RFC 9755

IMAP Support for UTF-8

📅 published March 2025, from ietf

📬 RFC 9755: IMAP Support for UTF-8 💖

Okay bestie, get ready, this one is SO good 🫶✨ It's the IMAP one, and it's all about letting UTF-8 international characters work in user names, mail addresses, and message headers 🌸. Lowkey the whole point is making email work for everyone, no matter what alphabet they type in 🌈.

Here's the title block tea ☕: this is RFC 9755, a Standards Track document from the IETF 🎀. It's written by P. Resnick (Episteme), J. Yao (CNNIC), and A. Gulbrandsen (ICANN) 👑. It came out in March 2025 🦋. It obsoletes RFC 6855 💅, which means it replaces that older one, and it doesn't update anything else. The ISSN is 2070-1721 ✨.

Abstract

This spec extends IMAP4rev1 (that's RFC 3501 🧚) so it can handle UTF-8 characters in user names, mail addresses, and message headers. It replaces RFC 6855. It does NOT extend IMAP4rev2 (RFC 9051), because that one already has everything in this extension 💜. Iconic, right? 😭

Status of This Memo

This is an Internet Standards Track document 🔥. It's a product of the IETF and it has the consensus of the IETF community 🫶. It went through public review and got approved by the IESG 💅. For more on Internet Standards, check Section 2 of RFC 7841 🌸.

Info about the current status, errata, and how to give feedback lives at https://www.rfc-editor.org/info/rfc9755 🎀.

Copyright Notice

Copyright (c) 2025 IETF Trust and the document authors. All rights reserved 🌈. This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Read them carefully, they're about your rights 💖. Any Code Components pulled out of this doc must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and come without warranty as the Revised BSD License says 🦋.

1.  Introduction
2.  Requirements Language
3.  "UTF8=ACCEPT" IMAP Capability and UTF-8 in IMAP Quoted-Strings
4.  "APPEND" Command
5.  "LOGIN" Command and UTF-8
6.  FETCH BODYSTRUCTURE and message/global
7.  "UTF8=ONLY" Capability
8.  Dealing with Legacy Clients
9.  Issues with UTF-8 Header Mailstore
10. IANA Considerations
11. Security Considerations
12. References
  12.1.  Normative References
  12.2.  Informative References
Appendix A.  Design Rationale
Appendix B.  Changes Since RFC 6855
  B.1.  APPEND UTF8
  B.2.  FETCH BODYSTRUCTURE
Acknowledgments
Authors' Addresses

1. Introduction ✨

This spec is part of the Email Address Internationalization protocols, described in the Email Address Internationalization Framework document [RFC6530] 🌸. It extends IMAP [RFC3501] to allow UTF-8 [RFC3629] in headers, as in "Internationalized Email Headers" [RFC6532] 💜. It also adds a way to support mailbox names that use the UTF-8 charset 🦋. Two new IMAP capabilities are created so servers can advertise these extensions 🎀.

This spec assumes the IMAP server is running in a fully internationalized environment, meaning every client that accesses the server can accept non-ASCII message header fields and other info, as Section 3 describes 🌈. At least during a transition period, that assumption won't be realistic for many environments. The issues are discussed in Section 7 below 💅.

This spec replaces an earlier, experimental approach to the same problem. See [RFC5738] and [RFC6855] 🧚.

2. Requirements Language 👑

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be read as described in BCP 14 [RFC2119] [RFC8174], but ONLY when they show up in all capitals, just like here 🫶. Lowercase versions are just regular words 🙈.

3. "UTF8=ACCEPT" IMAP Capability and UTF-8 in IMAP Quoted-Strings 🎀

The "UTF8=ACCEPT" capability tells you the server can open mailboxes with internationalized messages using the "SELECT" and "EXAMINE" commands, and it can send UTF-8 responses to "LIST" and "LSUB" 🌸. It also affects other IMAP extensions that return mailbox names or their prefixes, like NAMESPACE [RFC2342] and ACL [RFC4314] ✨.

The "UTF8=ONLY" capability (more on that in Section 7) implies "UTF8=ACCEPT" 💖. A server counts as supporting "UTF8=ACCEPT" if it advertises either "UTF8=ACCEPT" or "UTF8=ONLY" 🦋.

A client MUST use the "ENABLE" command [RFC5161] with the "UTF8=ACCEPT" option (defined in Section 4 below) 🔥. This tells the server the client accepts UTF-8 in quoted-strings and supports the "UTF8=ACCEPT" extension 💅. The "ENABLE UTF8=ACCEPT" command is only valid in the authenticated state 🌈.

Okay, here's the tea 🍵: the IMAP base spec [RFC3501] forbids 8-bit characters in atoms or quoted-strings 😭. So a UTF-8 string can only be sent as a literal 🙈. That's inconvenient for coding, and unless the server offers IMAP non-synchronizing literals [RFC7888], each UTF-8 string the client sends needs an extra round trip 💀. When the server supports "UTF8=ACCEPT", it supports UTF-8 in quoted-strings using this ABNF syntax [RFC5234] 🧚:

      quoted        =/ DQUOTE *uQUOTED-CHAR DQUOTE
             ; QUOTED-CHAR is not modified, as it will affect
             ; other RFC 3501 ABNF non-terminals.

      uQUOTED-CHAR  = QUOTED-CHAR / UTF8-2 / UTF8-3 / UTF8-4

      UTF8-2        =   <Defined in Section 4 of RFC 3629>

      UTF8-3        =   <Defined in Section 4 of RFC 3629>

      UTF8-4        =   <Defined in Section 4 of RFC 3629>

When the client uses this extended quoting, the server MUST reject, with a "BAD" response, any octet sequences with the high bit set that don't follow the formal syntax rules of UTF-8 [RFC3629] 🚫. And the IMAP server MUST NOT send UTF-8 in quoted-strings to a client unless that client has said it supports this syntax by using "ENABLE UTF8=ACCEPT" 💜.

If the server supports "UTF8=ACCEPT", the client MAY use extended quoted syntax with any IMAP argument that allows a string (including astring and nstring) 🌸. But if non-US-ASCII characters show up somewhere they don't belong, the result is the same as using any other syntactically valid but semantically invalid characters 🙈. The next paragraphs spell out where UTF-8 is and isn't allowed ✨.

All IMAP servers that support "UTF8=ACCEPT" SHOULD accept UTF-8 in mailbox names 🎀. Those that also support the Mailbox International Naming Convention described in [RFC3501], Section 5.1.3, MUST accept UTF-8 in mailbox names and convert them to the right internal format 🦋. Mailbox names MUST follow the Net-Unicode Definition ([RFC5198], Section 2), with one special exception: they MUST NOT contain control characters (U+0000 - U+001F and U+0080 - U+009F), a delete character (U+007F), a line separator (U+2028), or a paragraph separator (U+2029) 🔥.

Once an IMAP client has turned on UTF-8 support with "ENABLE UTF8=ACCEPT", it MUST NOT issue a "SEARCH" command that has a charset specification 🚫. If the server gets such a "SEARCH" command in that situation, it SHOULD reject it with a "BAD" response, because the charset labels conflict 💅. This also applies to any IMAP command or extension that includes an optional charset label and related strings in its arguments, including the MULTISEARCH extension 🌈. For commands with a mandatory charset field, like SORT and THREAD, servers SHOULD reject charset values other than UTF-8 with a "BAD" response (again, because of the conflicting charset labels) 💖.

4. "APPEND" Command 🦋

If the server supports "UTF8=ACCEPT", then it accepts UTF-8 headers in the "APPEND" command message argument ✨.

If an IMAP server supports "UTF8=ACCEPT" and the client hasn't issued "ENABLE UTF8=ACCEPT", the server MUST reject, with a "NO" response, any "APPEND" command that includes an 8-bit character in message header fields 🚫.

This spec does NOT extend the IMAP "LOGIN" command [RFC3501] to support UTF-8 usernames and passwords 🙅. Whenever a client needs UTF-8 usernames or passwords, it MUST use the IMAP "AUTHENTICATE" command, which can already pass UTF-8 usernames and credentials 🫶.

Using "AUTHENTICATE" this way makes it syntactically legal to have a UTF-8 username or password 🧚. But there's NO guarantee that the user provisioning system the IMAP server uses will allow those identities 😬. That's an implementation decision, and it may depend on which identity system the server is set up to use 🔥.

6. FETCH BODYSTRUCTURE and message/global 💜

[RFC9051], Section 7.5.2 treats message/global like message/rfc, which means that for some messages, the response to FETCH BODYSTRUCTURE depends on whether IMAP4rev1 or IMAP4rev2 is in use 🌈.

[RFC6855] doesn't extend [RFC3501] in this respect. This doc extends the media-message ABNF production to match [RFC9051] 🎀.

      media-message   = DQUOTE "MESSAGE" DQUOTE SP
                        DQUOTE ("RFC822" / "GLOBAL") DQUOTE

When IMAP4rev1 and UTF8=ACCEPT have been enabled, the server MAY treat message/global like message/rfc822 when computing the body structure 🦋. It MAY also treat it as described in [RFC3501] ✨. Clients MUST accept both cases 💖.

When IMAP4rev2 and UTF8=ACCEPT are in use, the server MUST behave as described in [RFC9051] 👑.

7. "UTF8=ONLY" Capability 🎀

The "UTF8=ONLY" capability says the server supports "UTF8=ACCEPT" (see Section 3) and that it REQUIRES UTF-8 support from clients 🔥. In particular, the server will send UTF-8 in quoted-strings, and it will NOT accept the older international mailbox name convention (modified UTF-7 [RFC3501]) 💀. Since these are incompatible changes to IMAP, the server has to announce it explicitly and clients have to confirm it: clients MUST use "ENABLE UTF8=ACCEPT" before using this server 🫶. A server that advertises "UTF8=ONLY" will reject, with a "NO [CANNOT]" response [RFC5530], any command that might need UTF-8 support and isn't preceded by "ENABLE UTF8=ACCEPT" 🚫.

IMAP clients that find a server announcing "UTF8=ONLY" problematic are encouraged to at least detect the announcement and show an informative error message to the end user 🌸.

Because the "UTF8=ONLY" server capability includes support for "UTF8=ACCEPT", the capability string will include at most one of those and never both 💅. For the client, "ENABLE UTF8=ACCEPT" is always used, never "ENABLE UTF8=ONLY" 🦋.

Part 1 of 3 done, bestie 💖 Sections 8 through the end (Legacy Clients, Mailstore issues, IANA, Security, References, Appendices) are coming in the next parts 🧚✨

8. Dealing with Legacy Clients ✨

okay so bestie, this one is tricky 😭 In most situations, the person running an IMAP (or POP) server has no real way to know whether every client that might touch it, or the mail store in general, can handle the stuff in this doc 🙈 So almost always, a server that follows this spec has to be ready for clients that never turn the relevant capabilities on. There's no totally satisfying fix for that, other than making sure every part of a system that wants to receive email needing SMTPUTF8 is upgraded, including IMAP clients and whatever apps users pick 💅

When a message that needs SMTPUTF8 shows up and the client never enabled the UTF-8 capability, the server has some options. It can hide the problem message(s), send in-band or out-of-band notifications or error messages, or try to make a surrogate of the message so it can give that client useful info about what happened 🦋 Surrogates can't be real replacements for the original, though. They're almost always impossible to reply to (either not at all, or without losing info), and the new header fields or special server-client constructs might go past what current email specs ask for (like [RFC5322]) 😬 So they can confuse some legacy mail user agents (IMAP clients included), or just not give users the info they expected. There are also trade-offs when building surrogates. You can spend more complexity and computing cost trying to keep as much info as possible (see "Post-Delivery Message Downgrading for Internationalized Email Messages" [RFC6857]), or try to keep those costs low while still giving useful info (see "Simplified POP and IMAP Downgrading for Internationalized Email" [RFC6858]) ⚖️

Implementations that choose to perform downgrading SHOULD use one of the standardized algorithms provided in [RFC6857] or [RFC6858]. Getting downgrade algorithms right, and keeping the risk of operational problems and harm to the email system low, is tricky and needs careful engineering 🧠 These two algorithms are well understood and carefully designed, so they're the ones to reach for 🫶

Because these messages are really surrogates of the originals, not really "downgraded" ones (even though people use that word a lot for convenience), they inevitably have relationships to the originals that the IMAP specification [RFC3501] didn't anticipate 👀 That raises two big concerns. First, digital signatures computed over and meant for the original message will often not apply to the surrogate, and will often fail signature verification. (Some digital signatures can still be verified, but only if they cover parts of the original message that weren't changed when the surrogate was made.) Second, servers that the same user might access with different clients or methods (like POP or webmail systems alongside IMAP, or IMAP clients with different capabilities) need to be extremely careful that UIDVALIDITY [RFC3501] behaves the way the user would expect 😰 These issues can be especially sensitive if the server caches the surrogate message, or computes and stores it when the message arrives, with the goal of serving either form depending on client capabilities.

Also, to deal with the case where a server compliant with this extension returns the same UIDVALIDITY to both legacy and "UTF8=ACCEPT"-aware clients, a client that was upgraded from being non-"UTF8=ACCEPT"-aware MUST discard its cache of messages downloaded from the server 🧹 This one is non-negotiable, bestie!

The best (or "least bad") approach for any setup depends on local conditions, assumptions about how users behave, how much control the server operator has over client usage and upgrades, which options are actually available, and so on 🌸 At the time this spec was published, it's impossible to give good advice that works for every situation, or even for particular groups of situations, other than "upgrade legacy clients as soon as possible" 🚀

9. Issues with UTF-8 Header Mailstore 💜

When an IMAP server uses a mailbox format that supports UTF-8 headers, and it lets you select or examine that mailbox without issuing ENABLE UTF8=ACCEPT first, it's the server's job to follow the IMAP base specification [RFC3501] and the Internet Message Format [RFC5322] for all header info sent over the wire 📬 Dealing with messages that contain non-ASCII characters in legacy environments is covered in Section 8, so go check that out too ✨

10. IANA Considerations 🌈

The "IMAP Capabilities" registry had a bunch of references to [RFC6855]. IANA has updated them so they point to this document instead 🎀 The affected entries are:

UTF8=ACCEPT
UTF8=ALL (OBSOLETE)
UTF8=APPEND (OBSOLETE)
UTF8=ONLY
UTF8=USER (OBSOLETE)

11. Security Considerations 🔐

Okay, this section is serious, so listen up 🚨 The security considerations of UTF-8 [RFC3629] and PRECIS Usernames and Passwords [RFC8265] apply to this specification, especially when it comes to using UTF-8 in usernames and passwords 🔑 Other than that, this isn't believed to change the security considerations of IMAP.

There are special considerations, some with real security implications, when a server that conforms to this specification gets accessed by a client that doesn't conform. There are also more complicated situations where one message is accessed by multiple clients that might use different protocols and/or support different capabilities 😱 Those issues are discussed in Section 8, so please read it carefully!

12. References 📚

12.1. Normative References

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC3501]  Crispin, M., "INTERNET MESSAGE ACCESS PROTOCOL - VERSION
           4rev1", RFC 3501, DOI 10.17487/RFC3501, March 2003,
           <https://www.rfc-editor.org/info/rfc3501>.

[RFC3629]  Yergeau, F., "UTF-8, a transformation format of ISO
           10646", STD 63, RFC 3629, DOI 10.17487/RFC3629, November
           2003, <https://www.rfc-editor.org/info/rfc3629>.

[RFC5161]  Gulbrandsen, A., Ed. and A. Melnikov, Ed., "The IMAP
           ENABLE Extension", RFC 5161, DOI 10.17487/RFC5161, March
           2008, <https://www.rfc-editor.org/info/rfc5161>.

[RFC5198]  Klensin, J. and M. Padlipsky, "Unicode Format for Network
           Interchange", RFC 5198, DOI 10.17487/RFC5198, March 2008,
           <https://www.rfc-editor.org/info/rfc5198>.

[RFC5234]  Crocker, D., Ed. and P. Overell, "Augmented BNF for Syntax
           Specifications: ABNF", STD 68, RFC 5234,
           DOI 10.17487/RFC5234, January 2008,
           <https://www.rfc-editor.org/info/rfc5234>.

[RFC5322]  Resnick, P., Ed., "Internet Message Format", RFC 5322,
           DOI 10.17487/RFC5322, October 2008,
           <https://www.rfc-editor.org/info/rfc5322>.

[RFC6530]  Klensin, J. and Y. Ko, "Overview and Framework for
           Internationalized Email", RFC 6530, DOI 10.17487/RFC6530,
           February 2012, <https://www.rfc-editor.org/info/rfc6530>.

[RFC6532]  Yang, A., Steele, S., and N. Freed, "Internationalized
           Email Headers", RFC 6532, DOI 10.17487/RFC6532, February
           2012, <https://www.rfc-editor.org/info/rfc6532>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[RFC8265]  Saint-Andre, P. and A. Melnikov, "Preparation,
           Enforcement, and Comparison of Internationalized Strings
           Representing Usernames and Passwords", RFC 8265,
           DOI 10.17487/RFC8265, October 2017,
           <https://www.rfc-editor.org/info/rfc8265>.

12.2. Informative References

[RFC2342]  Gahrns, M. and C. Newman, "IMAP4 Namespace", RFC 2342,
           DOI 10.17487/RFC2342, May 1998,
           <https://www.rfc-editor.org/info/rfc2342>.

[RFC4314]  Melnikov, A., "IMAP4 Access Control List (ACL) Extension",
           RFC 4314, DOI 10.17487/RFC4314, December 2005,
           <https://www.rfc-editor.org/info/rfc4314>.

[RFC5530]  Gulbrandsen, A., "IMAP Response Codes", RFC 5530,
           DOI 10.17487/RFC5530, May 2009,
           <https://www.rfc-editor.org/info/rfc5530>.

[RFC5738]  Resnick, P. and C. Newman, "IMAP Support for UTF-8",
           RFC 5738, DOI 10.17487/RFC5738, March 2010,
           <https://www.rfc-editor.org/info/rfc5738>.

[RFC6855]  Resnick, P., Ed., Newman, C., Ed., and S. Shen, Ed., "IMAP
           Support for UTF-8", RFC 6855, DOI 10.17487/RFC6855, March
           2013, <https://www.rfc-editor.org/info/rfc6855>.

[RFC6857]  Fujiwara, K., "Post-Delivery Message Downgrading for
           Internationalized Email Messages", RFC 6857,
           DOI 10.17487/RFC6857, March 2013,
           <https://www.rfc-editor.org/info/rfc6857>.

[RFC6858]  Gulbrandsen, A., "Simplified POP and IMAP Downgrading for
           Internationalized Email", RFC 6858, DOI 10.17487/RFC6858,
           March 2013, <https://www.rfc-editor.org/info/rfc6858>.

[RFC7888]  Melnikov, A., Ed., "IMAP4 Non-synchronizing Literals",
           RFC 7888, DOI 10.17487/RFC7888, May 2016,
           <https://www.rfc-editor.org/info/rfc7888>.

[RFC8620]  Jenkins, N. and C. Newman, "The JSON Meta Application
           Protocol (JMAP)", RFC 8620, DOI 10.17487/RFC8620, July
           2019, <https://www.rfc-editor.org/info/rfc8620>.

[RFC9051]  Melnikov, A., Ed. and B. Leiba, Ed., "Internet Message
           Access Protocol (IMAP) - Version 4rev2", RFC 9051,
           DOI 10.17487/RFC9051, August 2021,
           <https://www.rfc-editor.org/info/rfc9051>.

Appendix A. Design Rationale ✨

This non-normative section talks through the reasons behind some of the design choices in this spec 🧠

The UTF8=ONLY mechanism makes it easier to diagnose interoperability problems once legacy support goes away 🔍 When backwards compatibility isn't working anyway, the non-conforming "just-send-UTF-8 IMAP" approach has the advantage that it might work with some legacy clients. But that same approach makes interoperability problems really hard to diagnose, and that's exactly why the UTF8=ONLY capability mechanism was chosen 💖

Appendix B. Changes Since RFC 6855 🎀

This non-normative section describes the changes made since [RFC6855] 🦋

B.1. APPEND UTF8 💅

okay so this bit removes APPEND's UTF8 data item 🫶 which makes the UTF8 stuff match IMAP4rev2 [RFC9051]. the whole point is that clients can support IMAP4rev1 and IMAP4rev2 with the same code ✨ no two-version headaches, bestie.

IMAP4rev2 [RFC9051] gives you roughly the same abilities as [RFC6855] but drops APPEND's UTF8 item 🦋 And here's the tea: none of [RFC6855], IMAP4rev2, or JMAP [RFC8620] say how you'd find out whether a message was stored using the UTF8 data item 💀 So right now an IMAP client can't tell, and even if IMAP4rev1 and 2 got an upgrade to share that info, it still couldn't trust it 😭

In July 2023, one of the authors found only one IMAP client that uses the UTF8 data item, and it's using it wrong 🙈 It sends the data item for every message whenever the server supports UTF8=ACCEPT, even if the message has no UTF8 in it at all. not it 💅

So the verdict: revise [RFC6855] and adopt the same syntax as IMAP4rev2 👑

B.2. FETCH BODYSTRUCTURE 🧚

[RFC6532] made a new media type, message/global 🌸 It's basically message/rfc822 except the submessage is allowed to (also) use the syntax from [RFC6532]. Then [RFC3501] and [RFC9051] define a FETCH item that returns the MIME structure of a message, which servers usually work out once and then store 🍓

Here's the thing: none of the RFCs warn implementers that IMAP4rev1 and IMAP4rev2 are slightly different 😬 So storing BODYSTRUCTURE the way servers and clients usually do can easily cause problems. bestie, be careful 💀

This document makes the syntax optional 💖 which makes it way simpler for server authors to implement this extension correctly. The catch is clients have to parse and handle both varieties, but honestly they need to do that anyway if they want to support both IMAP4rev1 and IMAP4rev2 ✨

Acknowledgments 🎀

This document is an almost unchanged copy of [RFC6855], which was written by Pete Resnick, Chris Newman, and Sean Shen 🫶 Sean has since changed jobs, and the current authors don't have a new email address for him. We can't be sure he'd approve of the changes in this document, so we didn't list him as an author 🥺 but we gratefully acknowledge his work on [RFC6855]. Jiankang Yao replaces him 🦋

The next paragraph is a straight copy of the acknowledgments in [RFC6855] 📜

|  The authors wish to thank the participants of the EAI working
|  group for their contributions to this document, with particular
|  thanks to Harald Alvestrand, David Black, Randall Gellens, Arnt
|  Gulbrandsen, Kari Hurtta, John Klensin, Xiaodong Lee, Charles
|  Lindsey, Alexey Melnikov, Subramanian Moonesamy, Shawn Steele,
|  Daniel Taharlev, and Joseph Yee for their specific contributions
|  to the discussion.

Many of them also reread the document during this revision 💜

Authors' Addresses 🌈

Pete Resnick
Episteme Technology Consulting LLC
503 West Indiana Avenue
Urbana, IL 61801-4941
United States of America
Email: resnick@episteme.net

Jiankang Yao
CNNIC
No.4 South 4th Zhongguancun Street
Beijing
100190
China
Email: yaojk@cnnic.cn

Arnt Gulbrandsen
ICANN
6 Rond Point Schumann, Bd. 1
1040 Brussels
Belgium
Email: arnt@gulbrandsen.priv.no

📦 where this page comes from

ietf: rfc9755 2025-03
💖 girlified by claude-haiku-5-5 on 2026-10-19: a language model's rewrite of the original, under its terms