Email Authentication for Internationalized Mail
Sender Policy Framework (SPF) (RFC 7208), DomainKeys Identified Mail (DKIM) (RFC 6376), and Domain-based Message Authentication, Reporting, and Conformance (DMARC) (RFC 7489) enable a domain owner to publish email authentication and policy information in the DNS. In internationalized email, domain names can occur both as U-labels and A-labels. This specification updates the SPF, DKIM, and DMARC specifications to clarify which form of internationalized domain names to use in those specifications.
What it is
How SPF, DKIM and DMARC behave when domains and local parts are internationalised.
What it solves
Authentication was specified for ASCII domains. Comparison and alignment need defining once a domain can be written in another script.
What it means to operate
Alignment compares A-labels, so normalise before you compare. Getting this wrong means an internationalised domain that authenticates correctly is reported as failing.
Header analyser decodes encoded header fields back to readable text. Open header analyser
Normative requirements
Every sentence in this RFC carrying an RFC 2119 keyword, with the section it came from.
4 SPF and Internationalized Mail
- MUSTSince the EHLO command precedes the server response that tells whether the server supports the SMTPUTF8 extension, an IDN host name MUST be represented as A-labels.
- MUSTAll U-labels MUST be converted to A-labels before being used for an SPF validation.
- MUSTSection 4.3 of [RFC7208] states that all IDNs in an SPF DNS record MUST be A-labels; this rule is unchanged since any SPF record can be used to authorize either EAI or conventional mail.
5 DKIM and Internationalized Mail
- MUSTSection 3.5 of [RFC6376] states that IDNs in the d=, i=, and s= tags of a DKIM-Signature header field MUST be encoded as A-labels.
- SHOULDThis rule is relaxed only for internationalized message header fields [RFC6532], so IDNs SHOULD be represented as U-labels.
- MUSTWhen computing or verifying the hash in a DKIM signature as described in Section 3.7 of [RFC6376], the hash MUST use the domain name in the format it occurs in the header field.