| Network Working Group | T. Hansen, Ed. |
| Internet-Draft | AT&T Laboratories |
| Obsoletes: 3798 (if approved) | A. Melnikov, Ed. |
| Intended status: Standards Track | Isode Ltd |
| Expires: January 16, 2014 | July 15, 2013 |
Message Disposition Notification
draft-hansen-mdn-3798bis-01.txt
This memo defines a MIME content-type that may be used by a mail user agent (MUA) or electronic mail gateway to report the disposition of a message after it has been successfully delivered to a recipient. This content-type is intended to be machine-processable. Additional message header fields are also defined to permit Message Disposition Notifications (MDNs) to be requested by the sender of a message. The purpose is to extend Internet Mail to support functionality often found in other messaging systems, such as X.400 and the proprietary "LAN-based" systems, and often referred to as "read receipts," "acknowledgements", or "receipt notifications." The intention is to do this while respecting privacy concerns, which have often been expressed when such functions have been discussed in the past.
Because many messages are sent between the Internet and other messaging systems (such as X.400 or the proprietary "LAN-based" systems), the MDN protocol is designed to be useful in a multi-protocol messaging environment. To this end, the protocol described in this memo provides for the carriage of "foreign" addresses, in addition to those normally used in Internet Mail. Additional attributes may also be defined to support "tunneling" of foreign notifications through Internet Mail.
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
This Internet-Draft will expire on January 16, 2014.
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
This document may contain material from IETF Documents or IETF Contributions published or made publicly available before November 10, 2008. The person(s) controlling the copyright in some of this material may not have granted the IETF Trust the right to allow modifications of such material outside the IETF Standards Process. Without obtaining an adequate license from the person(s) controlling the copyright in such materials, this document may not be modified outside the IETF Standards Process, and derivative works of it may not be created outside the IETF Standards Process, except to format it for publication as an RFC or to translate it into languages other than English.
This memo defines a RFC-MIME-MEDIA [RFC2046] content-type for message disposition notifications (MDNs). An MDN can be used to notify the sender of a message of any of several conditions that may occur after successful delivery, such as display of the message contents, printing of the message, deletion (without display) of the message, or the recipient's refusal to provide MDNs. The "message/disposition-notification" content-type defined herein is intended for use within the framework of the "multipart/report" content type defined in RFC-REPORT [RFC3462].
This memo defines the format of the notifications and the RFC-MSGFMT [RFC5322] header fields used to request them.
This memo is an update to RFC 3798 and is intended to be published at Internet Standard Level.
This memo is currently marked with the 'pre5378Trust200902' IPR statements until a release has been obtained from all previous authors and editors of this text.
The MDNs defined in this memo are expected to serve several purposes:
These purposes place the following constraints on the notification protocol:
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC-KEYWORDS [RFC2119].
All syntax descriptions use the ABNF specified by RFC-MSGFMT [RFC5322], in which the lexical tokens (used below) are defined: "atom", "CRLF", "FWS", "CFWS", "field-name", "mailbox", "msg-id", and "text". The following lexical tokens are defined in the definition of the Content-Type header field in RFC-MIME-BODY [RFC2045]: "attribute" and "value".
Message disposition notifications are requested by including a Disposition-Notification-To header field in the message. Further information to be used by the recipient's MUA in generating the MDN may be provided by also including Original-Recipient and/or Disposition-Notification-Options header fields in the message.
mdn-request-header = "Disposition-Notification-To" ":" [FWS]
mailbox *("," [FWS] mailbox)
A request for the receiving user agent to issue message disposition notifications is made by placing a Disposition-Notification-To header field into the message. The syntax of the header field is
The presence of a Disposition-Notification-To header field in a message is merely a request for an MDN. The recipients' user agents are always free to silently ignore such a request. Alternatively, an explicit denial of the request for information about the disposition of the message may be sent using the "denied" disposition in an MDN.
An MDN MUST NOT itself have a Disposition-Notification-To header field. An MDN MUST NOT be generated in response to an MDN.
A user agent MUST NOT issue more than one MDN on behalf of each particular recipient. That is, once an MDN has been issued on behalf of a recipient, no further MDNs may be issued on behalf of that recipient, even if another disposition is performed on the message. However, if a message is forwarded, an MDN may have been issued for the recipient doing the forwarding and the recipient of the forwarded message may also cause an MDN to be generated.
While Internet standards normally do not specify the behavior of user interfaces, it is strongly recommended that the user agent obtain the user's consent before sending an MDN. This consent could be obtained for each message through some sort of prompt or dialog box, or globally through the user's setting of a preference. The user might also indicate globally that MDNs are to never be sent or that a "denied" MDN is always sent in response to a request for an MDN.
MDNs SHOULD NOT be sent automatically if the address in the Disposition-Notification-To header field differs from the address in the Return-Path header field (see RFC-MSGFMT [RFC5322]). In this case, confirmation from the user SHOULD be obtained, if possible. If obtaining consent is not possible (e.g., because the user is not online at the time), then an MDN SHOULD NOT be sent.
Confirmation from the user SHOULD be obtained (or no MDN sent) if there is no Return-Path header field in the message, or if there is more than one distinct address in the Disposition-Notification-To header field.
The comparison of the addresses should be done using only the addr-spec (local-part "@" domain) portion, excluding any angle brackets, phrase and route. The comparison MUST be case-sensitive for the local-part and case-insensitive for the domain part. [[ more work needed here ]]
If the message contains more than one Return-Path header field, the implementation may pick one to use for the comparison, or treat the situation as a failure of the comparison.
The reason for not automatically sending an MDN if the comparison fails or more than one address is specified is to reduce the possibility of mail loops and of MDNs being used for mail bombing.
A message that contains a Disposition-Notification-To header field SHOULD also contain a Message-ID header field as specified in RFC-MSGFMT [RFC5322]. This will permit automatic correlation of MDNs with their original messages by user agents.
If the request for message disposition notifications for some recipients and not others is desired, two copies of the message should be sent, one with a Disposition-Notification-To header field and one without. Many of the other header fields of the message (e.g., To, Cc) will be the same in both copies. The recipients in the respective message envelopes determine for whom message disposition notifications are requested and for whom they are not. If desired, the Message-ID header field may be the same in both copies of the message. Note that there are other situations (e.g., Bcc) in which it is necessary to send multiple copies of a message with slightly different header fields. The combination of such situations and the need to request MDNs for a subset of all recipients may result in more than two copies of a message being sent, some with a Disposition-Notification-To header field and some without.
Messages posted to newsgroups SHOULD NOT have a Disposition-Notification-To header field.
Disposition-Notification-Options =
"Disposition-Notification-Options" ":" [FWS]
disposition-notification-parameter-list
disposition-notification-parameter-list =
disposition-notification-parameter
*(";" [FWS] disposition-notification-parameter)
disposition-notification-parameter = attribute [FWS] "="
[FWS] importance "," [FWS] value *("," [FWS] value)
importance = "required" / "optional"
Future extensions to this specification may require that information be supplied to the recipient's MUA for additional control over how and what MDNs are generated. The Disposition-Notification-Options header field provides an extensible mechanism for such information. The syntax of this header field is as follows:
An importance of "required" indicates that interpretation of the disposition-notification-parameter is necessary for proper generation of an MDN in response to this request. An importance of "optional" indicates that an MUA that does not understand the meaning of this disposition-notification-parameter MAY generate an MDN in response anyway, ignoring the value of the disposition-notification-parameter.
No disposition-notification-parameter attribute names are defined in this specification. Attribute names may be defined in the future by later revisions or extensions to this specification. Disposition-notification-parameter attribute names beginning with "X-" will never be defined as standard names; such names are reserved for experimental use. MDN parameter names not beginning with "X-" MUST be registered with the Internet Assigned Numbers Authority (IANA) and described in a standards-track RFC or an experimental RFC approved by the IESG. [[ more work needed here ]]
Section 10 for a registration form.)
If a required disposition-notification-parameter is not understood or contains some sort of error, the receiving MUA SHOULD issue an MDN with a disposition type of "failed" (see Section 3.2.6), and include a Failure field (see Section 3.2.7) that further describes the problem. MDNs with the disposition type of "failed" and a "Failure" field MAY also be generated when other types of errors are detected in the disposition-notification-parameters of the Disposition-Notification-Options header field.
However, an MDN with a disposition type of "failed" MUST NOT be generated if the user has indicated a preference that MDNs are not to be sent. If user consent would be required for an MDN of some other disposition type to be sent, user consent SHOULD also be obtained before sending an MDN with a disposition type of "failed".
Since electronic mail addresses may be rewritten while the message is in transit, it is useful for the original recipient address to be made available by the delivering MTA. The delivering MTA may be able to obtain this information from the ORCPT parameter of the SMTP RCPT TO command, as defined in RFC-SMTP [RFC2821] and RFC-DSN-SMTP [RFC3461].
original-recipient-header =
"Original-Recipient" ":" address-type ";" generic-address
RFC-DSN-SMTP [RFC3461] is amended as follows: If the ORCPT information is available, the delivering MTA SHOULD insert an Original-Recipient header field at the beginning of the message (along with the Return-Path header field). The delivering MTA MAY delete any other Original-Recipient header fields that occur in the message. The syntax of this header field is as follows:
The address-type and generic-address token are as specified in the description of the Original-Recipient field in Section 3.2.3.
The purpose of carrying the original recipient information and returning it in the MDN is to permit automatic correlation of MDNs with the original message on a per-recipient basis.
The use of the header fields Disposition-Notification-To, Disposition-Notification-Options, and Original-Recipient with the MIME message/partial content type (RFC-MIME-MEDIA [RFC2046]]) requires further definition.
When a message is segmented into two or more message/partial fragments, the three header fields mentioned in the above paragraph SHOULD be placed in the "inner" or "enclosed" message (using the terms of RFC-MIME-MEDIA [RFC2046]). These header fields SHOULD NOT be used in the header fields of any of the fragments themselves.
When the multiple message/partial fragments are reassembled, the following applies. If these header fields occur along with the other header fields of a message/partial fragment message, they pertain to an MDN that will be generated for the fragment. If these header fields occur in the header fields of the "inner" or "enclosed" message (using the terms of RFC-MIME-MEDIA [RFC2046]), they pertain to an MDN that will be generated for the reassembled message. Section 5.2.2.1 of RFC-MIME-MEDIA [RFC2046]) is amended to specify that, in addition to the header fields specified there, the three header fields described in this specification are to be appended, in order, to the header fields of the reassembled message. Any occurrences of the three header fields defined here in the header fields of the initial enclosing message must not be copied to the reassembled message.
A message disposition notification is a MIME message with a top-level content-type of multipart/report (defined in RFC-REPORT [RFC3462]). When multipart/report content is used to transmit an MDN:
NOTE: For message disposition notifications gatewayed from foreign systems, the header fields of the original message may not be available. In this case, the third component of the MDN may be omitted, or it may contain "simulated" RFC-MSGFMT [RFC5322] header fields that contain equivalent information. In particular, it is very desirable to preserve the subject and date fields from the original message.
The MDN MUST be addressed (in both the message header field and the transport envelope) to the address(es) from the Disposition-Notification-To header field from the original message for which the MDN is being generated.
The From field of the message header field of the MDN MUST contain the address of the person for whom the message disposition notification is being issued.
The envelope sender address (i.e., SMTP MAIL FROM) of the MDN MUST be null (<>), specifying that no Delivery Status Notification messages or other messages indicating successful or unsuccessful delivery are to be sent in response to an MDN.
A message disposition notification MUST NOT itself request an MDN. That is, it MUST NOT contain a Disposition-Notification-To header field.
The Message-ID header field (if present) for an MDN MUST be different from the Message-ID of the message for which the MDN is being issued.
A particular MDN describes the disposition of exactly one message for exactly one recipient. Multiple MDNs may be generated as a result of one message submission, one per recipient. However, due to the circumstances described in Section 2.1, MDNs may not be generated for some recipients for which MDNs were requested.
The message/disposition-notification content-type is defined as follows:
(While the 7bit restriction applies to the message/disposition-notification portion of the multipart/report content, it does not apply to the optional third portion of the multipart/report content.)
The message/disposition-notification report type for use in the multipart/report is "disposition-notification".
disposition-notification-content = [ reporting-ua-field CRLF ]
[ mdn-gateway-field CRLF ]
[ original-recipient-field CRLF ]
final-recipient-field CRLF
[ original-message-id-field CRLF ]
disposition-field CRLF
*( failure-field CRLF )
*( error-field CRLF )
*( extension-field CRLF )
extension-field = extension-field-name ":" *(CFWS / text)
extension-field-name = field-name
The body of a message/disposition-notification consists of one or more "fields" formatted according to the ABNF of RFC-MSGFMT [RFC5322] header "fields". The syntax of the message/disposition-notification content is as follows:
[[ more work needed here ]]
Since these fields are defined according to the rules of RFC-MSGFMT [RFC5322], the same conventions for continuation lines and comments apply. Notification fields may be continued onto multiple lines by beginning each additional line with a SPACE or HTAB. Text that appears in parentheses is considered a comment and not part of the contents of that notification field. Field names are case-insensitive, so the names of notification fields may be spelled in any combination of upper and lower case letters. Comments in notification fields may use the "encoded-word" construct defined in RFC-MIME-HEADER [RFC2047].
Several fields consist of a "-type" subfield, followed by a semi-colon, followed by "*text". [[ more work needed here ]]
address-type = atom
mta-name-type = atom
The "-type" subfields are defined as follows:
Values for address-type and mta-name-type are case-insensitive. Thus, address-type values of "RFC822" and "rfc822" are equivalent.
The Internet Assigned Numbers Authority (IANA) maintains a registry of address-type and mta-name-type values, along with descriptions of the meanings of each, or a reference to one or more specifications that provide such descriptions. (The "rfc822" address-type is defined in RFC-DSN-SMTP [RFC3461].) Registration forms for address-type and mta-name-type appear in RFC-DSN-FORMAT [RFC3464].
reporting-ua-field = "Reporting-UA" ":" ua-name [ ";" ua-product ]
ua-name = *text-no-semi
ua-product = *text-no-semi
text-no-semi = %d1-9 / ; text characters excluding NUL, CR,
%d11 / %d12 / %d14-58 / %d60-127 ; LF, or semi-colon
Reporting-UA: pc.example.com; Foomail 97.1
An MDN describes the disposition of a message after it has been delivered to a recipient. In all cases, the Reporting-UA is the MUA that performed the disposition described in the MDN. This field is optional, but recommended. For Internet Mail user agents, it is recommended that this field contain both: the DNS name of the particular instance of the MUA that generated the MDN, and the name of the product. For example,
If the reporting MUA consists of more than one component (e.g., a base program and plug-ins), this may be indicated by including a list of product names.
mdn-gateway-field = "MDN-Gateway" ":" mta-name-type ";" mta-name
mta-name = *text
The MDN-Gateway field indicates the name of the gateway or MTA that translated a foreign (non-Internet) message disposition notification into this MDN. This field MUST appear in any MDN that was translated by a gateway from a foreign system into MDN format, and MUST NOT appear otherwise.
For gateways into Internet Mail, the MTA-name-type will normally be "smtp", and the mta-name will be the Internet domain name of the gateway.
original-recipient-field =
"Original-Recipient" ":" address-type ";" generic-address
generic-address = *text
The Original-Recipient field indicates the original recipient address as specified by the sender of the message for which the MDN is being issued. For Internet Mail messages, the value of the Original-Recipient field is obtained from the Original-Recipient header field from the message for which the MDN is being generated. If there is no Original-Recipient header field in the message, then the Original-Recipient field MUST be omitted, unless the same information is reliably available some other way. If there is an Original-Recipient header field in the original message (or original recipient information is reliably available some other way), then the Original-Recipient field must be supplied. If there is more than one Original-Recipient header field in the message, the MUA may choose the one to use, or act as if no Original-Recipient header field is present.
The address-type field indicates the type of the original recipient address. If the message originated within the Internet, the address-type field will normally be "rfc822", and the address will be according to the syntax specified in RFC-MSGFMT [RFC5322]. The value "unknown" should be used if the Reporting MUA cannot determine the type of the original recipient address from the message envelope. This address is the same as that provided by the sender and can be used to automatically correlate MDN reports with original messages on a per recipient basis.
The Final-Recipient field indicates the recipient for which the MDN is being issued. This field MUST be present.
final-recipient-field =
"Final-Recipient" ":" address-type ";" generic-address
The syntax of the field is as follows:
The generic-address subfield of the Final-Recipient field MUST contain the mailbox address of the recipient (from the From header field of the MDN) as it was when the MDN was generated by the MUA.
The Final-Recipient address may differ from the address originally provided by the sender, because it may have been transformed during forwarding and gatewaying into a totally unrecognizable mess. However, in the absence of the optional Original-Recipient field, the Final-Recipient field and any returned content may be the only information available with which to correlate the MDN with a particular message recipient.
The address-type subfield indicates the type of address expected by the reporting MTA in that context. Recipient addresses obtained via SMTP will normally be of address-type "rfc822".
Since mailbox addresses (including those used in the Internet) may be case sensitive, the case of alphabetic characters in the address MUST be preserved.
original-message-id-field =
"Original-Message-ID" ":" msg-id
The Original-Message-ID field indicates the message-ID of the message for which the MDN is being issued. It is obtained from the Message-ID header field of the message for which the MDN is issued. This field MUST be present if the original message contained a Message-ID header field. The syntax of the field is as follows:
The msg-id token is as specified in RFC-MSGFMT [RFC5322].
The Disposition field indicates the action performed by the Reporting-MUA on behalf of the user. This field MUST be present.
disposition-field =
"Disposition" ":" [FWS] disposition-mode ";"
[FWS] disposition-type
[ "/" disposition-modifier
*( "," disposition-modifier ) ]
disposition-mode = action-mode "/" sending-mode
action-mode = "manual-action" / "automatic-action"
sending-mode = "MDN-sent-manually" / "MDN-sent-automatically"
disposition-type = "displayed" / "deleted" / "dispatched" /
"processed"
disposition-modifier = [CFWS]
("error" / disposition-modifier-extension)
disposition-modifier-extension = atom
The syntax for the Disposition field is:
The disposition-mode, disposition-type, and disposition-modifier may be spelled in any combination of upper and lower case characters.
The following disposition modes are defined:
"Manual-action" and "automatic-action" are mutually exclusive. One or the other MUST be specified.
"MDN-sent-manually" and "MDN-sent-automatically" are mutually exclusive. One or the other MUST be specified.
The following disposition-types are defined:
Only the extension disposition modifiers is defined:
If an MUA developer does not wish to register the meanings of such disposition modifier extensions, "X-" modifiers may be used for this purpose. To avoid name collisions, the name of the MUA implementation should follow the "X-", (e.g., "X-Foomail-").
It is not required that an MUA be able to generate all of the possible values of the Disposition field.
A user agent MUST NOT issue more than one MDN on behalf of each particular recipient. That is, once an MDN has been issued on behalf of a recipient, no further MDNs may be issued on behalf of that recipient, even if another disposition is performed on the message. However, if a message is forwarded, a "dispatched" MDN MAY be issued for the recipient doing the forwarding and the recipient of the forwarded message may also cause an MDN to be generated.
failure-field = "Failure" ":" *text
error-field = "Error" ":" *text
The Failure and Error fields are used to supply additional information in the form of text messages when the "failure" disposition type or "error" disposition modifier appear. The syntax is as follows:
Additional MDN fields may be defined in the future by later revisions or extensions to this specification. Extension-field names beginning with "X-" will never be defined as standard fields; such names are reserved for experimental use. MDN field names NOT beginning with "X-" MUST be registered with the Internet Assigned Numbers Authority (IANA) and described in a standards-track RFC or an experimental RFC approved by the IESG. (See Section 10 for a registration form.) MDN Extension-fields may be defined for the following reasons:
If an application developer does not wish to register the meanings of such extension fields, "X-" fields may be used for this purpose. To avoid name collisions, the name of the application implementation should follow the "X-", (e.g., "X-Foomail-Log-ID" or "X-Foomail-EDI-info").
The following timeline shows when various events in the processing of a message and generation of MDNs take place:
An MUA or gateway conforms to this specification if it generates MDNs according to the protocol defined in this memo. It is not necessary to be able to generate all of the possible values of the Disposition field.
MUAs and gateways MUST NOT generate the Original-Recipient field of an MDN unless the mail protocols provide the address originally specified by the sender at the time of submission. Ordinary SMTP does not make that guarantee, but the SMTP extension defined in RFC-DSN-SMTP [RFC3461] permits such information to be carried in the envelope if it is available. The Original-Recipient header field defined in this document provides a way for the MTA to pass the original recipient address to the MUA.
Each sender-specified recipient address may result in more than one MDN. If an MDN is requested for a recipient that is forwarded to multiple recipients of an "alias" (as defined in RFC-DSN-SMTP [RFC3461], section 6.2.7.3), each of the recipients may issue an MDN.
Successful distribution of a message to a mailing list exploder SHOULD be considered the final disposition of the message. A mailing list exploder MAY issue an MDN with a disposition type of "processed" and disposition modes of "automatic-action" and "MDN-sent-automatically" indicating that the message has been forwarded to the list. In this case, the request for MDNs is not propagated to the members of the list.
Alternatively, the mailing list exploder MAY issue no MDN and propagate the request for MDNs to all members of the list. The latter behavior is not recommended for any but small, closely knit lists, as it might cause large numbers of MDNs to be generated and may cause confidential subscribers to the list to be revealed. The mailing list exploder MAY also direct MDNs to itself, correlate them, and produce a report to the original sender of the message.
This specification places no restrictions on the processing of MDNs received by user agents or mailing lists.
The following security considerations apply when using MDNs:
MDNs may be forged as easily as ordinary Internet electronic mail. User agents and automatic mail handling facilities (such as mail distribution list exploders) that wish to make automatic use of MDNs should take appropriate precautions to minimize the potential damage from denial-of-service attacks.
Security threats related to forged MDNs include the sending of:
Another dimension of security is privacy. There may be cases in which a message recipient does not wish the disposition of messages addressed to him to be known, or is concerned that the sending of MDNs may reveal other sensitive information (e.g., when the message was read). In this situation, it is acceptable for the MUA to issue "denied" MDNs or to silently ignore requests for MDNs.
If the Disposition-Notification-To header field is passed on unmodified when a message is distributed to the subscribers of a mailing list, the subscribers to the list may be revealed to the sender of the original message by the generation of MDNs.
Headers of the original message returned in part 3 of the multipart/report could reveal confidential information about host names and/or network topology inside a firewall.
An unencrypted MDN could reveal confidential information about an encrypted message, especially if all or part of the original message is returned in part 3 of the multipart/report. Encrypted MDNs are not defined in this specification.
In general, any optional MDN field may be omitted if the Reporting MUA site or user determines that inclusion of the field would impose too great a compromise of site confidentiality. The need for such confidentiality must be balanced against the utility of the omitted information in MDNs.
In some cases, someone with access to the message stream may use the MDN request mechanism to monitor the mail reading habits of a target. If the target is known to generate MDN reports, they could add a disposition-notification-to field containing the envelope from address along with a source route. The source route is ignored in the comparison so the addresses will always match. But if the source route is honored when the notification is sent, it could direct the message to some other destination. This risk can be minimized by not sending MDN's automatically.
MDNs do not provide non-repudiation with proof of delivery. Within the framework of today's Internet Mail, the MDNs defined in this document provide valuable information to the mail user; however, MDNs cannot be relied upon as a guarantee that a message was or was not seen by the recipient. Even if MDNs are not actively forged, they may be lost in transit. The recipient may bypass the MDN issuing mechanism in some manner.
One possible solution for this purpose can be found in RFC-SEC-SERVICES [RFC2634].
The MDN request mechanism introduces an additional way of mailbombing a mailbox. The MDN request notification provides an address to which MDN's should be sent. It is possible for an attacking agent to send a potentially large set of messages to otherwise unsuspecting third party recipients with a false "disposition-notification-to:" address. Automatic, or simplistic processing of such requests would result in a flood of MDN notifications to the target of the attack. Such an attack could overrun the capacity of the targeted mailbox and deny service.
For that reason, MDN's SHOULD NOT be sent automatically where the "disposition-notification-to:" address is different from the envelope MAIL FROM address. See Section 2.1 for further discussion.
Message header fields:
mdn-request-header =
"Disposition-Notification-To" ":" [FWS]
mailbox *("," [FWS] mailbox)
Disposition-Notification-Options =
"Disposition-Notification-Options" ":" [FWS]
disposition-notification-parameter-list
disposition-notification-parameter-list =
disposition-notification-parameter
*(";" [FWS] disposition-notification-parameter)
disposition-notification-parameter = attribute [FWS] "=" [FWS]
importance "," [FWS] value *("," [FWS] value)
importance = "required" / "optional"
original-recipient-header =
"Original-Recipient" ":" address-type ";" generic-address
Report content:
disposition-notification-content =
[ reporting-ua-field CRLF ]
[ mdn-gateway-field CRLF ]
[ original-recipient-field CRLF ]
final-recipient-field CRLF
[ original-message-id-field CRLF ]
disposition-field CRLF
*( failure-field CRLF )
*( error-field CRLF )
*( extension-field CRLF )
address-type = atom
mta-name-type = atom
reporting-ua-field = "Reporting-UA" ":" ua-name [ ";" ua-product ]
ua-name = *text-no-semi
ua-product = *text-no-semi
text-no-semi = %d1-9 / ; text characters excluding NUL, CR,
%d11 / %d12 / %d14-58 / %d60-127 ; LF, or semi-colon
mdn-gateway-field = "MDN-Gateway" ":" mta-name-type ";" mta-name
mta-name = *text
original-recipient-field =
"Original-Recipient" ":" address-type ";" generic-address
generic-address = *text
final-recipient-field =
"Final-Recipient" ":" address-type ";" generic-address
original-message-id-field = "Original-Message-ID" ":" msg-id
disposition-field =
"Disposition" ":" [FWS] disposition-mode ";"
[FWS] disposition-type
[ "/" disposition-modifier
*( "," disposition-modifier ) ]
disposition-mode = action-mode "/" sending-mode
action-mode = "manual-action" / "automatic-action"
sending-mode = "MDN-sent-manually" / "MDN-sent-automatically"
disposition-type = "displayed" / "deleted" / "dispatched" /
"processed"
disposition-modifier = [CFWS]
("error" / disposition-modifier-extension)
disposition-modifier-extension = atom
failure-field = "Failure" ":" *text
error-field = "Error" ":" *text
extension-field = extension-field-name ":" *text
extension-field-name = field-name
NOTE: The following lexical tokens are defined in RFC-MSGFMT [RFC5322]: atom, CRLF, FWS, CFWS, field-name, mailbox, msg-id, text. The definitions of attribute and value are as in the definition of the Content-Type header field in RFC-MIME-BODY [RFC2045].
NOTE: This section provides non-binding recommendations for the construction of mail gateways that wish to provide semi-transparent disposition notifications between the Internet and another electronic mail system. Specific MDN gateway requirements for a particular pair of mail systems may be defined by other documents.
A mail gateway may issue an MDN to convey the contents of a "foreign" disposition notification over Internet Mail. When there are appropriate mappings from the foreign notification elements to MDN fields, the information may be transmitted in those MDN fields. Additional information (such as might be needed to tunnel the foreign notification through the Internet) may be defined in extension MDN fields. (Such fields should be given names that identify the foreign mail protocol, e.g., X400-* for X.400 protocol elements).
The gateway must attempt to supply reasonable values for the Reporting-UA, Final-Recipient, and Disposition fields. These will normally be obtained by translating the values from the foreign notification into their Internet-style equivalents. However, some loss of information is to be expected.
The sender-specified recipient address and the original message-id, if present in the foreign notification, should be preserved in the Original-Recipient and Original-Message-ID fields.
The gateway should also attempt to preserve the "final" recipient address from the foreign system. Whenever possible, foreign protocol elements should be encoded as meaningful printable ASCII strings.
For MDNs produced from foreign disposition notifications, the name of the gateway MUST appear in the MDN-Gateway field of the MDN.
It may be possible to gateway MDNs from the Internet into a foreign mail system. The primary purpose of such gatewaying is to convey disposition information in a form that is usable by the destination system. A secondary purpose is to allow "tunneling" of MDNs through foreign mail systems in case the MDN may be gatewayed back into the Internet.
In general, the recipient of the MDN (i.e., the sender of the original message) will want to know, for each recipient: the closest available approximation to the original recipient address, and the disposition (displayed, printed, etc.).
If possible, the gateway should attempt to preserve the Original-Recipient address and Original-Message-ID (if present) in the resulting foreign disposition report.
If it is possible to tunnel an MDN through the destination environment, the gateway specification may define a means of preserving the MDN information in the disposition reports used by that environment.
By use of the separate disposition-notification-to request header field, this specification offers a richer functionality than most, if not all, other email systems. In most other email systems, the notification recipient is identical to the message sender as indicated in the "from" address. There are two interesting cases when gatewaying into such systems:
NOTE: This example is provided as illustration only, and is not considered part of the MDN protocol specification. If the example conflicts with the protocol definition above, the example is wrong.
Likewise, the use of *-type subfield names or extension fields in this example is not to be construed as a definition for those type names or extension fields.
This is an MDN issued after a message has been displayed to the user of an Internet Mail user agent.
Date: Wed, 20 Sep 1995 00:19:00 (EDT) -0400
From: Joe Recipient <Joe_Recipient@example.com>
Message-Id: <199509200019.12345@example.com>
Subject: Disposition notification
To: Jane Sender <Jane_Sender@example.org>
MIME-Version: 1.0
Content-Type: multipart/report; report-type=disposition-notification;
boundary="RAA14128.773615765/example.com"
--RAA14128.773615765/example.com
The message sent on 1995 Sep 19 at 13:30:00 (EDT) -0400 to Joe
Recipient <Joe_Recipient@example.com> with subject "First draft of
report" has been displayed.
This is no guarantee that the message has been read or understood.
--RAA14128.773615765/example.com
content-type: message/disposition-notification
Reporting-UA: joes-pc.cs.example.com; Foomail 97.1
Original-Recipient: rfc822;Joe_Recipient@example.com
Final-Recipient: rfc822;Joe_Recipient@example.com
Original-Message-ID: <199509192301.23456@example.org>
Disposition: manual-action/MDN-sent-manually; displayed
--RAA14128.773615765/example.com
content-type: message/rfc822
[original message optionally goes here]
--RAA14128.773615765/example.com--
This document specifies three types of parameters that must be registered with the Internet Assigned Numbers Authority (IANA).
The forms below are for use when registering a new disposition-notification-parameter name for the Disposition-Notification-Options header field, a new disposition modifier name, or a new MDN extension field. Each piece of information required by a registration form may be satisfied either by providing the information on the form itself, or by including a reference to a published, publicly available specification that includes the necessary information. IANA MAY reject registrations because of incomplete registration forms or incomplete specifications.
To register, complete the following applicable form and send it via electronic mail to <IANA@IANA.ORG>.
A registration for a Disposition-Notification-Options header field disposition-notification-parameter name MUST include the following information:
A registration for a disposition-modifier name (used in the Disposition field of a message/disposition-notification) MUST include the following information:
A registration for an MDN extension-field name MUST include the following information:
The contributions of Bruce Lilly and Alfred Hoenes are gratefully acknowledged for this revision.
The contributions of Roger Fajman and Greg Vaudreuil to earlier versions of this document are also gratefully acknowledged.
| [1] | Hoffman, P., "Enhanced Security Services for S/MIME", RFC 2634, June 1999. |
The values of "dispatched" and "processed" were lost from the ABNF for "disposition-type".
Because the warning disposition modifier was previously removed, warning-field has also been removed.
The ABNF for ua-name and ua-product included semi-colon, which could not be distinguished from *text in the production. The ua-name and ua-product definitions were restricted to not include semi-colon.
The ABNF did not indicate all places that whitespace was allowable, in particular folding whitespace, although all implementations allow whitespace and folding in the header fields just like any other RFC5322 [RFC5322]-formatted header field. There were also a number of places in the ABNF that inconsistently permitted comments and whitespace in one leg of the production and not another. The ABNF now specifies FWS and CFWS in several places that should have already been specified by the grammar.
Extension-field was defined in the collected grammar but not in the main text.
The comparison of mailboxes in Disposition-Notification-To to the Return-Path addr-spec was clarified.
The use of the grammar production "parameter" was confusing with the RFC2045 [RFC2045] production of the same name, as well as other uses of the same term. These have been clarified.
A clarification was added on the extent of the 7bit nature of MDNs.
Uses of the terms "may" and "might" were clarified.
A clarification was added on the order of the fields in the message/disposition-notification content.