Update to Internet Message Format to Allow Group Syntax in the "From:" and "Sender:" Header Fields
updates
- rfc-5322 — Internet Message Format
Extracted elements (18)
Although the updated syntax allows named groups with non-empty address lists, the document recommends against general use and classifies group syntax in originator fields as 'Limited Use' per RFC 2026. The concern is that many email procedures and software assume 'From:' and 'Sender:' addresses are replyable and suitable for filtering, and groups can disrupt these uses.
Group syntax was previously forbidden in 'From:' and 'Sender:' because those fields required usable reply addresses. The change is motivated by two new use cases: automated systems that cannot handle replies (needing an empty group to signal no-reply), and internationalized email addresses that older clients cannot reply to but can still display using the group label.
A review of existing email clients found that all reviewed programs properly display messages with group syntax in 'From:', though some may generate an error when attempting to reply. No other interoperability problems were discovered, making the change safe for deployment.
Some RFC 5322-conformant implementations may not be prepared to handle group syntax in 'From:' and 'Sender:' because such syntax was previously forbidden. However, address field parsers are required to understand group syntax, so misbehavior is considered unlikely in practice.
If the 'From:' field contains more than one mailbox specification (including all mailboxes in any groups), then the 'Sender:' field MUST appear in the message.
If the originator can be indicated by a single mailbox and the author and transmitter are identical, the 'Sender:' field SHOULD NOT be used; otherwise, both fields SHOULD appear.
If the 'Sender:' field uses group syntax, the group MUST NOT contain more than one mailbox.
In the absence of a 'Reply-To:' field, replies SHOULD by default be sent to the mailbox(es) specified in the 'From:' field unless otherwise specified by the person composing the reply.
The 'From:' and 'Sender:' fields SHOULD NOT use group syntax; rather, 'From:' SHOULD use only mailbox-list syntax and 'Sender:' SHOULD use only mailbox syntax. Group syntax is defined as Limited Use.
The 'From:' field SHOULD NOT contain any mailbox that does not belong to the author(s) of the message.
User agents SHOULD NOT permit the use of groups in 'From:' or 'Sender:' fields in outgoing messages, as group syntax is for limited use only when necessary.
The 'From:' field is redefined to accept either 'mailbox-list' or 'address-list' syntax: 'from = "From:" (mailbox-list / address-list) CRLF'. This allows group syntax, including empty groups, in addition to the previously required mailbox-list.
The 'Resent-From:' and 'Resent-Sender:' fields are updated in parallel with 'From:' and 'Sender:': 'resent-from = "Resent-From:" (mailbox-list / address-list) CRLF' and 'resent-sender = "Resent-Sender:" (mailbox / address) CRLF'.
The 'Sender:' field is redefined to accept either 'mailbox' or 'address' syntax: 'sender = "Sender:" (mailbox / address) CRLF'. This allows a group as the sender, but the group MUST NOT contain more than one mailbox.
IANA updated the 'Permanent Message Header Field Names' registry to add RFC 6854 as an additional reference alongside RFC 5322 for the 'From', 'Sender', 'Resent-From', and 'Resent-Sender' header fields.
Group syntax in 'From:' can be used to hide the identity of the message originator; however, a fabricated mailbox 'From:' address is equally easy to use for the same purpose, so this change does not materially worsen the security problem.
It is possible that some implementations might behave in an exploitable way when presented with group syntax in 'From:' or 'Sender:', but this risk is deemed low because attackers can already exploit such implementations by simply violating RFC 5322.
Protocols that validate the originator by matching 'From:' to a verified domain (e.g., DKIM ADSP, RFC 5617) will not be applicable to messages lacking an actual email address in 'From:'. Senders using group syntax in 'From:' should be aware this may adversely affect deliverability.