Email Authentication Status Codes
updates
- rfc-7208 — Sender Policy Framework (SPF) for Authorizing Use of Domains in Email, Version 1
Extracted elements (14)
RFC 6376 Section 6.1 discourages special treatment of messages bearing no valid DKIM signature. This document acknowledges that some operators disregard this advice and require valid Author Domain Signatures, and provides status codes for improved interoperability with such operators without endorsing their configuration.
The codes are introduced to serve mailing list software and other agents that need to distinguish authentication failures from other rejection reasons (e.g., invalid recipient). A single SMTP exchange can return only one enhanced status code, so the multiple-failure code X.7.26 exists to convey that more than one mechanism failed without requiring enumeration.
This document updates RFC 7208 (SPF): the new enhanced status codes X.7.23 and X.7.24 replace the codes previously recommended in Sections 8.4, 8.6, and 8.7 of RFC 7208 for SPF failure and error conditions.
Any future message authentication or policy enforcement technologies SHOULD register their own enhanced status codes to enable specific reporting available to operators that wish to use them.
If a receiving server performs multiple authentication checks and more than one fails, warranting rejection, the SMTP server SHOULD use the code that indicates multiple methods failed (X.7.26) rather than only reporting the first one that failed.
Status code X.7.20 indicates that a message did not contain any passing DKIM signatures. Associated basic status code is 550.
Status code X.7.21 indicates that a message contains one or more passing DKIM signatures, but none are acceptable per local policy requirements. Associated basic status code is 550.
Status code X.7.22 indicates that a message contains passing DKIM signatures but none match the author address(es) in the From header field (no valid author-matched DKIM signature). This is a special case of X.7.21; associated basic status code is 550.
Status code X.7.23 indicates that a message completed an SPF check that produced a 'fail' result, contrary to local policy. Used in place of 5.7.1 as described in Section 8.4 of RFC 7208; associated basic status code is 550.
Status code X.7.24 indicates that evaluation of SPF relative to an arriving message resulted in an error. Used in place of 4.4.3 or 5.5.2 as described in Sections 8.6 and 8.7 of RFC 7208; associated basic status codes are 451/550.
Status code X.7.25 indicates that an SMTP client's IP address failed a reverse DNS validation check, contrary to local policy. Associated basic status code is 550.
Status code X.7.26 indicates that a message failed more than one message authentication check, contrary to local policy. The particular mechanisms that failed are not specified; associated basic status code is 550.
This document registers six new enhanced status codes (X.7.20 through X.7.26, excluding X.7.25 as a separate entry) in the Enumerated Status Codes sub-registry of the SMTP Enhanced Status Codes Registry established by RFC 5248.
Use of these authentication failure status codes reveals local policy with respect to email authentication, which can be exploited by actors attempting to deliver undesired mail. Operators who wish to conceal this aspect of local policy may continue using generic codes such as 5.7.7, 5.7.1, or 5.7.0.