RFC 8616

Email Authentication for Internationalized Mail

📅 published June 2019, from ietf

RFC 8616: Email Authentication for Internationalized Mail 💌

Okay bestie, this one is the spec for making SPF, DKIM, and DMARC work when emails have non-ASCII names in them 🌍✨. It was written by J. Levine at Taughannock Networks, and it came out in June 2019. It's a Standards Track doc, so it's an official Internet standard, not just a suggestion 💅. It updates three older specs: RFC 6376 (DKIM), RFC 7208 (SPF), and RFC 7489 (DMARC). It doesn't obsolete anything. The ISSN is 2070-1721 🎀.

Abstract 🦋

SPF, DKIM, and DMARC all let a domain owner publish email auth and policy info in DNS, which is giving trust energy 🔐. The problem is that internationalized domain names can show up as U-labels or A-labels. This spec updates those three specs so it's clear which form to use 🫶.

Status of This Memo 📜

So this is an Internet Standards Track document 💖. It comes from the IETF, which means it reflects what the IETF community agreed on. It got public review and was approved by the IESG. If you want more on Internet Standards, check Section 2 of RFC 7841 🧚.

For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc8616 💜.

This is copyright (c) 2019 IETF Trust and the people listed as the authors, and all rights are reserved 🎀. It's subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they were on the date it was published. Please actually read those, because they lay out your rights and restrictions 🙈. Code pulled out of this document has to include the Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions. It also comes with no warranty, as the Simplified BSD License says 🔥.

Table of Contents 🗂️

   1.  Introduction  . . . . . . . . . . . . . . . . . . . . . . . .   2
   2.  Definitions . . . . . . . . . . . . . . . . . . . . . . . . .   2
   3.  General Principles  . . . . . . . . . . . . . . . . . . . . .   3
   4.  SPF and Internationalized Mail  . . . . . . . . . . . . . . .   3
   5.  DKIM and Internationalized Mail . . . . . . . . . . . . . . .   3
   6.  DMARC and Internationalized Mail  . . . . . . . . . . . . . .   4
   7.  IANA Considerations . . . . . . . . . . . . . . . . . . . . .   5
   8.  Security Considerations . . . . . . . . . . . . . . . . . . .   5
   9.  Normative References  . . . . . . . . . . . . . . . . . . . .   5
   Author's Address  . . . . . . . . . . . . . . . . . . . . . . . .   6

1. Introduction ✨

Okay so SPF [RFC7208], DKIM [RFC6376], and DMARC [RFC7489] are how a domain owner publishes email auth and policy info in DNS 💅. SPF is mostly about which host addresses are allowed to send mail for a domain 📮. DKIM signs email messages with cryptographic signatures, and the keys to check them live in DNS 🔑. DMARC publishes policy about the domain in the From: header field 💫.

In regular email, every domain name is ASCII everywhere, so there's zero question about how to represent them 😌. All internationalized domain names get written as A-labels [RFC5890] in message header fields, SMTP sessions, and DNS 🌐.

Internationalized mail [RFC6530] (usually called "EAI" for Email Address Internationalization) lets you use U-labels in SMTP sessions [RFC6531] and in message header fields [RFC6532] 🦋.

Every U-label has an A-label equivalent, so in theory the label format shouldn't cause ambiguity 🧠. In practice though, using the same label format everywhere makes it way more likely that sender and receiver code actually works together 🫶.

EAI also allows UTF-8-encoded Unicode characters in the local parts of mailbox names. Those local parts used to be ASCII only 🌈.

2. Definitions 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🎀. So they only count as key words when they're in all caps 💅.

The term "IDN", for Internationalized Domain Name, refers to a domain name containing either U-labels or A-labels 🌸.

Since DMARC isn't currently a Standards Track protocol, this spec gives advice for DMARC, not requirements 🙈.

3. General Principles 💜

In headers of EAI mail messages, domain names that were ASCII-only can be U-labels, and mailbox local parts can be UTF-8 ✨. Header field names and other text meant mainly for computers to read instead of people stays ASCII 🤖.

Strings stored in DNS records stay ASCII. There's no way to tell whether a client looking up a DNS record wants an EAI result or an ASCII one 🧚. When a domain name in a mail header field has U-labels, those labels get translated to A-labels before the DNS lookup, as described in [RFC5891] 🔄.

4. SPF and Internationalized Mail 📮

Okay so SPF [RFC7208] uses two identities from the SMTP session: the host name in the EHLO command, and the domain in the address in the MAIL FROM command 🫣. The EHLO command comes before the server response that says whether it supports the SMTPUTF8 extension. So an IDN host name MUST be represented as A-labels 🔒. An IDN in MAIL FROM can be U-labels or A-labels 💖.

All U-labels MUST be converted to A-labels before SPF validation. That includes the labels in the name used for the original DNS lookup, described in Section 3 of [RFC7208], and the labels used in macro expansion of domain-spec, described in Section 7 😤. Section 4.3 of [RFC7208] says all IDNs in an SPF DNS record MUST be A-labels. That rule didn't change, since any SPF record can be used to authorize either EAI or conventional mail 🌍.

SPF macros %{s} and %{l} expand the local part of the sender's mailbox. If the local part has non-ASCII characters, terms that include %{s} or %{l} don't match anything. That's because non-ASCII local parts can't be used as the DNS labels those macros are meant to match 💀. These macros are rarely used, so this probably won't be a problem in practice 🫶.

5. DKIM and Internationalized Mail 🔏

DKIM [RFC6376] defines a mail header field that holds a cryptographic message signature, and a DNS record that holds the validation key 🔑.

Section 2.11 of [RFC6376] defines dkim-quoted-printable. In messages with internationalized header fields, that definition is modified so non-ASCII UTF-8 characters don't need to be quoted 🌸. The ABNF [RFC5234] for dkim-safe-char in those messages is replaced by the following, which adds non-ASCII UTF-8 characters from [RFC3629] ✨:

   dkim-safe-char        =  %x21-3A / %x3C / %x3E-7E /
                                       UTF8-2 / UTF8-3 / UTF8-4
                            ; '!' - ':', '<', '>' - '~', non-ASCII

   UTF8-2                = <Defined in Section 4 of RFC 3629>

   UTF8-3                = <Defined in Section 4 of RFC 3629>

   UTF8-4                = <Defined in Section 4 of RFC 3629>

Section 3.5 of [RFC6376] says IDNs in the d=, i=, and s= tags of a DKIM-Signature header field MUST be encoded as A-labels 🙅‍♀️. That rule only gets relaxed for internationalized message header fields [RFC6532], so IDNs SHOULD be represented as U-labels 💅. That's more consistent with other header fields 🦋. A-labels are still valid so software can transition from older versions 🧚. The allowed characters in the local part of an i= tag are extended the same way as local parts of email addresses in Section 3.2 of [RFC6532] 🌈. When computing or verifying the hash in a DKIM signature, as described in Section 3.7 of [RFC6376], the hash MUST use the domain name in the format it occurs in the header field 🔐.

Section 3.4.2 of [RFC6376] describes relaxed header canonicalization. Its first step converts all header field names from uppercase to lowercase 🔤. Field names are restricted to printable ASCII (see [RFC5322], Section 3.6.8), so that case conversion stays ASCII case conversion 🫶.

DKIM key records, described in Section 3.6.1 of [RFC6376], don't contain domain names, so their specification doesn't change 💜.

Part 1 of 2 ends here 🌈

9. Normative References ✨

okay so these are the docs this whole spec leans on, bestie 🫶 they're the normative ones, which means they're basically required reading. no skipping, no cap 💅

Author's Address 🌸

here's where you can find the author, John Levine, 💌

John Levine
Taughannock Networks
PO Box 727
Trumansburg, NY  14886
United States of America

Email: standards@taugh.com
URI:   http://jl.ly

and that's the whole RFC, bestie 🌈✨

📦 where this page comes from