1
2
3
4
5
6
7Internet Engineering Task Force (IETF) K. Fujiwara
8Request for Comments: 6857 JPRS
9Category: Standards Track March 2013
10ISSN: 2070-1721
11
12
13 Post-Delivery Message Downgrading for Internationalized Email Messages
14
15Abstract
16
17 The Email Address Internationalization (SMTPUTF8) extension to SMTP
18 allows Unicode characters encoded in UTF-8 and outside the ASCII
19 repertoire in mail header fields. Upgraded POP and IMAP servers
20 support internationalized messages. If a POP or IMAP client does not
21 support Email Address Internationalization, a POP or IMAP server
22 cannot deliver internationalized messages to the client and cannot
23 remove the message. To avoid that situation, this document describes
24 a mechanism for converting internationalized messages into the
25 traditional message format. As part of the conversion process,
26 message elements that require internationalized treatment are recoded
27 or removed, and receivers are able to recognize that they received
28 messages containing such elements, even if they cannot process the
29 internationalized elements.
30
31Status of This Memo
32
33 This is an Internet Standards Track document.
34
35 This document is a product of the Internet Engineering Task Force
36 (IETF). It represents the consensus of the IETF community. It has
37 received public review and has been approved for publication by the
38 Internet Engineering Steering Group (IESG). Further information on
39 Internet Standards is available in Section 2 of RFC 5741.
40
41 Information about the current status of this document, any errata,
42 and how to provide feedback on it may be obtained at
43 http://www.rfc-editor.org/info/rfc6857.
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58Fujiwara Standards Track [Page 1]
59
60RFC 6857 POP or IMAP Downgrade March 2013
61
62
63Copyright Notice
64
65 Copyright (c) 2013 IETF Trust and the persons identified as the
66 document authors. All rights reserved.
67
68 This document is subject to BCP 78 and the IETF Trust's Legal
69 Provisions Relating to IETF Documents
70 (http://trustee.ietf.org/license-info) in effect on the date of
71 publication of this document. Please review these documents
72 carefully, as they describe your rights and restrictions with respect
73 to this document. Code Components extracted from this document must
74 include Simplified BSD License text as described in Section 4.e of
75 the Trust Legal Provisions and are provided without warranty as
76 described in the Simplified BSD License.
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114Fujiwara Standards Track [Page 2]
115
116RFC 6857 POP or IMAP Downgrade March 2013
117
118
119Table of Contents
120
121 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . . 4
122 1.1. Problem Statement . . . . . . . . . . . . . . . . . . . . 4
123 1.2. Possible Solutions . . . . . . . . . . . . . . . . . . . . 4
124 1.3. Approach Taken in This Specification . . . . . . . . . . . 5
125 2. Terminology . . . . . . . . . . . . . . . . . . . . . . . . . 6
126 3. Email Message Header Field Downgrading . . . . . . . . . . . . 7
127 3.1. Downgrading Method for Each ABNF Element . . . . . . . . . 7
128 3.1.1. Unstructured Downgrading . . . . . . . . . . . . . . . 7
129 3.1.2. Word Downgrading . . . . . . . . . . . . . . . . . . . 7
130 3.1.3. Comment Downgrading . . . . . . . . . . . . . . . . . 7
131 3.1.4. MIME-Value Downgrading . . . . . . . . . . . . . . . . 7
132 3.1.5. Display-Name Downgrading . . . . . . . . . . . . . . . 7
133 3.1.6. Domain Downgrading . . . . . . . . . . . . . . . . . . 8
134 3.1.7. Group Downgrading . . . . . . . . . . . . . . . . . . 8
135 3.1.8. Mailbox Downgrading . . . . . . . . . . . . . . . . . 8
136 3.1.9. Type-Addr Downgrading . . . . . . . . . . . . . . . . 9
137 3.1.10. Encapsulation: A Last Resort . . . . . . . . . . . . . 9
138 3.2. Downgrading Method for Each Header Field . . . . . . . . . 10
139 3.2.1. Address Header Fields That Contain <address>
140 Elements . . . . . . . . . . . . . . . . . . . . . . . 10
141 3.2.2. Non-ASCII Strings in <comment> Elements . . . . . . . 11
142 3.2.3. Message-ID Header Fields . . . . . . . . . . . . . . . 11
143 3.2.4. Received Header Field . . . . . . . . . . . . . . . . 11
144 3.2.5. MIME Content Header Fields . . . . . . . . . . . . . . 12
145 3.2.6. Non-ASCII Characters in <unstructured> Elements . . . 12
146 3.2.7. Non-ASCII Characters in <phrase> Elements . . . . . . 12
147 3.2.8. Other Header Fields . . . . . . . . . . . . . . . . . 12
148 4. MIME Body Parts and Delivery Status Notifications . . . . . . 12
149 4.1. MIME Body Part Header Field Downgrading . . . . . . . . . 13
150 4.2. Delivery Status Notification Downgrading . . . . . . . . . 13
151 5. Security Considerations . . . . . . . . . . . . . . . . . . . 13
152 6. Implementation Note: Encoded-Word Encoding . . . . . . . . . . 14
153 7. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 15
154 7.1. Obsolescence of Existing Downgraded-* Header Fields . . . 15
155 7.2. Registration of New Downgraded-* Header Fields . . . . . . 15
156 8. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 16
157 9. References . . . . . . . . . . . . . . . . . . . . . . . . . . 16
158 9.1. Normative References . . . . . . . . . . . . . . . . . . . 16
159 9.2. Informative References . . . . . . . . . . . . . . . . . . 18
160 Appendix A. Downgrading Example . . . . . . . . . . . . . . . . . 19
161
162
163
164
165
166
167
168
169
170Fujiwara Standards Track [Page 3]
171
172RFC 6857 POP or IMAP Downgrade March 2013
173
174
1751. Introduction
176
1771.1. Problem Statement
178
179 Traditional (legacy) mail systems, which are defined by the Internet
180 Message Format [RFC5322] and other specifications, allow only ASCII
181 characters in mail header field values. The SMTPUTF8 extension
182 [RFC6530] [RFC6531] [RFC6532] allows Unicode characters encoded in
183 UTF-8 [RFC3629] in these mail header fields. "Raw non-ASCII strings"
184 refers to strings of those characters in which at least one of them
185 is not part of the ASCII repertoire.
186
187 If a header field contains non-ASCII strings, a POP or IMAP server
188 cannot deliver internationalized messages to legacy clients that do
189 not send UTF8 commands or have UTF8 capability. Also, because they
190 have no obvious or standardized way to explain what is going on to
191 clients, a POP or IMAP server cannot even safely discard the message.
192
1931.2. Possible Solutions
194
195 There are four plausible approaches to the problem. The preferred
196 approach depends on the particular circumstances and relationship
197 among the delivery SMTP server, the mail store, the POP or IMAP
198 server, and the users and their Mail User Agent (MUA) clients. The
199 four approaches are as follows:
200
201 1. If the delivery Mail Transport Agent (MTA) has sufficient
202 knowledge about the POP or IMAP server and the clients being
203 used, the message may be rejected as undeliverable.
204
205 2. A new, surrogate, message may be created by downgrading the
206 original one in the POP or IMAP server in a way that preserves
207 maximum information at the expense of some complexity and that
208 does not create security or operational problems in the mail
209 system. These surrogate messages are referred to as "downgraded"
210 in this specification and as "surrogate messages" elsewhere.
211
212 3. Some intermediate downgrading may be applied that balances
213 additional information loss against lower complexity and greater
214 ease of implementation.
215
216 4. The POP or IMAP server may fabricate a message that is intended
217 to notify the client that an internationalized message is waiting
218 but cannot be delivered until an upgraded client is available.
219
220
221
222
223
224
225
226Fujiwara Standards Track [Page 4]
227
228RFC 6857 POP or IMAP Downgrade March 2013
229
230
2311.3. Approach Taken in This Specification
232
233 This specification describes the second of these options. It is
234 worth noting that, at least in the general case, none of these
235 options preserves sufficient information to guarantee that it is
236 possible to reply to an incoming message without loss of information,
237 so the choice may be considered one of the available "least bad"
238 options. While this document specifies a well-designed mechanism, it
239 is only an interim solution while clients are being upgraded
240 [RFC6855] [RFC6856].
241
242 This message downgrading mechanism converts mail header fields to an
243 all-ASCII representation. The POP or IMAP server can use the
244 downgrading mechanism and then deliver the internationalized message
245 in a traditional form, which allows receivers to know whether a
246 message is internationalized or unknown or broken.
247
248 The Internationalized Mail Header specification [RFC6532] allows
249 UTF-8 characters (see Section 2) to be used in mail header fields and
250 MIME header fields. The Internationalized Mail Transport
251 specification [RFC6531] allows UTF-8 characters to be used in some
252 trace header fields. The message downgrading mechanism specified
253 here describes the method by which internationalized messages
254 [RFC6530] [RFC6532] are converted to traditional email messages
255 [RFC5322].
256
257 This document provides a precise definition of the minimum-
258 information-loss message downgrading process.
259
260 Downgrading consists of the following two parts:
261
262 o Email header field downgrading
263
264 o MIME header field downgrading
265
266 Email header field downgrading is described in Section 3. It
267 generates ASCII-only header fields.
268
269 Header fields starting with Downgraded- are introduced in
270 Section 3.1.10. They preserve the information that appeared in the
271 original header fields.
272
273 The definition of MIME header fields in internationalized messages is
274 described in RFC 6532. A delivery status notification may contain
275 non-ASCII addresses. MIME header field downgrading is described in
276 Section 4.1. Delivery status notification downgrading is described
277 in Section 4.2. It generates ASCII-only MIME header fields.
278
279
280
281
282Fujiwara Standards Track [Page 5]
283
284RFC 6857 POP or IMAP Downgrade March 2013
285
286
287 Displaying downgraded messages that originally contained
288 internationalized header fields is out of scope of this document. A
289 POP or IMAP client that does not support UTF8 extensions as defined
290 for POP3 "UTF8 command" and IMAP "ENABLE UTF8=ACCEPT command" does
291 not recognize the internationalized message format [RFC6532].
292
2932. Terminology
294
295 The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
296 "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
297 document are to be interpreted as described in RFC 2119 [RFC2119].
298
299 Many of the specialized terms used in this specification are defined
300 in other documents. They include "Overview and Framework for
301 Internationalized Email" [RFC6530], the Internet Message Format
302 specification [RFC5322], and some of the basic MIME documents
303 [RFC2045] [RFC2183]. This specification makes extensive use of the
304 MIME Message Header Extensions [RFC2047] and extended MIME parameter
305 encodings [RFC2231]. For convenience, both are described as
306 "encoded-words" or "encoded-word encoding". All of the encoded-words
307 generated according to this specification use UTF-8 as their charset.
308
309 The terms "U-label", "A-label", and "IDNA" are used as defined in the
310 IDNA Definitions document [RFC5890]. The terms "ASCII address",
311 "non-ASCII address", "SMTPUTF8", "message", and "internationalized
312 message" are used as defined RFC 6530. The term "non-ASCII string"
313 is used with the definition provided in the Internationalized Email
314 Headers document [RFC6532]. The term "UTF-8 character" is used
315 informally in this document to denote a Unicode character, encoded in
316 UTF-8, outside the ASCII repertoire. Such characters are more
317 formally described using the ABNF element <UTF8-non-ascii>, defined
318 in RFC 6532.
319
320 This document refers to the Augmented Backus-Naur Form (ABNF)
321 [RFC5234] elements that appear in RFC 5322 and RFC 2045. RFC 5322
322 describes the ABNF elements <CFWS>, <comment>, <display-name>,
323 <group>, <id-left>, <id-right>, <mailbox>, <quoted-string>,
324 <unstructured>, and <word>. RFC 2045 describes the ABNF element
325 <value>. Section 3.3 of the Internationalized Mail Transport
326 specification [RFC6531] and Section 3.2 of the Internationalized
327 Email Headers document [RFC6532] updated <domain> to allow non-ASCII
328 characters.
329
330 Some additional terms are defined locally in-line below.
331
332
333
334
335
336
337
338Fujiwara Standards Track [Page 6]
339
340RFC 6857 POP or IMAP Downgrade March 2013
341
342
3433. Email Message Header Field Downgrading
344
345 This section defines the method for converting each header field that
346 may contain non-ASCII strings into ASCII. Section 3.1 describes the
347 methods for rewriting each ABNF element. Section 3.2 describes the
348 methods for rewriting each header field.
349
3503.1. Downgrading Method for Each ABNF Element
351
352 Header field downgrading is defined below for each ABNF element.
353 Conversion of the header field terminates when no characters other
354 than those in the ASCII repertoire remain in the header field.
355
3563.1.1. Unstructured Downgrading
357
358 If the header field has an <unstructured> field that contains
359 non-ASCII strings, apply encoded-word encoding.
360
3613.1.2. Word Downgrading
362
363 If the header field has any <word> fields that contain non-ASCII
364 strings, apply encoded-word encoding.
365
3663.1.3. Comment Downgrading
367
368 If the header field has any <comment> fields that contain non-ASCII
369 strings, apply encoded-word encoding.
370
3713.1.4. MIME-Value Downgrading
372
373 If the header field has any <value> elements [RFC2045] that contain
374 non-ASCII strings, remove any <CFWS> that appear outside DQUOTE
375 [RFC5234] that appear in those elements, then encode the <value>
376 elements as extended MIME parameter encodings [RFC2231] and leave the
377 language information empty.
378
3793.1.5. Display-Name Downgrading
380
381 If the header field has any <address> (<mailbox> or <group>)
382 elements, and they have <display-name> elements that contain
383 non-ASCII strings, encode the <display-name> elements as encoded-
384 words. Display-Name downgrading uses the same algorithm as Word
385 downgrading.
386
387
388
389
390
391
392
393
394Fujiwara Standards Track [Page 7]
395
396RFC 6857 POP or IMAP Downgrade March 2013
397
398
3993.1.6. Domain Downgrading
400
401 If the header field has any <domain> elements that contain U-labels,
402 rewrite the non-ASCII domain name into an ASCII domain name using
403 A-labels [RFC5891].
404
4053.1.7. Group Downgrading
406
407 <group> is defined in Section 3.4 of the Internet Message Format
408 specification [RFC5322]. The <group> element may contain <mailbox>
409 elements that contain non-ASCII addresses.
410
411 If a <group> element contains <mailbox> elements and one of those
412 <mailbox> elements contains a non-ASCII <local-part>, rewrite the
413 <group> element as
414
415 display-name " " ENCODED_WORD " :;"
416
417 where the <ENCODED_WORD> is the original <group-list> encoded as
418 encoded-words.
419
420 Otherwise, the <group> element contains an ASCII-only <local-part>.
421 If the <group> element contains non-ASCII <mailbox> elements, they
422 contain non-ASCII domain names. Rewrite the non-ASCII domain names
423 into ASCII domain names using A-labels [RFC5891]. Generated
424 <mailbox> elements contain ASCII addresses only.
425
4263.1.8. Mailbox Downgrading
427
428 If the <local-part> of the <mailbox> element contains no characters
429 other than those in the ASCII repertoire, the <domain> element may
430 contain non-ASCII characters. Rewrite the non-ASCII domain names
431 into ASCII domain names using A-labels [RFC5891].
432
433 Otherwise, the <local-part> may contain non-ASCII characters. The
434 <local-part> that contains characters outside the ASCII repertoire
435 has no equivalent format for ASCII addresses. The <addr-spec>
436 element that contains non-ASCII strings may appear in two forms as:
437
438 "<" addr-spec ">"
439
440 or
441
442 addr-spec
443
444 Rewrite both as:
445
446 ENCODED-WORD " :;"
447
448
449
450Fujiwara Standards Track [Page 8]
451
452RFC 6857 POP or IMAP Downgrade March 2013
453
454
455 where the <ENCODED-WORD> is the original <addr-spec> encoded as
456 encoded-words.
457
4583.1.9. Type-Addr Downgrading
459
460 If the header field contains <utf-8-type-addr> and the
461 <utf-8-type-addr> contains raw non-ASCII strings (<UTF8-non-ascii>),
462 it is in utf-8-address form [RFC6533]. Convert it to
463 utf-8-addr-xtext form [RFC6533]. Comment downgrading is also
464 performed in this case. If the address type is unrecognized and the
465 header field contains non-ASCII strings, then fall back to using
466 Encapsulation on the entire header field as specified in
467 Section 3.1.10.
468
4693.1.10. Encapsulation: A Last Resort
470
471 As a last resort, when header fields cannot be converted as discussed
472 in the previous subsection, the fields are deleted and replaced by
473 specialized new header fields. Those fields are defined to preserve,
474 in encoded form, as much information as possible from the header
475 field values of the incoming message. This mechanism is known as
476 Encapsulation downgrading in this specification because it preserves
477 the original information in a different form. The syntax of these
478 new header fields is:
479
480 fields =/ downgraded
481
482 downgraded = "Downgraded-Message-Id:" unstructured CRLF /
483 "Downgraded-Resent-Message-Id:" unstructured CRLF /
484 "Downgraded-In-Reply-To:" unstructured CRLF /
485 "Downgraded-References:" unstructured CRLF /
486 "Downgraded-Original-Recipient:" unstructured CRLF /
487 "Downgraded-Final-Recipient:" unstructured CRLF
488
489 Applying this procedure to the "Received:" header field is
490 prohibited. Encapsulation downgrading is allowed for "Message-ID:",
491 "In-Reply-To:", "References:", "Original-Recipient:", and
492 "Final-Recipient:" header fields.
493
494 To preserve a header field in a Downgraded- header field:
495
496 1. Generate a new header field.
497
498 * The field name is a concatenation of Downgraded- and the
499 original field name.
500
501 * The initial new field value is the original header field
502 value.
503
504
505
506Fujiwara Standards Track [Page 9]
507
508RFC 6857 POP or IMAP Downgrade March 2013
509
510
511 2. Treat the initial new header field value as if it were
512 unstructured, and then apply the encoded-word encoding as
513 necessary so that the resulting new header field value is
514 completely in ASCII.
515
516 3. Remove the original header field.
517
5183.2. Downgrading Method for Each Header Field
519
520 The Mail and MIME Header Fields document [RFC4021] establishes a
521 registry of header fields. This section describes the downgrading
522 method for each header field listed in that registry as of the date
523 of publication of this specification.
524
525 If the entire mail header field contains no characters other than
526 those in the ASCII repertoire, email header field downgrading is not
527 required. Each header field's downgrading method is described below.
528
5293.2.1. Address Header Fields That Contain <address> Elements
530
531 From:
532 Sender:
533 To:
534 Cc:
535 Bcc:
536 Reply-To:
537 Resent-From:
538 Resent-Sender:
539 Resent-To:
540 Resent-Cc:
541 Resent-Bcc:
542 Resent-Reply-To:
543 Return-Path:
544 Disposition-Notification-To:
545
546 If the header field contains non-ASCII characters, first perform
547 Comment downgrading and Display-Name downgrading as described in the
548 corresponding subsections of Section 3.1. If the header field still
549 contains non-ASCII characters, complete the following two steps:
550
551 1. If the header field contains <group> elements that contain
552 non-ASCII addresses, perform Group downgrading on those elements.
553
554 2. If the header field contains <mailbox> elements that contain
555 non-ASCII addresses, perform Mailbox downgrading on those
556 elements.
557
558
559
560
561
562Fujiwara Standards Track [Page 10]
563
564RFC 6857 POP or IMAP Downgrade March 2013
565
566
567 This procedure may generate empty <group> elements in the "From:" and
568 "Sender:" header fields. The Group Syntax document [RFC6854] updates
569 the Internet Message Format specification [RFC5322] to allow (empty)
570 <group> elements in the "From:" and "Sender:" header fields.
571
5723.2.2. Non-ASCII Strings in <comment> Elements
573
574 Date:
575 Resent-Date:
576 MIME-Version:
577 Content-ID:
578 Content-Transfer-Encoding:
579 Content-Language:
580 Accept-Language:
581 Auto-Submitted:
582
583 Except in comments, these header fields do not contain characters
584 other than those in the ASCII repertoire. If the header field
585 contains UTF-8 characters in comments, perform Comment downgrading.
586
5873.2.3. Message-ID Header Fields
588
589 Message-ID:
590 Resent-Message-ID:
591 In-Reply-To:
592 References:
593
594 If there are non-ASCII strings in <id-left> or <id-right> elements,
595 perform Encapsulation. Otherwise, the header field contains UTF-8
596 characters in comments and Comment downgrading should be performed.
597
5983.2.4. Received Header Field
599
600 Received:
601
602 If <domain> elements or <mailbox> elements contain U-labels, perform
603 Domain downgrading as specified in Section 3.1.6. Comments may
604 contain non-ASCII strings; if so, perform Comment downgrading.
605
606 After the Domain downgrading and the Comment downgrading, if the
607 "FOR" clause contains a non-ASCII <local-part>, remove the FOR
608 clause. If the "ID" clause contains a non-ASCII value, remove the ID
609 clause.
610
611
612
613
614
615
616
617
618Fujiwara Standards Track [Page 11]
619
620RFC 6857 POP or IMAP Downgrade March 2013
621
622
6233.2.5. MIME Content Header Fields
624
625 Content-Type:
626 Content-Disposition:
627
628 If there are non-ASCII strings in <value> or <CFWS> elements, perform
629 MIME-Value and Comment downgrading.
630
6313.2.6. Non-ASCII Characters in <unstructured> Elements
632
633 Subject:
634 Comments:
635 Content-Description:
636
637 If non-ASCII strings are present in <unstructured> elements, perform
638 Unstructured downgrading.
639
6403.2.7. Non-ASCII Characters in <phrase> Elements
641
642 Keywords:
643
644 If non-ASCII strings are present in <phrase> elements, perform Word
645 downgrading.
646
6473.2.8. Other Header Fields
648
649 Other header fields that are not covered in this document (such as
650 implementation-specific or user-defined fields) might also contain
651 non-ASCII strings. Any header field that does not have a conversion
652 method defined above will be in this category and treated as follows.
653
654 If there are non-ASCII strings present in the header fields, perform
655 Unstructured downgrading.
656
657 If the software understands the header field's structure and a
658 downgrading algorithm other than Unstructured is applicable, that
659 software SHOULD use that algorithm; Unstructured downgrading is used
660 when there is no other option.
661
662 Mailing list header fields (those that start in "List-") are part of
663 this category.
664
6654. MIME Body Parts and Delivery Status Notifications
666
667 Both the MIME body part header fields [RFC2045] [RFC6532] and the
668 contents of a delivery status notification [RFC6533] may contain
669 non-ASCII characters.
670
671
672
673
674Fujiwara Standards Track [Page 12]
675
676RFC 6857 POP or IMAP Downgrade March 2013
677
678
6794.1. MIME Body Part Header Field Downgrading
680
681 RFC 6532 specifies an extension that permits MIME header fields,
682 including body part header fields, to contain non-ASCII strings.
683 This section defines the conversion method to ASCII-only header
684 fields for each MIME header field that contains non-ASCII strings.
685 Parse the message body's MIME structure at all levels and check each
686 MIME header field to see whether it contains non-ASCII strings. If
687 the header field contains non-ASCII strings in the header field
688 value, the header field is a target of the MIME body part header
689 field's downgrading. The downgrading methods used for the MIME body
690 part header fields Content-ID, Content-Type, Content-Disposition, and
691 Content-Description are the same as those used for the header fields
692 of the same name described in Section 3.2
693
6944.2. Delivery Status Notification Downgrading
695
696 If the message contains a delivery status notification (see Section 6
697 of the SMTP DSN Extension [RFC3461]), perform the following tests and
698 conversions.
699
700 If there are "Original-Recipient:" and "Final-Recipient:" header
701 fields, and the header fields contain non-ASCII strings, perform
702 Type-Addr downgrading.
703
7045. Security Considerations
705
706 The purpose of post-delivery message downgrading is to allow POP and
707 IMAP servers to deliver internationalized messages to traditional POP
708 and IMAP clients and to permit the clients to display those messages.
709 Users that receive such messages can know that they were
710 internationalized. It does not permit receivers to read the messages
711 in their original form and, in general, will not permit generating
712 replies, at least without significant user intervention.
713
714 After downgrading as specified in this document, the header fields of
715 a message will contain ASCII characters only, some of them in
716 encoded-word form. Nothing in this document or other SMTPUTF8
717 specifications [RFC6530] [RFC6531] alters the basic properties of
718 MIME that allow characters outside the ASCII repertoire in encodings
719 as specified for them. Thus, this document inherits the security
720 considerations associated with MIME-encoded header fields as
721 specified in RFC 2047 [RFC2047] and with UTF-8 itself as specified in
722 RFC 3629 [RFC3629].
723
724 Rewriting header fields increases the opportunities for undetected
725 spoofing by malicious senders. However, the rewritten header field
726 values are preserved in equivalent MIME form or in newly defined
727
728
729
730Fujiwara Standards Track [Page 13]
731
732RFC 6857 POP or IMAP Downgrade March 2013
733
734
735 header fields for which traditional MUAs have no special processing
736 procedures.
737
738 The techniques described here may invalidate methods that depend on
739 digital signatures over any part of the message, which includes the
740 top-level header fields and body part header fields. Depending on
741 the specific message being downgraded, at least the following
742 techniques are likely to break: DomainKeys Identified Mail (DKIM) and
743 possibly S/MIME and Pretty Good Privacy (PGP). The downgrade
744 mechanism SHOULD NOT remove signatures even if the signatures will
745 fail validation after downgrading. As much of the information as
746 possible from the original message SHOULD be preserved. In addition,
747 MUAs may be able to use the presence of an Authentication-Results
748 header field [RFC5451] to assess whether the digital signatures were
749 valid before the header fields were downgraded.
750
751 While information in any email header field should usually be treated
752 with some suspicion, current email systems commonly employ various
753 mechanisms and protocols to make the information more trustworthy.
754 Information in the new Downgraded-* header fields is not inspected by
755 traditional MUAs and may be even less trustworthy than the
756 traditional header fields. Note that the Downgraded-* header fields
757 could have been inserted with malicious intent (and with content
758 unrelated to the traditional header fields); however, traditional
759 MUAs do not evaluate Downgraded-* header fields.
760
761 See the Security Considerations sections in the Group Syntax document
762 [RFC6854] and the Internationalized Email Framework [RFC6530] for
763 more discussion.
764
7656. Implementation Note: Encoded-Word Encoding
766
767 While the specification of encoded-words includes specific rules for
768 dealing with whitespace in adjacent encoded words [RFC2047], there
769 are a number of deployed implementations that fail to implement the
770 algorithm correctly. As a result, whitespace behavior is somewhat
771 unpredictable, in practice, when multiple encoded words are used.
772
773 While RFC 5322 states that implementations SHOULD limit lines to 78
774 characters or less, implementations MAY choose to allow overly long
775 encoded words to work around faulty implementations of encoded-words.
776 Implementations that choose to do so SHOULD have an optional
777 mechanism to limit line length to 78 characters.
778
779
780
781
782
783
784
785
786Fujiwara Standards Track [Page 14]
787
788RFC 6857 POP or IMAP Downgrade March 2013
789
790
7917. IANA Considerations
792
793 The experimental specification from which this document was partially
794 derived [RFC5504] specifies that no new header fields beginning with
795 Downgraded- are to be registered. That restriction is now lifted,
796 and this document makes a new set of registrations, replacing the
797 experimental fields with standard ones.
798
7997.1. Obsolescence of Existing Downgraded-* Header Fields
800
801 The Downgraded-* header fields that were registered as experimental
802 fields in RFC 5504 are no longer in use. IANA has changed the status
803 from "experimental" to "obsoleted" for every name in the "Permanent
804 Message Header Field Names" registry that began with Downgraded-.
805
8067.2. Registration of New Downgraded-* Header Fields
807
808 The following header fields have been registered in the "Permanent
809 Message Header Field Names" registry, in accordance with the
810 procedures set out in the Header Field Registration document
811 [RFC3864].
812
813 Header field name: Downgraded-Message-Id
814 Applicable protocol: mail
815 Status: standard
816 Author/change controller: IETF
817 Specification document(s): This document (Section 3.1.10)
818
819 Header field name: Downgraded-In-Reply-To
820 Applicable protocol: mail
821 Status: standard
822 Author/change controller: IETF
823 Specification document(s): This document (Section 3.1.10)
824
825 Header field name: Downgraded-References
826 Applicable protocol: mail
827 Status: standard
828 Author/change controller: IETF
829 Specification document(s): This document (Section 3.1.10)
830
831 Header field name: Downgraded-Original-Recipient
832 Applicable protocol: mail
833 Status: standard
834 Author/change controller: IETF
835 Specification document(s): This document (Section 3.1.10)
836
837
838
839
840
841
842Fujiwara Standards Track [Page 15]
843
844RFC 6857 POP or IMAP Downgrade March 2013
845
846
847 Header field name: Downgraded-Final-Recipient
848 Applicable protocol: mail
849 Status: standard
850 Author/change controller: IETF
851 Specification document(s): This document (Section 3.1.10)
852
8538. Acknowledgements
854
855 This document draws heavily from the experimental in-transit message
856 downgrading procedure described RFC 5504. The contributions of the
857 coauthor of that earlier document, Y. Yoneya, are gratefully
858 acknowledged. Significant comments and suggestions were received
859 from John Klensin, Barry Leiba, Randall Gellens, Pete Resnick, Martin
860 J. Durst, and other WG participants.
861
8629. References
863
8649.1. Normative References
865
866 [RFC2045] Freed, N. and N. Borenstein, "Multipurpose Internet Mail
867 Extensions (MIME) Part One: Format of Internet Message
868 Bodies", RFC 2045, November 1996.
869
870 [RFC2047] Moore, K., "MIME (Multipurpose Internet Mail Extensions)
871 Part Three: Message Header Extensions for Non-ASCII Text",
872 RFC 2047, November 1996.
873
874 [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
875 Requirement Levels", BCP 14, RFC 2119, March 1997.
876
877 [RFC2183] Troost, R., Dorner, S., and K. Moore, "Communicating
878 Presentation Information in Internet Messages: The
879 Content-Disposition Header Field", RFC 2183, August 1997.
880
881 [RFC2231] Freed, N. and K. Moore, "MIME Parameter Value and Encoded
882 Word Extensions:
883 Character Sets, Languages, and Continuations", RFC 2231,
884 November 1997.
885
886 [RFC3461] Moore, K., "Simple Mail Transfer Protocol (SMTP) Service
887 Extension for Delivery Status Notifications (DSNs)",
888 RFC 3461, January 2003.
889
890 [RFC3629] Yergeau, F., "UTF-8, a transformation format of ISO
891 10646", STD 63, RFC 3629, November 2003.
892
893
894
895
896
897
898Fujiwara Standards Track [Page 16]
899
900RFC 6857 POP or IMAP Downgrade March 2013
901
902
903 [RFC3864] Klyne, G., Nottingham, M., and J. Mogul, "Registration
904 Procedures for Message Header Fields", BCP 90, RFC 3864,
905 September 2004.
906
907 [RFC4021] Klyne, G. and J. Palme, "Registration of Mail and MIME
908 Header Fields", RFC 4021, March 2005.
909
910 [RFC5322] Resnick, P., Ed., "Internet Message Format", RFC 5322,
911 October 2008.
912
913 [RFC5890] Klensin, J., "Internationalized Domain Names for
914 Applications (IDNA): Definitions and Document Framework",
915 RFC 5890, August 2010.
916
917 [RFC5891] Klensin, J., "Internationalized Domain Names in
918 Applications (IDNA): Protocol", RFC 5891, August 2010.
919
920 [RFC6530] Klensin, J. and Y. Ko, "Overview and Framework for
921 Internationalized Email", RFC 6530, February 2012.
922
923 [RFC6531] Yao, J. and W. Mao, "SMTP Extension for Internationalized
924 Email", RFC 6531, February 2012.
925
926 [RFC6532] Yang, A., Steele, S., and N. Freed, "Internationalized
927 Email Headers", RFC 6532, February 2012.
928
929 [RFC6533] Hansen, T., Newman, C., and A. Melnikov,
930 "Internationalized Delivery Status and Disposition
931 Notifications", RFC 6533, February 2012.
932
933 [RFC6854] Leiba, B., "Update to Internet Message Format to Allow
934 Group Syntax in the "From:" and "Sender:" Header Fields",
935 RFC 6854, March 2013.
936
937 [RFC6855] Resnick, P., Ed., Newman, C., Ed., and S. Shen, Ed., "IMAP
938 Support for UTF-8", RFC 6855, March 2013.
939
940 [RFC6856] Gellens, R., Newman, C., Yao, J., and K. Fujiwara, "Post
941 Office Protocol Version 3 (POP3) Support for UTF-8",
942 RFC 6856, March 2013.
943
944
945
946
947
948
949
950
951
952
953
954Fujiwara Standards Track [Page 17]
955
956RFC 6857 POP or IMAP Downgrade March 2013
957
958
9599.2. Informative References
960
961 [RFC5234] Crocker, D. and P. Overell, "Augmented BNF for Syntax
962 Specifications: ABNF", STD 68, RFC 5234, January 2008.
963
964 [RFC5451] Kucherawy, M., "Message Header Field for Indicating
965 Message Authentication Status", RFC 5451, April 2009.
966
967 [RFC5504] Fujiwara, K. and Y. Yoneya, "Downgrading Mechanism for
968 Email Address Internationalization", RFC 5504, March 2009.
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
1001
1002
1003
1004
1005
1006
1007
1008
1009
1010Fujiwara Standards Track [Page 18]
1011
1012RFC 6857 POP or IMAP Downgrade March 2013
1013
1014
1015Appendix A. Downgrading Example
1016
1017 This appendix shows a message downgrading example. Consider a
1018 received mail message where:
1019
1020 o The sender address is a non-ASCII address,
1021 "NON-ASCII-LOCAL@example.com". Its display-name is
1022 "DISPLAY-LOCAL".
1023
1024 o The "To:" header field contains two non-ASCII addresses,
1025 "NON-ASCII-REMOTE1@example.net" and
1026 "NON-ASCII-REMOTE2@example.com". Their display-names are
1027 "DISPLAY-REMOTE1" and "DISPLAY-REMOTE2".
1028
1029 o The "Cc:" header field contains a non-ASCII address,
1030 "NON-ASCII-REMOTE3@example.org". Its display-name is
1031 "DISPLAY-REMOTE3".
1032
1033 o Four display-names contain non-ASCII characters.
1034
1035 o The "Subject:" header field is "NON-ASCII-SUBJECT", which contains
1036 non-ASCII strings.
1037
1038 o The "Message-Id:" header field contains "NON-ASCII-MESSAGE_ID",
1039 which contains non-ASCII strings.
1040
1041 o There is an unknown header field "X-Unknown-Header:", which
1042 contains non-ASCII strings.
1043
1044 Return-Path: <NON-ASCII-LOCAL@example.com>
1045 Received: from ... by ... for <NON-ASCII-REMOTE1@example.net>
1046 Received: from ... by ... for <NON-ASCII-REMOTE1@example.net>
1047 From: DISPLAY-LOCAL <NON-ASCII-LOCAL@example.com>
1048 To: DISPLAY-REMOTE1 <NON-ASCII-REMOTE1@example.net>,
1049 DISPLAY-REMOTE2 <NON-ASCII-REMOTE2@example.com>
1050 Cc: DISPLAY-REMOTE3 <NON-ASCII-REMOTE3@example.org>
1051 Subject: NON-ASCII-SUBJECT
1052 Date: Mon, 30 Jul 2012 01:23:45 -0000
1053 Message-Id: NON-ASCII-MESSAGE_ID
1054 Mime-Version: 1.0
1055 Content-Type: text/plain; charset="UTF-8"
1056 Content-Transfer-Encoding: 8bit
1057 X-Unknown-Header: NON-ASCII-CHARACTERS
1058
1059 MAIL_BODY
1060
1061 Figure 1: Received Message in a Maildrop
1062
1063
1064
1065
1066Fujiwara Standards Track [Page 19]
1067
1068RFC 6857 POP or IMAP Downgrade March 2013
1069
1070
1071 The downgraded message is shown in Figure 2. "Return-Path:",
1072 "From:", "To:", and "Cc:" header fields are rewritten. "Subject:"
1073 and "X-Unknown-Header:" header fields are encoded as encoded-words.
1074 The "Message-Id:" header field is encapsulated as a
1075 "Downgraded-Message-Id:" header field.
1076
1077 Return-Path: =?UTF-8?Q?NON-ASCII-LOCAL@example.com?= :;
1078 Received: from ... by ...
1079 Received: from ... by ...
1080 From: =?UTF-8?Q?DISPLAY-LOCAL?=
1081 =?UTF-8?Q?NON-ASCII-LOCAL@example.com?= :;
1082 To: =?UTF-8?Q?DISPLAY-REMOTE1?=
1083 =?UTF-8?Q?NON-ASCII-REMOTE1@example.net?= :;,
1084 =?UTF-8?Q?DISPLAY-REMOTE2?=
1085 =?UTF-8?Q?NON-ASCII-REMOTE2@example.com?= :;,
1086 Cc: =?UTF-8?Q?DISPLAY-REMOTE3?=
1087 =?UTF-8?Q?NON-ASCII-REMOTE3@example.org?= :;
1088 Subject: =?UTF-8?Q?NON-ASCII-SUBJECT?=
1089 Date: Mon, 30 Jul 2012 01:23:45 -0000
1090 Downgraded-Message-Id: =?UTF-8?Q?MESSAGE_ID?=
1091 Mime-Version: 1.0
1092 Content-Type: text/plain; charset="UTF-8"
1093 Content-Transfer-Encoding: 8bit
1094 X-Unknown-Header: =?UTF-8?Q?NON-ASCII-CHARACTERS?=
1095
1096 MAIL_BODY
1097
1098 Figure 2: Downgraded Message
1099
1100Author's Address
1101
1102 Kazunori Fujiwara
1103 Japan Registry Services Co., Ltd.
1104 Chiyoda First Bldg. East 13F, 3-8-1 Nishi-Kanda
1105 Chiyoda-ku, Tokyo 101-0065
1106 Japan
1107
1108 Phone: +81 3 5215 8451
1109 EMail: fujiwara@jprs.co.jp
1110
1111
1112
1113
1114
1115
1116
1117
1118
1119
1120
1121
1122Fujiwara Standards Track [Page 20]
1123
1124