RFC 9694

Guidelines for the Definition of New Top-Level Media Types

📅 published March 2025, from ietf

RFC 9694: Guidelines for the Definition of New Top-Level Media Types 💖

Okay bestie, here's the title block tea ☕. This is RFC 9694, written by M.J. Dürst at Aoyama Gakuin University and published in March 2025. It's a Best Current Practice (so it's BCP 13 🎀), it's an IETF document with ISSN 2070-1721, and it updates RFC 6838. It doesn't list anything it obsoletes, so there's nothing to report there 🙈.

Abstract ✨

This doc is basically the rulebook for making brand-new top-level media types 📋. It also sets up a registry for top-level media types 🗂️, and it includes a short history of them 📜. And yes, it updates RFC 6838 🦋.

Status of This Memo 💅

This memo is an Internet Best Current Practice. It's a product of the IETF, so it reflects what the IETF community agreed on 🫶. It got public review and was approved for publication by the Internet Engineering Steering Group (IESG). If you want more on BCPs, check Section 2 of RFC 7841. For the current status, any errata, and how to send feedback, go to https://www.rfc-editor.org/info/rfc9694.

Copyright (c) 2025 IETF Trust and the people listed as the document authors. All rights reserved. This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Please read those carefully, because they spell out your rights and restrictions for this document. Any Code Components pulled out of this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, as the Revised BSD License describes.

Table of Contents 📑

1.  Introduction
  1.1.  Background
  1.2.  Requirements Language
2.  Rules and Criteria for the Registration of New Top-Level Media
        Types
  2.1.  Required Criteria
  2.2.  Additional Considerations
  2.3.  Negative Criteria
3.  Top-Level Media Type History
4.  IANA Considerations
  4.1.  Registration of Top-level Media Types
  4.2.  Initialization of the Registry of Top-Level Media Types
5.  Security Considerations
Acknowledgements
References
  Normative References
  Informative References
Author's Address

1. Introduction 🦋

This doc is all about best practices for defining new top-level media types. Top-level media types (I'll call them 'top-level types' for short) sit to the left of the slash in a media type, like 'text/...', 'application/...', 'image/...', and so on. Heads up, though: top-level types are different from trees (standards tree, vendor tree, personal tree). Those trees, except for the standards tree, sit right of the slash with a prefix of '.../vnd.' or '.../prs.'. Section 4.2.7 of RFC 6838 [RFC6838] only gives criteria for defining more top-level media types in a quick summary. This doc gives more detailed criteria for that, so it updates RFC 6838 [RFC6838] 💖.

1.1. Background ✨

New top-level types are rare, and they're different enough from each other that every application needs to be checked on its own 🔍. The main way media types get extended is through subtypes under each of the main types. For formats that don't fit under any other top-level type, the 'application' top-level type always works as a catch-all 📦.

The main job of media types and subtypes is sending data formats to the right application code 🎯. Most of the time, that dispatch uses the full type (the subtype included, and often some parameters too). The top-level type can sometimes act as a fallback when a tentative dispatch goes to applications that handle a really wide range of related formats. Be careful, though: assumptions about whether a media type is correct have to be made carefully, because an attacker could be the one controlling it 🚨.

In some older setups, you could identify a device by its media type (like a phone for audio messages, a printer or fax machine for images, a video recorder for videos, or a computer for 'application' subtypes). Today's hardware is different. Computers and smartphones can handle a huge variety of media, so that kind of setup looks pretty far-fetched now 📱.

The top-level type can also be used for user-facing info. Besides a user reading the type string directly, this includes showing different default icons for different top-level types 🎀.

1.2. Requirements Language 📝

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this doc get interpreted as described in BCP 14 [RFC2119] [RFC8174], but only when they show up in all capitals, just like they do here 🤓.

2. Rules and Criteria for the Registration of New Top-Level Media Types 👑

This section lays out the rules and criteria for new top-level media types. That includes the criteria already set out in RFC 6838 [RFC6838] 📜.

2.1. Required Criteria 🔥

Here's the list of required criteria for defining a new top-level type, plus the reasons behind each requirement 💅.

  • Every new top-level type MUST be defined in a Standards Track RFC (see Section 4.9 of RFC 8126 [RFC8126]). This makes sure there's enough community interest, review, and consensus for a new top-level type ✨.
  • The IANA Considerations section of an RFC that defines a new top-level type MUST request that IANA add this new top-level type to the registry of top-level types 🗂️.
  • The criteria for what types do and don't fall under the new top-level type MUST be defined clearly. Clear criteria help expert reviewers figure out whether a subtype belongs under the new type, and whether the registration template for a subtype has the right info 🧐. If the criteria can't be defined clearly, that's a strong sign that whatever is being talked about isn't suitable as a top-level type 🚩.
  • Any RFC that defines a new top-level type MUST clearly document the security considerations that apply to all or a significant subset of subtypes 🔐.
  • At a minimum, one subtype MUST be described. A top-level type without any subtypes serves no purpose 💀. Also, the 'example' top-level describes the subtype 'example' 🧚.

2.2. Additional Considerations 🌸

  • If a top-level type is already widely used without being registered, that can point to a real need, so it may be an argument for formally defining it 💜.
  • On the flip side, using unregistered top-level types is highly discouraged 🙅‍♀️.
  • You don't need an IETF WG to define a new top-level type, but it can be a good idea in some cases 🤝. There are examples of new top-level type definitions done without a WG (RFC 2077 [RFC2077]), with a short, dedicated WG (RFC 8081 [RFC8081]), and with a WG that also covered other related work (RFC 9695 [RFC9695]).
  • The document that defines the new top-level type should include initial registrations of actual subtypes. The exception might be a top-level type like 'example'. Doing this helps show the need for the new top-level type, lets people check that the definition makes sense, saves separate work on registering a first batch of subtypes, and gives examples of what counts as a valid subtype for future registrations 🦋.
  • You should expect a certain number of subtypes to be registered and actually used under the new top-level type. One subtype isn't enough. It should be clear that similar new types may show up later. Otherwise, creating a new top-level type is probably not justified 🙄.
  • The people proposing the new top-level type, plus the wider user community, should be willing to commit to producing and consuming the new top-level type in environments they control 🫡.
  • Desirability for common parameters: if a group of (potential) types mostly share common parameters, that may be a sign they belong under a common new top-level type 🎀.
  • Top-level types can help humans understand and debug things. So how a new top-level type helps humans understand types may be crucial to evaluate. But as always with humans, opinions can vary a lot 🙃.
  • Common restrictions may apply to all subtypes of a top-level type. Examples include the restriction to CRLF line endings for subtypes of type 'text' (at least in the context of electronic mail), or for subtypes of type 'multipart' 📧.
  • Top-level types are also used a lot in dispatching code. For example, multipart/* is often handled as multipart/mixed, without understanding any specific subtype 🧩. The top-level types 'image', 'audio', and 'video' also get handled generically a lot. Documents with these top-level types can be passed to applications that handle a wide variety of image, audio, or video formats 🖼️🎵🎬. HTML-generating applications can pick different HTML elements (for example, <img> or <audio>) to include data from different top-level types 🌈. Applications can also pick different icons to represent unknown types within different top-level types 💖.

2.3. Negative Criteria 🚫

This subsection lists the negative criteria for top-level types. In other words, it spells out the things that are explicitly NOT reasons to register a top-level type 🙅.

  • A top-level type is not a pointer into another registration space that offers duplicate registrations for existing media types. For example, a top-level type of 'oid' would lead to types like oid/nnnnn, where nnnnn is an OID (Object Identifier) designating a specific media format 🔢.
  • A top-level type MUST NOT be defined for the mapping of other protocol elements to media types. For example, a mapping from media types to URIs might have some merit, like in the context of RDF (Resource Description Framework) [RDF]. But a reverse mapping has very limited merit, and creating a top-level type for such a mapping has even less. The same goes for other protocol elements, like file extensions or URI schemes 🚧. If you do need a mapping, the recommended solution is to choose a single type/subtype and put the extra info in an appropriately named parameter. As an example, info about a file extension '.dcat' can be encoded as application/octet-string; filename=foo.dcat 🎁.
  • Media types aren't a general type system. A top-level type MUST NOT be defined if its main or only purpose is to map other type systems, like those in programming languages or ontologies 🧠.
  • A new top-level type SHOULD NOT generate aliases for existing widely used types or subtypes 🙅‍♀️.
  • Top-level types with an "X-" prefix cannot be registered, and SHOULD NOT be used. This lines up with RFC 6648 [RFC6648] 💅.

3. Top-Level Media Type History 🦋

Okay bestie, this section is the tea ☕ on how top-level types have been added over the years. We're only looking at the parts that matter for adding new ones, so let's go!

RFC 1341 [RFC1341] first defined the structuring of content types into (top-level) type and subtype, and introduced the text, multipart, message, image, audio, video, and application top-level types. That spec also allowed top-level types starting with X-. On new top-level types, it said:

An initial set of seven Content-Types is defined by this document. This set of top-level names is intended to be substantially complete. It is expected that additions to the larger set of supported types can generally be accomplished by the creation of new subtypes of these initial types. In the future, more top-level types may be defined only by an extension to this standard. If another primary type is to be used for any reason, it must be given a name starting with "X-" to indicate its non-standard status and to avoid a potential conflict with a future official name.

RFC 1437 [RFC1437] defined the first additional top-level type 🙈. It never got registered, though, because RFC 1437 is an April Fools RFC that was published purely for entertainment purposes. 💀

RFC 2046 [RFC2046] discouraged the use of "X-" for (new) top-level types, with these words:

In general, the use of "X-" top-level types is strongly discouraged. Implementors should invent subtypes of the existing types whenever possible. In many cases, a subtype of "application" will be more appropriate than a new top-level type.

RFC 2048 [RFC2048], published at the same time as RFC 2046 [RFC2046], set the requirements for defining new top-level types:

In some cases a new media type may not "fit" under any currently defined top-level content type. Such cases are expected to be quite rare. However, if such a case arises a new top-level type can be defined to accommodate it. Such a definition must be done via standards-track RFC; no other mechanism can be used to define additional top-level content types.

The model top-level type was introduced by RFC 2077 [RFC2077] in 1997. 🧚

RFC 4735 [RFC4735] introduced the example top-level type for use in documentation examples. 📚

The font top-level type was defined in RFC 8081 [RFC8081], a work of the justfont IETF WG, in 2017. It formalized the widespread use of the unofficial font top-level type that people were already using in preference to official, registered types. ✨

RFC 9695 [RFC9695] defines a new haptics top-level type. RFC 9695 and this document were developed in parallel, and RFC 9695 was used to cross-check the considerations and procedures defined in this document. 🫶

The "Chemical file format" Wikipedia page [CHEMICAL] reports the unofficial use of a chemical top-level type. It was proposed by Peter Murray-Rust and Henry Rzepa at a workshop at the First WWW conference in May 1994 [CHEMIME]. It's in widespread use but remains unregistered. 🧪

Some Linux desktop logic uses what looks like a top-level type of x-scheme-handler to map URI schemes to applications. The type inode/directory is also used. However, this is a purely local, system-specific use and is not intended for exchange. If exchange or standardization are desired, different types (in all cases, properly registered) are strongly recommended. As an example, x-scheme-handler/http should be changed to something like application/scheme-handler; scheme=http. As another example, the type inode/directory should be changed to multipart/inode-directory or application/inode-directory. 🌈

The document that previously defined the requirements for new top-level media types was RFC 6838 [RFC6838]. The parts of [RFC6838] that matter most here are Sections 4.2.5 (Application Media Types) and 4.2.7 (Additional Top-Level Types). These two sections aren't strictly aligned, because the first says that anything that doesn't go under a more specific type can go under the application top-level type, while the later section allows for new top-level types. It's a little bit of a plot twist 👀

4. IANA Considerations 💅

4.1. Registration of Top-level Media Types

Registrations of new top-level types follow the "Standards Action" policy (see Section 4.9 of RFC 8126 [RFC8126]).

Registrations of new top-level types have to provide the name of the top-level type, the defining specification (RFC, or the respective draft during the approval process), and, if applicable, some comments. The defining specification has to contain an "IANA Considerations" section requesting addition to the registry of top-level media types, and has to document security considerations for the top-level type they register. 🔐

The comments field is empty or contains short comments about the usage of the type. Comments can be added or updated by the experts for subtype registrations under the respective top-level type, and by IANA itself. 📝

There should be at least one subtype, except for registrations that are for demonstration purposes only (e.g., the example top-level type). 🎀

4.2. Initialization of the Registry of Top-Level Media Types

IANA has created the "Top-Level Media Types" registry (https://www.iana.org/assignments/top-level-media-types) and populated it with the values in Table 1. IANA also added a pointer to this registry from the "Media Types" registry group (https://www.iana.org/assignments/media-types), and they added pointers to this document and to the "Top-Level Media Types" registry in the application for a media type at <https://www.iana.org/form/media-types>. 🍓

For each top-level media type, the registry contains the name of the type, a pointer to the RFC defining the type, a pointer to IANA's registry of subtypes for that type, and a comment field. 🌸

The initial state of the registry is as follows:

  +=============+==============+==============+===================+
  | Name        | Defining RFC | Registry of  | Comments          |
  |             |              | Subtypes     |                   |
  +=============+==============+==============+===================+
  | application | [RFC2046]    | [Application | -                 |
  |             |              | Media Types] |                   |
  +-------------+--------------+--------------+-------------------+
  | audio       | [RFC2046]    | [Audio Media | -                 |
  |             |              | Types]       |                   |
  +-------------+--------------+--------------+-------------------+
  | example     | [RFC4735]    | [Example     | no registrations, |
  |             |              | Media Types] | for examples only |
  +-------------+--------------+--------------+-------------------+
  | font        | [RFC8081]    | [Font Media  | -                 |
  |             |              | Types]       |                   |
  +-------------+--------------+--------------+-------------------+
  | haptics     | [RFC9695]    | [Haptics     | -                 |
  |             |              | Media Types] |                   |
  +-------------+--------------+--------------+-------------------+
  | image       | [RFC2046]    | [Image Media | -                 |
  |             |              | Types]       |                   |
  +-------------+--------------+--------------+-------------------+
  | message     | [RFC2046]    | [Message     | -                 |
  |             |              | Media Types] |                   |
  +-------------+--------------+--------------+-------------------+
  | model       | [RFC2077]    | [Model Media | -                 |
  |             |              | Types]       |                   |
  +-------------+--------------+--------------+-------------------+
  | multipart   | [RFC2046]    | [Multipart   | -                 |
  |             |              | Media Types] |                   |
  +-------------+--------------+--------------+-------------------+
  | text        | [RFC2046]    | [Text Media  | requires CRLF for |
  |             |              | Types]       | newlines          |
  +-------------+--------------+--------------+-------------------+
  | video       | [RFC2046]    | [Video Media | -                 |
  |             |              | Types]       |                   |
  +-------------+--------------+--------------+-------------------+

Table 1: Initial Values for the Registry of Top-level Media Types 📊

5. Security Considerations 🔥

This document itself is not expected to introduce any security issues. Still, the security issues related to introducing a new top-level media type MUST be evaluated and documented carefully. 🚨 This part is seriously important, no cap.

Acknowledgements 🫶

Continuous encouragement for writing this document came from Harald Alvestrand. Further encouragement was provided by Murray S. Kucherawy. Both Harald and Murray also provided ideas for actual text. Without them, this memo would never have reached even the first draft stage. Alexey Melnikov provided the difficult-to-find pointer to RFC 2077 [RFC2077] and examples for applications dispatching on top-level types. Additional information and comments were received from Chris Lilley, Graham Kline, Henry S. Rzepa, Francesca Palombini, Zaheduzzaman Sarker, Amanda Baber, Paul Wouters, Roman Danyliw, John Scudder, Radia Perlman, Lars Eggert, and Antoine Fressancourt. Inspiration for negative criteria or examples was provided by Phillip Hallam-Baker, Donald E. Eastlake 3rd, Petter Reinholdtsen, and Christian Heller. The whole squad was so supportive 💖

References

Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC6838]  Freed, N., Klensin, J., and T. Hansen, "Media Type
           Specifications and Registration Procedures", BCP 13,
           RFC 6838, DOI 10.17487/RFC6838, January 2013,
           <https://www.rfc-editor.org/info/rfc6838>.

[RFC8126]  Cotton, M., Leiba, B., and T. Narten, "Guidelines for
           Writing an IANA Considerations Section in RFCs", BCP 26,
           RFC 8126, DOI 10.17487/RFC8126, June 2017,
           <https://www.rfc-editor.org/info/rfc8126>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

Informative References 📚

Okay bestie, these are the receipts 🧾 the rest of the doc leans on. Here's the reading list, unchanged.

Author's Address 🎀

Here's who wrote it, so you can say thank you 🫶

  • Martin J. Dürst
  • Aoyama Gakuin University
  • Fuchinobe 5-10-1, Chuo-ku, Sagamihara, Kanagawa
  • 252-5258
  • Japan
  • Phone: +81 42 759 6329
  • Email: duerst@it.aoyama.ac.jp
  • URI: https://www.sw.it.aoyama.ac.jp/Dürst/
📦 where this page comes from