with a colon (":") between each. The <domain>, <type-string>, and <certifier-list> bits can't have any white space in them 🙅‍♀️

For example, say the signer has two companies willing to vouch for its transactional notices: certifier-a.example and certifier-b.example. The signer would add this to the header of its outgoing message:

   VBR-Info: md=somebank.example; mc=transaction;
       mv=certifier-a.example:certifier-b.example;

All three header parameters in the VBR-Info header are mandatory. There's no default for the md= domain, so you can't skip it 💅

Uppercase and lowercase characters in a VBR-Info header field are equivalent, though by convention the contents are all lowercase 🌸 For upward compatibility, verifiers MUST accept the fields in any order, and they SHOULD ignore any fields other than the three defined here ✨

If a message has more than one VBR-Info header field, verifiers SHOULD check each one in turn or in parallel, until either a satisfactory certifier is found or all the header fields have been checked 🔥 All of the VBR-Info header fields in a single message MUST have identical mc= values 😭

4.1. Syntax of VBR-Info Header Fields 🧩

In the ABNF below, the ALPHA and DIGIT tokens are imported from [RFC5234], and the FWS and domain-name tokens are imported from [RFC4871] 💖

   vbr-info-header =  "VBR-Info:" 1*([FWS] element [FWS] ";")
   element = md-element / mc-element / mv-element

   md-element = "md=" [FWS] domain-name

   mc-element = "mc=" [FWS] type-string
   type-string = "all" / "list" / "transaction"

   mv-element = "mv=" [FWS] certifier-list
   certifier-list = domain-name *(":" domain-name)

5. DNS Query ✨

okay so bestie, here's where the VBR magic actually happens 🔮💅 when a recipient wants to check if a certification claim is valid, it compares the list in the message to the list of services it trusts. for every service on the intersection of those two lists, it builds a domain name to look up, made of these DNS labels (left to right):

the domain name that asserts it can be certified
_vouch (a string literal)
the host name of the vouching service

this domain name gets queried for a DNS TXT record 🎀 and the recipient looks it up in the DNS in the exact same way it looks up literally every other domain name. no special treatment, no cap 💀

here's an example 🦋 if a message signed by somebank.example had the VBR-Info header field from before, the receiver might look up either or both of these names, depending on which vouching service it trusts:

somebank.example._vouch.certifier-b.example
somebank.example._vouch.certifier-a.example

if the DNS TXT record exists, it holds a space-delimited list of all the types that the service certifies, written in lowercase ASCII 🌸 for example, the TXT record might say:

transaction list

so in this example the receiver checks whether either certifier vouches for "transaction" mail. that would show up as either of these types: "all" or "transaction". ("all" means the certifier vouches for every message type the domain sends 👑) if either of those types appears in either TXT record, the certifier has vouched for the message. and of course, the recipient needs to ignore services it doesn't trust 🙈 otherwise a bad actor could just add an authority they set up themselves so it can vouch for itself. not me... 💀

the _vouch label was picked on purpose 🧚 any domain name that includes it as one of its labels cannot be a valid host name, so there's never any accidental overlap with a real host name. ALSO it's safe to make a rule that says a TXT record coming from a domain name with a _vouch label will always have the structure defined in this document. iconic ✨

if the RDATA in the TXT record has multiple character-strings (as defined in Section 3.3 of [RFC1035]), the code handling that DNS reply MUST assemble all of those marshaled text blocks into a single one before any syntactical verification takes place 🫶

then verifiers MUST check that the TXT record consists of strings of lowercase letters separated by spaces, and discard any records that aren't in that format 🧹 this defends against misconfigured records and irrelevant records synthesized from DNS wildcards. slay 💅

the VBR record MUST have only one TXT record 🌈

this query method leans on the considerable advantages of existing DNS efficiencies, reliability, and experience 🚀 the lookup is very efficient, and certifiers can add and delete client records as quickly as they want 🍓 the lookup also takes advantage of the DNS's negative caching ([RFC2308]). main character energy fr 👑

6. Types of Message Content 🌷

okay so this section is about the types of content a certifier can vouch for 💭 the rest of the VBR spec is mostly technical and precise, but describing the types of contents in mail messages is inherently open to interpretation 🙃 so this section makes distinctions as specifically as possible, BUT the reader needs to understand that these semantic definitions can be interpreted in pretty different ways by different people 🫠

note that the value in the mc= element is self-asserted 🙈 its purpose is for auditing. there will likely be cases where a certifier vouches for one type of a sender's mail (like transactional mail) but not another type (like advertising). a sender who can't get anyone to certify its advertising mail, but has a certifier for its transactional mail, might be tempted to cheat and mislabel the advertising as transactional 😭 the mc= element creates an audit trail to help certifiers catch that cheating and allow removal of the certification for the transactional mail. rude but fair 💅

three types of content are defined ✨

6.1. All

"all" means all mail from the sender 🌍

6.2. List

"list" is the category for email sent to multiple recipients where each piece of mail is identical or very similar to the others 📬

6.3. Transaction

"transaction" is the category for transactional messages 💸 this is a response to a specific action of the user, or a notice about an event in the user's account at the sender 🔔

7. Obtaining a Useful Domain Name 🔑

VBR relies on having a domain name that specifies a party that is accountable for the message 🧾 this requires obtaining the domain name and having a strong basis for believing that using it is valid, meaning it has not been spoofed 🕵️‍♀️

there are different ways to achieve this, and this section goes over the allowed mechanisms. senders SHOULD use Domain Keys Identified Mail (DKIM) (and MAY use DomainKeys, Sender Policy Framework (SPF), or SenderID) to give an accountable identity for the sender 💖

7.1. DKIM

DomainKeys Identified Mail (DKIM), [RFC4871], defines an accountable identity by associating a domain name with the message 🦢 it provides assurance that the association is valid through a public-key-based authentication mechanism 🔐

when DKIM is the validation mechanism, VBR's md= MUST match the domain name taken from one of the DKIM-Signature header fields. if the DKIM signature contains an i= field, the domain name from that field is used; otherwise, the domain name from the DKIM signature d= field is used 🎯
the VBR-Info header field SHOULD be included in the set of header fields protected by DKIM, to prevent a malicious party from changing the contents of the VBR-Info header field or adding bogus VBR-Info header fields 🛡️
the VBR-Info header field SHOULD be added in the header immediately below the corresponding DKIM-Signature header field 📍

if the DKIM signature validates, the domain name taken from that signature is valid for use with VBR ✅

7.2. DomainKeys

DomainKeys (DK), [RFC4870], defines an accountable identity by associating a domain name with the message in the d= tag of the DomainKey-Signature header field 🗝️ it provides assurance that the association is valid through a public-key-based authentication mechanism 🔏

when DomainKeys is the validation mechanism, VBR's md= MUST be the same value as the domain name found in the DomainKey-Signature d= parameter 🎀
the VBR-Info header field SHOULD be included in the set of header fields protected by DK, to prevent a malicious party from changing the contents of the VBR-Info header field or adding bogus VBR-Info header fields 🫧
the VBR-Info header field SHOULD be added immediately below the corresponding DomainKey-Signature header field 🌷

if the DomainKeys signature validates, the domain in the d= tag is valid for use with VBR 🙌

7.3. SPF

Sender Policy Framework (SPF), [RFC4408], defines an accountable identity by using an existing message address and querying the DNS to discover whether it is valid for SPF use 🌐

when SPF is the validation mechanism, VBR's md= MUST be the same value as the domain name in the <reverse-path> address that is the first parameter to the SMTP MAIL command 📮

a domain is valid for use with VBR only when the SPF process produces a "pass" result 💯

7.4. Sender ID

Sender ID, [RFC4406], defines an accountable identity by using an existing message address known as the Purported Responsible Address ([RFC4407]) and querying the DNS to discover whether it is valid for Sender ID use 🪪

when Sender ID is the validation mechanism, VBR's md= MUST be the same value as the domain name in the Purported Responsible Address in the message 🎯

a domain is valid for use with VBR only when the Sender ID process produces a "pass" result 💫

8. Security Considerations 🚨

bestie, this one is SERIOUS 😤 read it closely.

VBR is used to let users trust independent third parties to certify the owner of a domain name that is associated with received mail 🤝 the party validating the mail might use that trust relationship to perform actions that affect the security of their system 😬

the receiver of a message with a VBR-Info header field MUST ignore certifiers that it does not trust; otherwise, a bad actor could just add an authority that it has set up so that it can vouch for itself 🚫 no exceptions, babe.

implementations SHOULD limit the number of VBR-Info header fields they process in a single message, in order to protect themselves from a make-work or denial-of-service attack 🛑

9. IANA Considerations 📋

IANA registered the VBR-Info header field in the Message Header Fields Registry ([RFC3864]) as follows:

Header field name: VBR-Info

Applicable protocol: mail

Status: standard

Author/Change controller: IETF

Specification document(s): RFC 5518

Related information: none

10. References 📚

10.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119, March 1997.

[RFC5234]  Crocker, D. and P. Overell, "Augmented BNF for Syntax
           Specifications: ABNF", STD 68, RFC 5234, January 2008.

[RFC5322]  Resnick, P., Ed., "Internet Message Format", RFC 5322,
           October 2008.

10.2. Informative References

[RFC1035]  Mockapetris, P., "Domain names - implementation and
           specification", STD 13, RFC 1035, November 1987.

[RFC2308]  Andrews, M., "Negative Caching of DNS Queries (DNS
           NCACHE)", RFC 2308, March 1998.

[RFC3864]  Klyne, G., Nottingham, M., and J. Mogul, "Registration
           Procedures for Message Header Fields", BCP 90, RFC 3864,
           September 2004.

[RFC4406]  Lyon, J. and M. Wong, "Sender ID: Authenticating E-Mail",
           RFC 4406, April 2006.

[RFC4407]  Lyon, J., "Purported Responsible Address in E-Mail
           Messages", RFC 4407, April 2006.

[RFC4408]  Wong, M. and W. Schlitt, "Sender Policy Framework (SPF)
           for Authorizing Use of Domains in E-Mail, Version 1",
           RFC 4408, April 2006.

[RFC4870]  Delany, M., "Domain-Based Email Authentication Using
           Public Keys Advertised in the DNS (DomainKeys)", RFC 4870,
           May 2007.

[RFC4871]  Allman, E., Callas, J., Delany, M., Libbey, M., Fenton,
           J., and M. Thomas, "DomainKeys Identified Mail (DKIM)
           Signatures", RFC 4871, May 2007.

Appendix A. Acknowledgements 🫶

many members of the Domain Assurance Council contributed to the design of the protocol and the wording of this document 💜 in addition, constructive suggestions were received from Jim Fenton and Murray Kucherawy 🌟

Authors' Addresses

Paul Hoffman
Domain Assurance Council

EMail: paul.hoffman@domain-assurance.org


John Levine
Domain Assurance Council

EMail: john.levine@domain-assurance.org


Arvel Hathcock
Alt-N Technologies

EMail: arvel.hathcock@altn.com

📦 where this page comes from

ietf: rfc5518 2009-04
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms