ietf-corpus

rfc-7372

Email Authentication Status Codes

M. Kucherawy
date2014-09 streamIETF areaart wgappsawg statusPROPOSED STANDARD pages8 canonicalhttps://www.rfc-editor.org/rfc/rfc7372 doi10.17487/RFC7372
This document registers code points to allow status codes to be returned to an email client to indicate that a message is being rejected or deferred specifically because of email authentication failures. This document updates RFC 7208, since some of the code points registered replace the ones recommended for use in that document.

updates

Extracted elements (14)

design-rationale §4

RFC 6376 Section 6.1 discourages special treatment of messages bearing no valid DKIM signature. This document acknowledges that some operators disregard this advice and require valid Author Domain Signatures, and provides status codes for improved interoperability with such operators without endorsing their configuration.

email

design-rationale §4

The codes are introduced to serve mailing list software and other agents that need to distinguish authentication failures from other rejection reasons (e.g., invalid recipient). A single SMTP exchange can return only one enhanced status code, so the multiple-failure code X.7.26 exists to convey that more than one mechanism failed without requiring enumeration.

email

interoperability-note §3.2

This document updates RFC 7208 (SPF): the new enhanced status codes X.7.23 and X.7.24 replace the codes previously recommended in Sections 8.4, 8.6, and 8.7 of RFC 7208 for SPF failure and error conditions.

email

normative-requirement §4 SHOULD

Any future message authentication or policy enforcement technologies SHOULD register their own enhanced status codes to enable specific reporting available to operators that wish to use them.

email, registry

normative-requirement §4 SHOULD

If a receiving server performs multiple authentication checks and more than one fails, warranting rejection, the SMTP server SHOULD use the code that indicates multiple methods failed (X.7.26) rather than only reporting the first one that failed.

email, security

protocol-element §3.1

Status code X.7.20 indicates that a message did not contain any passing DKIM signatures. Associated basic status code is 550.

email, security

protocol-element §3.1

Status code X.7.21 indicates that a message contains one or more passing DKIM signatures, but none are acceptable per local policy requirements. Associated basic status code is 550.

email, security

protocol-element §3.1

Status code X.7.22 indicates that a message contains passing DKIM signatures but none match the author address(es) in the From header field (no valid author-matched DKIM signature). This is a special case of X.7.21; associated basic status code is 550.

email, security

protocol-element §3.2

Status code X.7.23 indicates that a message completed an SPF check that produced a 'fail' result, contrary to local policy. Used in place of 5.7.1 as described in Section 8.4 of RFC 7208; associated basic status code is 550.

email, security

protocol-element §3.2

Status code X.7.24 indicates that evaluation of SPF relative to an arriving message resulted in an error. Used in place of 4.4.3 or 5.5.2 as described in Sections 8.6 and 8.7 of RFC 7208; associated basic status codes are 451/550.

email, security

protocol-element §3.3

Status code X.7.25 indicates that an SMTP client's IP address failed a reverse DNS validation check, contrary to local policy. Associated basic status code is 550.

email, dns, security

protocol-element §3.4

Status code X.7.26 indicates that a message failed more than one message authentication check, contrary to local policy. The particular mechanisms that failed are not specified; associated basic status code is 550.

email, security

registry §6

This document registers six new enhanced status codes (X.7.20 through X.7.26, excluding X.7.25 as a separate entry) in the Enumerated Status Codes sub-registry of the SMTP Enhanced Status Codes Registry established by RFC 5248.

email, registry

security-consideration §5

Use of these authentication failure status codes reveals local policy with respect to email authentication, which can be exploited by actors attempting to deliver undesired mail. Operators who wish to conceal this aspect of local policy may continue using generic codes such as 5.7.7, 5.7.1, or 5.7.0.

email, security