RFC 9873

Additional Email Address Extension for the Extensible Provisioning Protocol (EPP)

๐Ÿ“… published October 2025, from ietf

RFC 9873: Additional Email Address Extension for EPP ๐Ÿ’Œโœจ

Okay bestie, this one is all about giving EPP contact objects a second email address ๐Ÿฆ‹. The authors are D. Belyavskiy, J. Gould (VeriSign, Inc.) and S. Hollenbeck (Verisign Labs) ๐Ÿ’œ. It's a Standards Track document, published in October 2025 ๐ŸŒธ. It's also published as an IETF stream document under ISSN: 2070-1721. Heads up: the title block doesn't say it obsoletes or updates anything, so this one stands on its own ๐Ÿ™ˆ.

It's giving "EPP couldn't handle internationalized emails back when it was built, so let's fix that" ๐Ÿ’…. Ya girl's hitting you with the abstract below ๐Ÿ’–.

Abstract ๐ŸŒˆ

EPP never had internationalized email addresses built in, because those specs didn't exist yet when EPP got made ๐Ÿ˜ญ. So this doc adds a command-response extension that lets you attach one extra email address to an EPP contact object ๐Ÿซถ. That extra address can be an internationalized one OR a plain ASCII one. Literally both options, iconic ๐Ÿ‘‘.

Status of This Memo โœจ

This is an Internet Standards Track document ๐ŸŽ€.

It's a product of the Internet Engineering Task Force (IETF), it represents IETF community consensus, it went through public review, and the Internet Engineering Steering Group (IESG) approved it for publication ๐Ÿ’…. If you want more on Internet Standards, check Section 2 of RFC 7841 ๐Ÿ“š.

For the current status, any errata, and where to send feedback, go to https://www.rfc-editor.org/info/rfc9873 ๐Ÿ”—.

Copyright (c) 2025 IETF Trust and the persons identified as the document authors. All rights reserved ๐Ÿ’–.

This doc is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) as they stand on the publication date. Read them carefully, bestie, because they explain your rights and restrictions ๐Ÿงš. Any Code Components pulled out of this document must include Revised BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come with no warranty, per the Revised BSD License ๐Ÿ”ฅ.

Table of Contents ๐Ÿ“

1.  Introduction
  1.1.  Conventions Used in This Document
2.  Email Address Specification
3.  Additional Email Address Element
4.  Extension Considerations
  4.1.  Signaling Client and Server Support
  4.2.  Extension Behavior
    4.2.1.  Extension Negotiated
    4.2.2.  Extension Not Negotiated
5.  EPP Command Mapping
  5.1.  EPP Query Commands
    5.1.1.  EPP <check> Command
    5.1.2.  EPP <info> Command
    5.1.3.  EPP <transfer> Query Command
  5.2.  EPP Transform Commands
    5.2.1.  EPP <create> Command
    5.2.2.  EPP <delete> Command
    5.2.3.  EPP <renew> Command
    5.2.4.  EPP <transfer> Command
    5.2.5.  EPP <update> Command
6.  Formal Syntax
  6.1.  EPP Additional Email Address Extension Schema
7.  IANA Considerations
  7.1.  XML Namespace
  7.2.  EPP Extension Registry
8.  Security Considerations
9.  Privacy Considerations
10. References
  10.1.  Normative References
  10.2.  Informative References
Acknowledgments
Authors' Addresses

1. Introduction ๐Ÿฆ‹

Okay so the framework for internationalized email addresses lives in [RFC6530] ๐Ÿ“–. This doc describes an Extensible Provisioning Protocol (EPP) [RFC5730] command-response extension that lets you add a second email address to the EPP contact object mapping [RFC5733] ๐Ÿ’œ. The email address for the base contact object is described in Section 2.6 of [RFC5733] ๐ŸŽ€.

The second email address can be an ASCII-only one or an internationalized SMTPUTF8 email address [RFC6530] โœจ. Why bother? The second address can be your backup for when the primary address has delivery issues ๐Ÿซถ. It can also be an SMTPUTF8 address for contact purposes, and then the ASCII-only one covers you if SMTPUTF8 delivery breaks ๐Ÿ˜ญ.

This extension only adds a second email address to contact objects. It does NOT update or change any other EPP extension that includes an email address ๐Ÿ™…. If those other extensions want SMTPUTF8 support, their own specs will need updating ๐Ÿ’…. Also, when a contact object has two email addresses, everyone using them should know that either one may forward to the other. So a message sent to the ASCII-only address might get a reply from the SMTPUTF8 address, or the other way around ๐ŸŒˆ.

1.1. Conventions Used in This Document ๐ŸŽ€

The key words MUST, MUST NOT, REQUIRED, SHALL, SHALL NOT, SHOULD, SHOULD NOT, RECOMMENDED, NOT RECOMMENDED, MAY, and OPTIONAL in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174], but only when they appear in all capitals, as shown here ๐Ÿ’–.

XML is case sensitive ๐Ÿ™ˆ. Unless stated otherwise, XML specs and examples in this doc MUST be read in the character case they're shown in, so you can build a conforming implementation ๐Ÿ’….

In examples, "C:" marks lines sent by a protocol client and "S:" marks lines returned by a protocol server ๐Ÿงš. Indentation and whitespace in the examples are just there to show how elements relate, and they are NOT REQUIRED in the protocol โœจ.

The XML namespace prefix "addlEmail" is used for the namespace "urn:ietf:params:xml:ns:epp:addlEmail-1.0". Implementations MUST NOT depend on that prefix. Instead they MUST use a proper namespace-aware XML parser and serializer to interpret and output the XML documents ๐Ÿซถ.

2. Email Address Specification ๐Ÿ“ฎ

The EPP contact object mapping [RFC5733] normatively references [RFC5322] as the spec for email address syntax ๐Ÿ“–. That spec doesn't support internationalized email addresses ๐Ÿ˜ญ. [RFC6530] gives an overview and describes the framework for internationalized email ๐ŸŒธ. SMTPUTF8 email address syntax is in Section 3.3 of [RFC6531] ๐Ÿ’œ. [RFC6531] extends the Mailbox, Local-part, and Domain ABNF rules in [RFC5321] so the local-part can use "UTF8-non-ascii" (defined in Section 3.1 of [RFC6532]) and the domain can use U-label (defined in Section 2.3.2.1 of [RFC5890]) ๐ŸŽ€.

The validation rules in [RFC6531] MUST be followed when processing internationalized email addresses tied to this extension ๐Ÿ”ฅ.

3. Additional Email Address Element ๐Ÿ“

You set a second email address with the <addlEmail:addlEmail> element, using the command-response extensions from Section 5 ๐Ÿฆ‹. That element has one child element ๐Ÿ’…:

<addlEmail:email>: This is an element that follows the syntax in Section 2, holding a second ASCII or SMTPUTF8 address ๐Ÿ’–. An empty <addlEmail:email/> element unsets the second email address in the Update Command (Section 5.2.5), and it shows the second email is not set in the Info Response (Section 5.1.2) ๐Ÿ™ˆ. The <addlEmail:email> element can carry an OPTIONAL "primary" attribute. Use it to mark the extension email address as the primary email address for the extended contact object โœจ. The "primary" attribute MUST NOT be present if <addlEmail:email> is empty ๐Ÿšซ.

Additional email address considerations, bestie ๐ŸŒˆ:

  • The value set for the <contact:disclose><contact:email/> "flag" attribute (described in Section 2.9 of [RFC5733]) MUST also be applied to every additional email address added by a contact extension ๐Ÿ”’.
  • Any address in an extension is meant to be an additional address associated ONLY with the primary <contact:email> address. Support for any other additional email addresses MUST explicitly describe how they're associated with the existing addresses ๐Ÿงš.

4. Extension Considerations ๐Ÿ’œ

4.1. Signaling Client and Server Support ๐Ÿ“ฃ

As described in Section 2.4 of [RFC5730], the client and server can signal support for the extension with a namespace URI in the login and greeting extension services, respectively ๐Ÿซถ. The namespace URI "urn:ietf:params:xml:ns:epp:addlEmail-1.0" is used to signal support ๐ŸŽ€. The client puts the namespace URI in an <svcExtension> <extURI> element of the <login> command [RFC5730] ๐Ÿ’…. The server puts the namespace URI in an <svcExtension> <extURI> element of the greeting [RFC5730] โœจ.

4.2. Extension Behavior ๐ŸŒธ

4.2.1. Extension Negotiated ๐Ÿ‘‘

If both client and server have indicated support for SMTPUTF8 addresses during session establishment, they MUST be able to process an SMTPUTF8 address in any extended contact object during the established EPP session ๐Ÿ”ฅ. The server and client obligations, once this extension has been successfully negotiated in the EPP session, are below ๐Ÿ’–.

The server MUST satisfy the following obligations when support for this extension has been negotiated ๐Ÿงš:

  • Accept SMTPUTF8-compliant addresses for the extended contact object in the EPP session.
  • Support email address validation based on the SMTPUTF8 validation rules defined in Section 2.
  • Store email properties that support internationalized characters.
  • Return SMTPUTF8-compliant addresses for the extended contact object in EPP responses.
  • Support the SMTP extension for internationalized email described in [RFC6531] when sending or receiving email.

The client MUST satisfy the following obligations when support for this extension has been negotiated ๐ŸŽ€:

  • Provide SMTPUTF8-compliant addresses for the extended contact object in the EPP session.
  • Accept SMTPUTF8-compliant addresses for the extended contact object in EPP responses.
  • Support the SMTP extension for internationalized email described in [RFC6531] when sending or receiving email.

4.2.2. Extension Not Negotiated ๐Ÿ™…

An extended contact object MUST NOT be provided or returned by either an EPP client or an EPP server when support for this extension has not been successfully negotiated at the start of an EPP session ๐Ÿšซ.

5. EPP Command Mapping ๐Ÿฆ‹

The detailed EPP syntax and semantics live in the EPP core protocol spec [RFC5730] ๐Ÿ“–. This section defines how to provision an alternate email address ๐Ÿ’….

5.1. EPP Query Commands ๐Ÿ”

EPP gives you three commands to retrieve object information ๐Ÿ’–: <check> to figure out if an object can be provisioned, <info> to get information about an object, and <transfer> to get object-transfer status information ๐ŸŒธ.

5.1.1. EPP <check> Command โœ…

This extension does NOT add any elements to the EPP <check> command or the <check> response described in [RFC5730] ๐Ÿ™….

Part 1 of 4. More parts are coming, so stay tuned, bestie ๐Ÿ’œ๐Ÿซถ

5.1.2. EPP <info> Command

This extension does not add any elements to the EPP <info> command response described in [RFC5730]. Nothing new gets bolted onto the <info> command itself, bestie ๐Ÿ’…

If the query is successful, the server replies with an <addlEmail:addlEmail> element (Section 3) along with the regular EPP <resData>. So the <resData> stays the same and the extra stuff rides along in <extension> ๐ŸŽ€

S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
S:  <response>
S:    <result code="1000">
S:      <msg>Command completed successfully</msg>
S:    </result>
S:    <resData>
S:      <contact:infData
S:       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
S:        <contact:id>sh8013</contact:id>
S:        <contact:roid>SH8013-REP</contact:roid>
S:        <contact:status s="linked"/>
S:        <contact:status s="clientDeleteProhibited"/>
S:        <contact:postalInfo type="int">
S:          <contact:name>John Doe</contact:name>
S:          <contact:org>Example Inc.</contact:org>
S:          <contact:addr>
S:            <contact:street>123 Example Dr.</contact:street>
S:            <contact:street>Suite 100</contact:street>
S:            <contact:city>Dulles</contact:city>
S:            <contact:sp>VA</contact:sp>
S:            <contact:pc>20166-6503</contact:pc>
S:            <contact:cc>US</contact:cc>
S:          </contact:addr>
S:        </contact:postalInfo>
S:        <contact:voice x="1234">+1.7035555555</contact:voice>
S:        <contact:fax>+1.7035555556</contact:fax>
S:        <contact:email>jdoe@example.com</contact:email>
S:        <contact:clID>ClientY</contact:clID>
S:        <contact:crID>ClientX</contact:crID>
S:        <contact:crDate>1999-04-03T22:00:00.0Z</contact:crDate>
S:        <contact:upID>ClientX</contact:upID>
S:        <contact:upDate>1999-12-03T09:00:00.0Z</contact:upDate>
S:        <contact:trDate>2000-04-08T09:00:00.0Z</contact:trDate>
S:        <contact:authInfo>
S:          <contact:pw>2fooBAR</contact:pw>
S:        </contact:authInfo>
S:        <contact:disclose flag="0">
S:          <contact:voice/>
S:          <contact:email/>
S:        </contact:disclose>
S:      </contact:infData>
S:    </resData>
S:    <extension>
S:      <addlEmail:addlEmail
S:       xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
S:        <addlEmail:email/>
S:      </addlEmail:addlEmail>
S:    </extension>
S:    <trID>
S:      <clTRID>ABC-12345</clTRID>
S:      <svTRID>54322-XYZ</svTRID>
S:    </trID>
S:  </response>
S:</epp>

Figure 1: Example <info> Contact Response Using the <addlEmail:addlEmail> Extension with No Alternate Email Address

S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
S:  <response>
S:    <result code="1000">
S:      <msg>Command completed successfully</msg>
S:    </result>
S:    <resData>
S:      <contact:infData
S:       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
S:        <contact:id>sh8013</contact:id>
S:        <contact:roid>SH8013-REP</contact:roid>
S:        <contact:status s="linked"/>
S:        <contact:status s="clientDeleteProhibited"/>
S:        <contact:postalInfo type="int">
S:          <contact:name>John Doe</contact:name>
S:          <contact:org>Example Inc.</contact:org>
S:          <contact:addr>
S:            <contact:street>123 Example Dr.</contact:street>
S:            <contact:street>Suite 100</contact:street>
S:            <contact:city>Dulles</contact:city>
S:            <contact:sp>VA</contact:sp>
S:            <contact:pc>20166-6503</contact:pc>
S:            <contact:cc>US</contact:cc>
S:          </contact:addr>
S:        </contact:postalInfo>
S:        <contact:voice x="1234">+1.7035555555</contact:voice>
S:        <contact:fax>+1.7035555556</contact:fax>
S:        <contact:email>jdoe@example.com</contact:email>
S:        <contact:clID>ClientY</contact:clID>
S:        <contact:crID>ClientX</contact:crID>
S:        <contact:crDate>1999-04-03T22:00:00.0Z</contact:crDate>
S:        <contact:upID>ClientX</contact:upID>
S:        <contact:upDate>1999-12-03T09:00:00.0Z</contact:upDate>
S:        <contact:trDate>2000-04-08T09:00:00.0Z</contact:trDate>
S:        <contact:authInfo>
S:          <contact:pw>2fooBAR</contact:pw>
S:        </contact:authInfo>
S:        <contact:disclose flag="0">
S:          <contact:voice/>
S:          <contact:email/>
S:        </contact:disclose>
S:      </contact:infData>
S:    </resData>
S:    <extension>
S:      <addlEmail:addlEmail
S:       xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
S:        <addlEmail:email>jdoe-alt@example.net</addlEmail:email>
S:      </addlEmail:addlEmail>
S:    </extension>
S:    <trID>
S:      <clTRID>ABC-12345</clTRID>
S:      <svTRID>54322-XYZ</svTRID>
S:    </trID>
S:  </response>
S:</epp>

Figure 2: Example <info> Contact Response Using the <addlEmail:addlEmail> Extension with an Alternate ASCII Email Address

S:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
S:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
S:  <response>
S:    <result code="1000">
S:      <msg>Command completed successfully</msg>
S:    </result>
S:    <resData>
S:      <contact:infData
S:       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
S:        <contact:id>sh8013</contact:id>
S:        <contact:roid>SH8013-REP</contact:roid>
S:        <contact:status s="linked"/>
S:        <contact:status s="clientDeleteProhibited"/>
S:        <contact:postalInfo type="int">
S:          <contact:name>John Doe</contact:name>
S:          <contact:org>Example Inc.</contact:org>
S:          <contact:addr>
S:            <contact:street>123 Example Dr.</contact:street>
S:            <contact:street>Suite 100</contact:street>
S:            <contact:city>Dulles</contact:city>
S:            <contact:sp>VA</contact:sp>
S:            <contact:pc>20166-6503</contact:pc>
S:            <contact:cc>US</contact:cc>
S:          </contact:addr>
S:        </contact:postalInfo>
S:        <contact:voice x="1234">+1.7035555555</contact:voice>
S:        <contact:fax>+1.7035555556</contact:fax>
S:        <contact:email>jdoe@example.com</contact:email>
S:        <contact:clID>ClientY</contact:clID>
S:        <contact:crID>ClientX</contact:crID>
S:        <contact:crDate>1999-04-03T22:00:00.0Z</contact:crDate>
S:        <contact:upID>ClientX</contact:upID>
S:        <contact:upDate>1999-12-03T09:00:00.0Z</contact:upDate>
S:        <contact:trDate>2000-04-08T09:00:00.0Z</contact:trDate>
S:        <contact:authInfo>
S:          <contact:pw>2fooBAR</contact:pw>
S:        </contact:authInfo>
S:        <contact:disclose flag="0">
S:          <contact:voice/>
S:          <contact:email/>
S:        </contact:disclose>
S:      </contact:infData>
S:    </resData>
S:    <extension>
S:      <addlEmail:addlEmail
S:       xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
S:        <addlEmail:email
            primary="true">้บฅๅ…‹้ขจ@example.com</addlEmail:email>
S:      </addlEmail:addlEmail>
S:    </extension>
S:    <trID>
S:      <clTRID>ABC-12345</clTRID>
S:      <svTRID>54322-XYZ</svTRID>
S:    </trID>
S:  </response>
S:</epp>

Figure 3: Example <info> Contact Response Using the <addlEmail:addlEmail> Extension with an SMTPUTF8 Primary Email Address

5.1.3. EPP <transfer> Query Command

This extension does not add any elements to the EPP <transfer> query command or <transfer> query response described in [RFC5730]. The transfer query side is untouched, no new drama ๐Ÿฆ‹

5.2. EPP Transform Commands

EPP provides five commands to transform objects: <create> to create an instance of an object, <delete> to delete an instance of an object, <renew> to extend the validity period of an object, <transfer> to manage object sponsorship changes, and <update> to change information associated with an object. So that's five transform commands total: <create>, <delete>, <renew>, <transfer>, and <update> ๐ŸŒธโœจ

5.2.1. EPP <create> Command โœจ

okay so this extension adds some extra bits to the EPP <create> command from [RFC5733] ๐ŸŽ€

the <create> command is the transform op that lets a client make a brand new object ๐Ÿงš on top of the usual [RFC5733] elements, the command MUST contain a child <addlEmail:addlEmail> element (Section 3) so the client can set an alternate email address. no skipping it, bestie ๐Ÿ’…

Figure 4: Example <create> Command to Create a Contact Object with an Alternate ASCII Email Address

C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
C:  <command>
C:    <create>
C:      <contact:create
C:       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
C:        <contact:id>sh8013</contact:id>
C:        <contact:postalInfo type="int">
C:          <contact:name>John Doe</contact:name>
C:          <contact:org>Example Inc.</contact:org>
C:          <contact:addr>
C:            <contact:street>123 Example Dr.</contact:street>
C:            <contact:street>Suite 100</contact:street>
C:            <contact:city>Dulles</contact:city>
C:            <contact:sp>VA</contact:sp>
C:            <contact:pc>20166-6503</contact:pc>
C:            <contact:cc>US</contact:cc>
C:          </contact:addr>
C:        </contact:postalInfo>
C:        <contact:voice x="1234">+1.7035555555</contact:voice>
C:        <contact:fax>+1.7035555556</contact:fax>
C:        <contact:email>jdoe@example.com</contact:email>
C:        <contact:authInfo>
C:          <contact:pw>2fooBAR</contact:pw>
C:        </contact:authInfo>
C:        <contact:disclose flag="0">
C:          <contact:voice/>
C:          <contact:email/>
C:        </contact:disclose>
C:      </contact:create>
C:    </create>
C:    <extension>
C:      <addlEmail:addlEmail
C:       xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
C:        <addlEmail:email>jdoe-alt@example.net</addlEmail:email>
C:      </addlEmail:addlEmail>
C:    </extension>
C:    <clTRID>ABC-12345</clTRID>
C:  </command>
C:</epp>

Figure 5: Example <create> Command to Create a Contact Object with a Primary SMTPUTF8 Email Address

C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
C:  <command>
C:    <create>
C:      <contact:create
C:       xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
C:        <contact:id>sh8013</contact:id>
C:        <contact:postalInfo type="int">
C:          <contact:name>John Doe</contact:name>
C:          <contact:org>Example Inc.</contact:org>
C:          <contact:addr>
C:            <contact:street>123 Example Dr.</contact:street>
C:            <contact:street>Suite 100</contact:street>
C:            <contact:city>Dulles</contact:city>
C:            <contact:sp>VA</contact:sp>
C:            <contact:pc>20166-6503</contact:pc>
C:            <contact:cc>US</contact:cc>
C:          </contact:addr>
C:        </contact:postalInfo>
C:        <contact:voice x="1234">+1.7035555555</contact:voice>
C:        <contact:fax>+1.7035555556</contact:fax>
C:        <contact:email>jdoe@example.com</contact:email>
C:        <contact:authInfo>
C:          <contact:pw>2fooBAR</contact:pw>
C:        </contact:authInfo>
C:        <contact:disclose flag="0">
C:          <contact:voice/>
C:          <contact:email/>
C:        </contact:disclose>
C:      </contact:create>
C:    </create>
C:    <extension>
C:      <addlEmail:addlEmail
C:       xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
C:        <addlEmail:email
            primary="true">้บฅๅ…‹้ขจ@example.com</addlEmail:email>
C:      </addlEmail:addlEmail>
C:    </extension>
C:    <clTRID>ABC-12345</clTRID>
C:  </command>
C:</epp>

This extension does not add any elements to the EPP <create> response described in [RFC5730]. nothing new in the response, just vibes ๐ŸŒธ

5.2.2. EPP <delete> Command ๐Ÿซถ

This extension does not add any elements to the EPP <delete> command or <delete> response described in [RFC5730]. nothing to see here, it's giving chill ๐Ÿ˜ด

5.2.3. EPP <renew> Command ๐Ÿฆ‹

This extension does not add any elements to the EPP <renew> command or <renew> response described in [RFC5730]. still nothing new, periodt ๐Ÿ’…

5.2.4. EPP <transfer> Command ๐ŸŒˆ

This extension does not add any elements to the EPP <transfer> command or <transfer> response described in [RFC5730]. no notes, no changes, we move ๐Ÿงš

5.2.5. EPP <update> Command ๐Ÿ”ฅ

okay this extension adds some extra elements to the EPP <update> command from [RFC5733] ๐Ÿ’–

the <update> command is the transform op that lets a client update an object that already exists. on top of the usual [RFC5733] elements, the command MUST contain a child <addlEmail:addlEmail> element (Section 3) so the client can set or unset an alternate email address. if the alternate email address can't be applied to the object, the server MUST return an EPP error result code of 2201 โœจ that one is serious, so don't ignore it ๐Ÿ™ˆ

Figure 6: Example <update> Command to Set a Contact Object with an Alternate ASCII Email Address

C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
C: <command>
C:   <update>
C:     <contact:update
C:      xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
C:       <contact:id>sh8013</contact:id>
C:     </contact:update>
C:   </update>
C:   <extension>
C:     <addlEmail:addlEmail
C:      xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
C:       <addlEmail:email>jdoe-alt@example.net</addlEmail:email>
C:     </addlEmail:addlEmail>
C:   </extension>
C:   <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>

Figure 7: Example <update> Command to Set a Contact Object with an Alternate SMTPUTF8 Email Address

C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
C: <command>
C:   <update>
C:     <contact:update
C:      xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
C:       <contact:id>sh8013</contact:id>
C:     </contact:update>
C:   </update>
C:   <extension>
C:     <addlEmail:addlEmail
C:      xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
C:       <addlEmail:email>้บฅๅ…‹้ขจ@example.com</addlEmail:email>
C:     </addlEmail:addlEmail>
C:   </extension>
C:   <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>

Figure 8: Example <update> Command to Unset a Contact Object Alternate Email Address

C:<?xml version="1.0" encoding="UTF-8" standalone="no"?>
C:<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
C: <command>
C:   <update>
C:     <contact:update
C:      xmlns:contact="urn:ietf:params:xml:ns:contact-1.0">
C:       <contact:id>sh8013</contact:id>
C:     </contact:update>
C:   </update>
C:   <extension>
C:     <addlEmail:addlEmail
C:      xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0">
C:       <addlEmail:email/>
C:     </addlEmail:addlEmail>
C:   </extension>
C:   <clTRID>ABC-12345</clTRID>
C: </command>
C:</epp>

This extension does not add any elements to the EPP <update> response described in [RFC5730]. ok that's the whole update story ๐Ÿ’…

6. Formal Syntax ๐Ÿ“œ

The EPP Additional Email Address Extension schema is presented here.

The formal syntax shown here is a complete XML Schema [W3C.REC-xmlschema-1-20041028] [W3C.REC-xmlschema-2-20041028] representation of the object mapping suitable for automated validation of EPP XML instances. The <CODE BEGINS> and <CODE ENDS> tags are not part of the XML Schema; they are used to note the beginning and ending of the XML Schema for URI registration purposes. these are the bones of the whole thing ๐Ÿฆดโœจ

6.1. EPP Additional Email Address Extension Schema ๐ŸŽ€

<CODE BEGINS>
<?xml version="1.0" encoding="UTF-8"?>
<schema xmlns="http://www.w3.org/2001/XMLSchema"
  xmlns:addlEmail="urn:ietf:params:xml:ns:epp:addlEmail-1.0"
  targetNamespace="urn:ietf:params:xml:ns:epp:addlEmail-1.0"
  elementFormDefault="qualified">
  <annotation>
    <documentation>Extensible Provisioning Protocol v1.0
       additional email address schema.</documentation>
  </annotation>
  <!-- Create, Update, and Info Response extension element -->
  <element name="addlEmail" type="addlEmail:addlEmailType" />
  <!--
    Single email element that can be empty
   -->
   <complexType name="addlEmailType">
     <sequence>
       <element name="email" type="addlEmail:emailType"/>
     </sequence>
   </complexType>
   <complexType name="emailType">
     <simpleContent>
       <extension base="token">
       <attribute name="primary" type="boolean" default="false"/>
      </extension>
    </simpleContent>
  </complexType>
  <!--
 End of schema.
 -->
</schema>
<CODE ENDS>

7. IANA Considerations ๐ŸŒธ

7.1. XML Namespace ๐Ÿ’œ

This document uses URNs to describe XML namespaces and XML schemas conforming to a registry mechanism described in [RFC3688]. The following URI assignments have been made by IANA:

Registration for the addlEmail namespace:

URI:  urn:ietf:params:xml:ns:epp:addlEmail-1.0
Registrant Contact:  IESG
XML:  None.  Namespace URIs do not represent an XML specification.

Registration for the addlEmail XML Schema:

URI:  urn:ietf:params:xml:schema:epp:addlEmail-1.0
Registrant Contact:  IESG
XML:  See Section 6 of this document.

7.2. EPP Extension Registry ๐Ÿงš

The EPP extension described in this document have been registered by IANA in the "Extensions for the Extensible Provisioning Protocol (EPP)" registry described in [RFC7451]. The details of the registration are as follows:

Name of Extension:  Additional Email Address Extension for the
   Extensible Provisioning Protocol (EPP)
Document Status:  Standards Track
Reference:  RFC 9873
Registrant Name and Email Address:  IESG, <iesg@ietf.org>
TLDs:  Any
IPR Disclosure:  None
Status:  Active
Notes:  None

8. Security Considerations ๐Ÿ”

okay bestie, this section is SERIOUS but I'm still going to explain it in a way that makes sense ๐Ÿ’…. As noted in Sections 10.1 and 13 of [RFC6530], unconstrained Unicode in email addresses can introduce a class of security threats that do not exist with ASCII-only email addresses. ๐Ÿ˜ญ Like, ASCII-only addresses don't have these problems, but wild Unicode can totally cause chaos ๐Ÿ’€. EPP lives in ecosystems where the email addresses passed in EPP get displayed in the Registration Data Access Protocol (RDAP) and other services, and businesses copy and paste these addresses all the time when they transfer domains via EPP ๐Ÿ“‹. So there SHOULD be safeguards against these threats ๐Ÿ›ก๏ธ. Therefore, use of the SMTPUTF8 email addresses as described in this document SHOULD be done with policies that disallow the use of unconstrained Unicode ๐Ÿšซ. The domain-part of these SMTPUTF8 email addresses SHOULD conform to IDNA2008 [RFC5895] ๐ŸŒ. The local-part of these SMTPUTF8 email addresses SHOULD be restricted to Unicode that does not introduce the threats noted in [RFC6530] โœจ. One possible solution would be to disallow characters outside of Unicode Annex 31 [Unicode-UAX31] ๐ŸŽ€.

As an email address is often a primary end user contact, an invalid email address may put communication with the end user at risk when such contact is necessary ๐Ÿ“จ. In case of an invalid domain name in the email address, a malicious actor can register a valid domain name with a similar U-label (homograph attack) and take control over the domain name associated with the contact using social engineering techniques ๐Ÿ˜ˆ๐Ÿšจ. To reduce the risk of invalid domain names in email addresses, registries SHOULD validate the domain name syntax in provided email addresses and validate whether the domain name consists of the code points listed in the "IDNA Rules and Derived Property Values" registry <https://www.iana.org/assignments/idna-tables>). ๐Ÿงพ

Note that the syntax for internationalized email local-parts is very liberal ๐Ÿ™ƒ. Domains are normalized during MX lookup, while local-parts are unconstrained ๐Ÿคฏ. Implementers may wish to test that their database is able to store difficult local-parts such as U+0061 U+0300 U+00E0 ๐Ÿงช. For more on normalization and these three code points, see [RFC5198], Section 3 ๐Ÿ“š.

9. Privacy Considerations ๐Ÿซฃ

The content of <addlEmail:email> elements can be processed by EPP clients and servers in the same way that <contact:email> elements are processed, including publication in directory services such as RDAP [STD95] ๐Ÿ‘€. Many data protection regulations recognize email addresses as personal data, so any policies governing the collection, transmission, and processing of contact information by EPP clients and servers should apply equally to <addlEmail:email> elements ๐Ÿ”’๐Ÿ’–.

10. References ๐Ÿ“šโœจ

10.1. Normative References ๐Ÿ’œ

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <https://www.rfc-editor.org/info/rfc2119>.

[RFC3688]  Mealling, M., "The IETF XML Registry", BCP 81, RFC 3688,
           DOI 10.17487/RFC3688, January 2004,
           <https://www.rfc-editor.org/info/rfc3688>.

[RFC5321]  Klensin, J., "Simple Mail Transfer Protocol", RFC 5321,
           DOI 10.17487/RFC5321, October 2008,
           <https://www.rfc-editor.org/info/rfc5321>.

[RFC5322]  Resnick, P., Ed., "Internet Message Format", RFC 5322,
           DOI 10.17487/RFC5322, October 2008,
           <https://www.rfc-editor.org/info/rfc5322>.

[RFC5730]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)",
           STD 69, RFC 5730, DOI 10.17487/RFC5730, August 2009,
           <https://www.rfc-editor.org/info/rfc5730>.

[RFC5733]  Hollenbeck, S., "Extensible Provisioning Protocol (EPP)
           Contact Mapping", STD 69, RFC 5733, DOI 10.17487/RFC5733,
           August 2009, <https://www.rfc-editor.org/info/rfc5733>.

[RFC5890]  Klensin, J., "Internationalized Domain Names for
           Applications (IDNA): Definitions and Document Framework",
           RFC 5890, DOI 10.17487/RFC5890, August 2010,
           <https://www.rfc-editor.org/info/rfc5890>.

[RFC6530]  Klensin, J. and Y. Ko, "Overview and Framework for
           Internationalized Email", RFC 6530, DOI 10.17487/RFC6530,
           February 2012, <https://www.rfc-editor.org/info/rfc6530>.

[RFC6531]  Yao, J. and W. Mao, "SMTP Extension for Internationalized
           Email", RFC 6531, DOI 10.17487/RFC6531, February 2012,
           <https://www.rfc-editor.org/info/rfc6531>.

[RFC6532]  Yang, A., Steele, S., and N. Freed, "Internationalized
           Email Headers", RFC 6532, DOI 10.17487/RFC6532, February
           2012, <https://www.rfc-editor.org/info/rfc6532>.

[RFC8174]  Leiba, B., "Ambiguity of Uppercase vs Lowercase in RFC
           2119 Key Words", BCP 14, RFC 8174, DOI 10.17487/RFC8174,
           May 2017, <https://www.rfc-editor.org/info/rfc8174>.

[W3C.REC-xmlschema-1-20041028]
           Beech, D., Ed., Thompson, H., Ed., Maloney, M., Ed., and
           N. Mendelsohn, Ed., "XML Schema Part 1: Structures Second
           Edition", W3C Recommendation, 28 October 2004,
           <https://www.w3.org/TR/2004/REC-xmlschema-1-20041028/>.

[W3C.REC-xmlschema-2-20041028]
           Malhotra, A., Ed. and P. V. Biron, Ed., "XML Schema Part
           2: Datatypes Second Edition", W3C Recommendation, 28
           October 2004,
           <https://www.w3.org/TR/2004/REC-xmlschema-2-20041028>.

10.2. Informative References ๐ŸŒธ

[RFC5198]  Klensin, J. and M. Padlipsky, "Unicode Format for Network
           Interchange", RFC 5198, DOI 10.17487/RFC5198, March 2008,
           <https://www.rfc-editor.org/info/rfc5198>.

[RFC5895]  Resnick, P. and P. Hoffman, "Mapping Characters for
           Internationalized Domain Names in Applications (IDNA)
           2008", RFC 5895, DOI 10.17487/RFC5895, September 2010,
           <https://www.rfc-editor.org/info/rfc5895>.

[RFC7451]  Hollenbeck, S., "Extension Registry for the Extensible
           Provisioning Protocol", RFC 7451, DOI 10.17487/RFC7451,
           February 2015, <https://www.rfc-editor.org/info/rfc7451>.

[STD95]    Internet Standard 95,
           <https://www.rfc-editor.org/info/std95>.
           At the time of writing, this STD comprises the following:

           Newton, A., Ellacott, B., and N. Kong, "HTTP Usage in the
           Registration Data Access Protocol (RDAP)", STD 95,
           RFC 7480, DOI 10.17487/RFC7480, March 2015,
           <https://www.rfc-editor.org/info/rfc7480>.

           Hollenbeck, S. and N. Kong, "Security Services for the
           Registration Data Access Protocol (RDAP)", STD 95,
           RFC 7481, DOI 10.17487/RFC7481, March 2015,
           <https://www.rfc-editor.org/info/rfc7481>.

           Hollenbeck, S. and A. Newton, "Registration Data Access
           Protocol (RDAP) Query Format", STD 95, RFC 9082,
           DOI 10.17487/RFC9082, June 2021,
           <https://www.rfc-editor.org/info/rfc9082>.

           Hollenbeck, S. and A. Newton, "JSON Responses for the
           Registration Data Access Protocol (RDAP)", STD 95,
           RFC 9083, DOI 10.17487/RFC9083, June 2021,
           <https://www.rfc-editor.org/info/rfc9083>.

           Blanchet, M., "Finding the Authoritative Registration Data
           Access Protocol (RDAP) Service", STD 95, RFC 9224,
           DOI 10.17487/RFC9224, March 2022,
           <https://www.rfc-editor.org/info/rfc9224>.

[Unicode-UAX31]
           Davis, M., Ed. and R. Leroy, Ed., "Unicode Identifiers and
           Syntax", Version 16.0.0, Unicode Standard Annex #31,
           September 2024,
           <https://www.unicode.org/reports/tr31/tr31-41.html>.
           Latest version available at
           <https://www.unicode.org/reports/tr31/>.

Acknowledgments ๐Ÿซถ

The authors would like to thank Alexander Mayrhofer, Chris Lonvick, Gustavo Lozano, Jody Kolker, John C. Klensin, John Levine, Klaus Malorny, Marc Blanchet, Marco Schrieck, Mario Loffredo, Murray S. Kucherawy, Patrick Mevzek, Pete Resnick, Takahiro Nemoto, Taras Heichenko, Arnt Gulbrandsen, Thomas Corte, Gavin Brown, and Andrew Newton for their careful review and valuable comments ๐ŸŒˆ๐Ÿ’•.

Authors' Addresses ๐Ÿฆ‹

Dmitry Belyavskiy
Karpatska 241/3
62500 Brno
Czech Republic
Phone: +420 603 261 036
Email: beldmit@gmail.com


James Gould
VeriSign, Inc.
12061 Bluemont Way
Reston, VA 20190
United States of America
Email: jgould@verisign.com
URI:   https://www.verisign.com


Scott Hollenbeck
Verisign Labs
12061 Bluemont Way
Reston, VA 20190
United States of America
Email: shollenbeck@verisign.com
URI:   https://www.verisignlabs.com/
๐Ÿ“ฆ where this page comes from