defined in [RFC-DSN-SMTP].) Registration forms for address-type and
mta-name-type appear in [RFC-DSN-FORMAT].
3.2. Message/disposition-notification Fields
3.2.1. The Reporting-UA field
reporting-ua-field = "Reporting-UA" ":" ua-name
[ ";" ua-product ]
ua-name = *text
ua-product = *text
The Reporting-UA field is defined as follows:
An MDN describes the disposition of a message after it has been
delivered to a recipient. In all cases, the Reporting-UA is the MUA
that performed the disposition described in the MDN. This field is
optional, but recommended. For Internet Mail user agents, it is
recommended that this field contain both: the DNS name of the
particular instance of the MUA that generated the MDN, and the name
of the product. For example,
Reporting-UA: pc.example.com; Foomail 97.1
If the reporting MUA consists of more than one component (e.g., a
base program and plug-ins), this may be indicated by including a list
of product names.
3.2.2. The MDN-Gateway field
The MDN-Gateway field indicates the name of the gateway or MTA that
translated a foreign (non-Internet) message disposition notification
into this MDN. This field MUST appear in any MDN that was translated
by a gateway from a foreign system into MDN format, and MUST NOT
appear otherwise.
mdn-gateway-field = "MDN-Gateway" ":" mta-name-type ";" mta-name
mta-name = *text
For gateways into Internet Mail, the MTA-name-type will normally be
"smtp", and the mta-name will be the Internet domain name of the
gateway.
3.2.3. Original-Recipient field
The Original-Recipient field indicates the original recipient address
as specified by the sender of the message for which the MDN is being
issued. For Internet Mail messages, the value of the Original-
Recipient field is obtained from the Original-Recipient header from
the message for which the MDN is being generated. If there is no
Original-Recipient header in the message, then the Original-Recipient
field MUST be omitted, unless the same information is reliably
available some other way. If there is an Original-Recipient header
in the original message (or original recipient information is
reliably available some other way), then the Original-Recipient field
must be supplied. If there is more than one Original-Recipient
header in the message, the MUA may choose the one to use, or act as
if no Original-Recipient header is present.
original-recipient-field =
"Original-Recipient" ":" address-type ";"
generic-address
generic-address = *text
The address-type field indicates the type of the original recipient
address. If the message originated within the Internet, the
address-type field will normally be "rfc822", and the address will be
according to the syntax specified in [RFC-MSGFMT]. The value
"unknown" should be used if the Reporting MUA cannot determine the
type of the original recipient address from the message envelope.
This address is the same as that provided by the sender and can be
used to automatically correlate MDN reports with original messages on
a per recipient basis.
3.2.4. Final-Recipient field
The Final-Recipient field indicates the recipient for which the MDN
is being issued. This field MUST be present.
The syntax of the field is as follows:
final-recipient-field =
"Final-Recipient" ":" address-type ";" generic-address
The generic-address subfield of the Final-Recipient field MUST
contain the mailbox address of the recipient (from the From header of
the MDN) as it was when the MDN was generated by the MUA.
The Final-Recipient address may differ from the address originally
provided by the sender, because it may have been transformed during
forwarding and gatewaying into a totally unrecognizable mess.
However, in the absence of the optional Original-Recipient field, the
Final-Recipient field and any returned content may be the only
information available with which to correlate the MDN with a
particular message recipient.
The address-type subfield indicates the type of address expected by
the reporting MTA in that context. Recipient addresses obtained via
SMTP will normally be of address-type "rfc822".
Since mailbox addresses (including those used in the Internet) may be
case sensitive, the case of alphabetic characters in the address MUST
be preserved.
3.2.5. Original-Message-ID field
The Original-Message-ID field indicates the message-ID of the message
for which the MDN is being issued. It is obtained from the Message-
ID header of the message for which the MDN is issued. This field
MUST be present if the original message contained a Message-ID
header. The syntax of the field is as follows:
original-message-id-field =
"Original-Message-ID" ":" msg-id
The msg-id token is as specified in [RFC-MSGFMT].
3.2.6. Disposition field
The Disposition field indicates the action performed by the
Reporting-MUA on behalf of the user. This field MUST be present.
The syntax for the Disposition field is:
disposition-field =
"Disposition" ":" disposition-mode ";"
disposition-type
[ "/" disposition-modifier
*( "," disposition-modifier ) ]
disposition-mode = action-mode "/" sending-mode
action-mode = "manual-action" / "automatic-action"
sending-mode = "MDN-sent-manually" / "MDN-sent-automatically"
disposition-type = "displayed"
/ "deleted"
disposition-modifier = "error"
/ disposition-modifier-extension
disposition-modifier-extension = atom
The disposition-mode, disposition-type, and disposition-modifier may
be spelled in any combination of upper and lower case characters.
3.2.6.1. Disposition modes
The following disposition modes are defined:
"manual-action" The disposition described by the disposition
type was a result of an explicit instruction
by the user rather than some sort of
automatically performed action.
"automatic-action" The disposition described by the disposition
type was a result of an automatic action,
rather than an explicit instruction by the
user for this message.
"Manual-action" and "automatic-action" are mutually exclusive. One
or the other MUST be specified.
"MDN-sent-manually" The user explicitly gave permission for this
particular MDN to be sent.
"MDN-sent-automatically"
The MDN was sent because the MUA had
previously been configured to do so
automatically.
"MDN-sent-manually" and "MDN-sent-automatically" are mutually
exclusive. One or the other MUST be specified.
3.2.6.2. Disposition types
The following disposition-types are defined:
"displayed" The message has been displayed by the MUA
to someone reading the recipient’s mailbox.
There is no guarantee that the content has
been read or understood.
"deleted" The message has been deleted. The
recipient may or may not have seen the
message. The recipient might "undelete"
the message at a later time and read the
message.
3.2.6.3. Disposition modifiers
Only the extension disposition modifiers is defined:
disposition-modifier-extension
Disposition modifiers may be defined
in the future by later revisions
or extensions to this specification.
Disposition value names beginning with "X-"
will never be defined as standard values;
such names are reserved for experimental
use. MDN disposition value names NOT
beginning with "X-" MUST be registered with
the Internet Assigned Numbers Authority
(IANA) and described in a standards-track
RFC or an experimental RFC approved by the
IESG. (See Section 10 for a registration
form.) MDNs with disposition modifier
names not understood by the receiving MUA
MAY be silently ignored or placed in the
user’s mailbox without special
interpretation. They MUST not cause any
error message to be sent to the sender of
the MDN.
If an MUA developer does not wish to register the meanings of such
disposition modifier extensions, "X-" modifiers may be used for this
purpose. To avoid name collisions, the name of the MUA
implementation should follow the "X-", (e.g., "X-Foomail-").
It is not required that an MUA be able to generate all of the
possible values of the Disposition field.
A user agent MUST NOT issue more than one MDN on behalf of each
particular recipient. That is, once an MDN has been issued on behalf
of a recipient, no further MDNs may be issued on behalf of that
recipient, even if another disposition is performed on the message.
However, if a message is forwarded, a "dispatched" MDN may be issued
for the recipient doing the forwarding and the recipient of the
forwarded message may also cause an MDN to be generated.
3.2.7. Failure, Error, and Warning fields
The Failure, Error, and Warning fields are used to supply additional
information in the form of text messages when the "failure"
disposition type, "error" disposition modifier, and/or the "warning"
disposition modifier appear. The syntax is as follows:
failure-field = "Failure" ":" *text
error-field = "Error" ":" *text
warning-field = "Warning" ":" *text
3.3. Extension-fields
Additional MDN fields may be defined in the future by later revisions
or extensions to this specification. Extension-field names beginning
with "X-" will never be defined as standard fields; such names are
reserved for experimental use. MDN field names NOT beginning with
"X-" MUST be registered with the Internet Assigned Numbers Authority
(IANA) and described in a standards-track RFC or an experimental RFC
approved by the IESG. (See Section 10 for a registration form.)
MDN Extension-fields may be defined for the following reasons:
(a) To allow additional information from foreign disposition reports
to be tunneled through Internet MDNs. The names of such MDN
fields should begin with an indication of the foreign
environment name (e.g., X400-Physical-Forwarding-Address).
(b) To allow transmission of diagnostic information that is specific
to a particular mail user agent (MUA). The names of such MDN
fields should begin with an indication of the MUA implementation
that produced the MDN (e.g., Foomail-information).
If an application developer does not wish to register the meanings of
such extension fields, "X-" fields may be used for this purpose. To
avoid name collisions, the name of the application implementation
should follow the "X-", (e.g., "X-Foomail-Log-ID" or "X-Foomail-EDI-
info").
4. Timeline of events
The following timeline shows when various events in the processing of
a message and generation of MDNs take place:
-- User composes message
-- User tells MUA to send message
-- MUA passes message to MTA (original recipient information passed
along)
-- MTA sends message to next MTA
-- Final MTA receives message
-- Final MTA delivers message to MUA (possibly generating a DSN)
-- MUA performs automatic processing and generates corresponding MDNs
("dispatched", "processed", "deleted", "denied", or "failed"
disposition type with "automatic-action" and "MDN-sent-
automatically" disposition modes)
-- MUA displays list of messages to user
-- User selects a message and requests that some action be performed
on it.
-- MUA performs requested action and, with user’s permission, sends
an appropriate MDN ("displayed", "dispatched", "processed",
"deleted", "denied", or "failed" disposition type, with "manual-
action" and "MDN-sent-manually" or "MDN-sent-automatically"
disposition mode).
-- User possibly performs other actions on message, but no further
MDNs are generated.
5. Conformance and Usage Requirements
An MUA or gateway conforms to this specification if it generates MDNs
according to the protocol defined in this memo. It is not necessary
to be able to generate all of the possible values of the Disposition
field.
MUAs and gateways MUST NOT generate the Original-Recipient field of
an MDN unless the mail protocols provide the address originally
specified by the sender at the time of submission. Ordinary SMTP
does not make that guarantee, but the SMTP extension defined in
[RFC-DSN-SMTP] permits such information to be carried in the envelope
if it is available. The Original-Recipient header defined in this
document provides a way for the MTA to pass the original recipient
address to the MUA.
Each sender-specified recipient address may result in more than one
MDN. If an MDN is requested for a recipient that is forwarded to
multiple recipients of an "alias" (as defined in [RFC-DSN-SMTP],
section 6.2.7.3), each of the recipients may issue an MDN.
Successful distribution of a message to a mailing list exploder
SHOULD be considered the final disposition of the message. A mailing
list exploder MAY issue an MDN with a disposition type of "processed"
and disposition modes of "automatic-action" and "MDN-sent-
automatically" indicating that the message has been forwarded to the
list. In this case, the request for MDNs is not propagated to the
members of the list.
Alternatively, the mailing list exploder MAY issue no MDN and
propagate the request for MDNs to all members of the list. The
latter behavior is not recommended for any but small, closely knit
lists, as it might cause large numbers of MDNs to be generated and
may cause confidential subscribers to the list to be revealed. The
mailing list exploder MAY also direct MDNs to itself, correlate them,
and produce a report to the original sender of the message.
This specification places no restrictions on the processing of MDNs
received by user agents or mailing lists.
6. Security Considerations
The following security considerations apply when using MDNs:
6.1. Forgery
MDNs may be forged as easily as ordinary Internet electronic mail.
User agents and automatic mail handling facilities (such as mail
distribution list exploders) that wish to make automatic use of MDNs
should take appropriate precautions to minimize the potential damage
from denial-of-service attacks.
Security threats related to forged MDNs include the sending of:
(a) A falsified disposition notification when the indicated
disposition of the message has not actually occurred,
(b) Unsolicited MDNs
6.2. Privacy
Another dimension of security is privacy. There may be cases in
which a message recipient does not wish the disposition of messages
addressed to him to be known, or is concerned that the sending of
MDNs may reveal other sensitive information (e.g., when the message
was read). In this situation, it is acceptable for the MUA to issue
"denied" MDNs or to silently ignore requests for MDNs.
If the Disposition-Notification-To header is passed on unmodified
when a message is distributed to the subscribers of a mailing list,
the subscribers to the list may be revealed to the sender of the
original message by the generation of MDNs.
Headers of the original message returned in part 3 of the
multipart/report could reveal confidential information about host
names and/or network topology inside a firewall.
An unencrypted MDN could reveal confidential information about an
encrypted message, especially if all or part of the original message
is returned in part 3 of the multipart/report. Encrypted MDNs are
not defined in this specification.
In general, any optional MDN field may be omitted if the Reporting
MUA site or user determines that inclusion of the field would impose
too great a compromise of site confidentiality. The need for such
confidentiality must be balanced against the utility of the omitted
information in MDNs.
In some cases, someone with access to the message stream may use the
MDN request mechanism to monitor the mail reading habits of a target.
If the target is known to generate MDN reports, they could add a
disposition-notification-to field containing the envelope from
address along with a source route. The source route is ignored in
the comparison so the addresses will always match. But if the source
route is honored when the notification is sent, it could direct the
message to some other destination. This risk can be minimized by not
sending MDN’s automatically.
6.3. Non-Repudiation
MDNs do not provide non-repudiation with proof of delivery. Within
the framework of today’s Internet Mail, the MDNs defined in this
document provide valuable information to the mail user; however, MDNs
cannot be relied upon as a guarantee that a message was or was not
seen by the recipient. Even if MDNs are not actively forged, they
may be lost in transit. The recipient may bypass the MDN issuing
mechanism in some manner.
One possible solution for this purpose can be found in RFC 2634
[SEC-SERVICES].
6.4. Mail Bombing
The MDN request mechanism introduces an additional way of mailbombing
a mailbox. The MDN request notification provides an address to which
MDN’s should be sent. It is possible for an attacking agent to send
a potentially large set of messages to otherwise unsuspecting third
party recipients with a false "disposition-notification-to:" address.
Automatic, or simplistic processing of such requests would result in
a flood of MDN notifications to the target of the attack. Such an
attack could overrun the capacity of the targeted mailbox and deny
service.
For that reason, MDN’s SHOULD NOT be sent automatically where the
"disposition-notification-to:" address is different from the envelope
MAIL FROM address. See section 2.1 for further discussion.
7. Collected Grammar
NOTE: The following lexical tokens are defined in [RFC-MSGFMT]:
atom, CRLF, mailbox, msg-id, text. The definitions of attribute and
value are as in the definition of the Content-Type header in [RFC-
MIME-BODY].
Message headers:
mdn-request-header =
"Disposition-Notification-To" ":"
mailbox *("," mailbox)
Disposition-Notification-Options =
"Disposition-Notification-Options" ":"
disposition-notification-parameters
disposition-notification-parameters =
parameter *(";" parameter)
parameter = attribute "=" importance "," value *("," value)
importance = "required" / "optional"
original-recipient-header =
"Original-Recipient" ":" address-type ";" generic-address
Report content:
disposition-notification-content =
[ reporting-ua-field CRLF ]
[ mdn-gateway-field CRLF ]
[ original-recipient-field CRLF ]
final-recipient-field CRLF
[ original-message-id-field CRLF ]
disposition-field CRLF
*( failure-field CRLF )
*( error-field CRLF )
*( warning-field CRLF )
*( extension-field CRLF )
address-type = atom
mta-name-type = atom
reporting-ua-field = "Reporting-UA" ":" ua-name [ ";" ua-product ]
ua-name = *text
ua-product = *text
mdn-gateway-field = "MDN-Gateway" ":" mta-name-type ";" mta-name
mta-name = *text
original-recipient-field
= "Original-Recipient" ":" address-type ";"
generic-address
generic-address = *text
final-recipient-field =
"Final-Recipient" ":" address-type ";" generic-address
disposition-field =
"Disposition" ":" disposition-mode ";"
disposition-type
[ "/" disposition-modifier
*( "," disposition-modifier ) ]
disposition-mode = action-mode "/" sending-mode
action-mode = "manual-action" / "automatic-action"
sending-mode = "MDN-sent-manually" / "MDN-sent-automatically"
disposition-type = "displayed"
/ "deleted"
disposition-modifier = "error" / disposition-modifier-extension
disposition-modifier-extension = atom
original-message-id-field = "Original-Message-ID" ":" msg-id
failure-field = "Failure" ":" *text
error-field = "Error" ":" *text
warning-field = "Warning" ":" *text
extension-field = extension-field-name ":" *text
extension-field-name = atom
8. Guidelines for Gatewaying MDNs
NOTE: This section provides non-binding recommendations for the
construction of mail gateways that wish to provide semi-transparent
disposition notifications between the Internet and another electronic
mail system. Specific MDN gateway requirements for a particular pair
of mail systems may be defined by other documents.
8.1. Gatewaying from other mail systems to MDNs
A mail gateway may issue an MDN to convey the contents of a "foreign"
disposition notification over Internet Mail. When there are
appropriate mappings from the foreign notification elements to MDN
fields, the information may be transmitted in those MDN fields.
Additional information (such as might be needed to tunnel the foreign
notification through the Internet) may be defined in extension MDN
fields. (Such fields should be given names that identify the foreign
mail protocol, e.g., X400-* for X.400 protocol elements).
The gateway must attempt to supply reasonable values for the
Reporting-UA, Final-Recipient, and Disposition fields. These will
normally be obtained by translating the values from the foreign
notification into their Internet-style equivalents. However, some
loss of information is to be expected.
The sender-specified recipient address and the original message-id,
if present in the foreign notification, should be preserved in the
Original-Recipient and Original-Message-ID fields.
The gateway should also attempt to preserve the "final" recipient