Email Authentication for Internationalized Mail
Sender Policy Framework (SPF) (RFC 7208), DomainKeys Identified Mail (DKIM) (RFC 6376), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 7489) enable a domain owner to publish email authentication and policy information in the DNS. In internationalized email, domain names can occur both as U-labels and A-labels. This specification updates the SPF, DKIM, and DMARC specifications to clarify which form of internationalized domain names to use in those specifications.
Normative requirements
Every sentence in this RFC carrying an RFC 2119 keyword, with the section it came from. 5 must, 1 should, 0 may.
4 SPF and Internationalized Mail
- MUSTSince the EHLO command precedes the server response that tells whether the server supports the SMTPUTF8 extension, an IDN host name MUST be represented as A-labels.
- MUSTAll U-labels MUST be converted to A-labels before being used for an SPF validation.
- MUSTSection 4.3 of [RFC7208] states that all IDNs in an SPF DNS record MUST be A-labels; this rule is unchanged since any SPF record can be used to authorize either EAI or conventional mail.
5 DKIM and Internationalized Mail
- MUSTSection 3.5 of [RFC6376] states that IDNs in the d=, i=, and s= tags of a DKIM-Signature header field MUST be encoded as A-labels.
- SHOULDThis rule is relaxed only for internationalized message header fields [RFC6532], so IDNs SHOULD be represented as U-labels.
- MUSTWhen computing or verifying the hash in a DKIM signature as described in Section 3.7 of [RFC6376], the hash MUST use the domain name in the format it occurs in the header field.