Guidance on End-to-End Email Security

Metadata

Publisher: IETF
Doc Type: Informational
Pages: 53
Abstract: End-to-end cryptographic protections for email messages can provide useful security. However, the standards for providing cryptographic protection are extremely flexible. That flexibility can trap users and cause surprising failures. This document offers guidance for Mail User Agent (MUA) implementers to help mitigate those risks and to make end-to-end email simple and secure for the end user. It provides a useful set of vocabulary as well as recommendations to avoid common failures. It also identifies a number of currently unsolved usability and interoperability problems.
Publication Date: 2025-08-01
Status Note: Informational
DOI: 10.17487/RFC9787
Link: https://doi.org/10.17487/RFC9787
Author(s): Daniel Kahn Gillmor
Alexey Melnikov
Bernie Hoeneisen
Keyword(s): Cryptography, Encryption, Signature, Usability, MIME, Confidentiality, Integrity, Authenticity

Latest version of IETF RFC 9787

Document Versions — IETF RFC 9787

▶ IETF RFC 9787 (2025-08-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2119 [Active*]
IETF RFC 3156 [Active*]
IETF RFC 4289 [Active*]
IETF RFC 5890 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 8551 [Active*]
IETF RFC 9598 [Active*]
IETF RFC 9788 [Active*]

Bibliographic Reference(s)

IETF.draft-dkg-mail-cleartext-copy-01 — I-D.dkg-mail-cleartext-copy EXTERNAL
IETF.draft-ietf-jmap-smime-sender-extensions-04 — I-D.ietf-jmap-smime-sender-extensions EXTERNAL
IETF.draft-koch-openpgp-webkey-service-20 — I-D.koch-openpgp-webkey-service EXTERNAL
IETF.draft-woodhouse-cert-best-practice-01 — I-D.woodhouse-cert-best-practice EXTERNAL
IETF.draft-wussler-openpgp-forwarding-00 — I-D.wussler-openpgp-forwarding EXTERNAL
ISBN.9780471117094 — 7. Menezes A. van Oorshot P. Vanstone S. , Handbook of Applied Cryptography , CRC Press , 1997 . EXTERNAL
Ising, F., Poddebniak, D., Kappert, T., Saatjohann, C., and S. Schinzel, "Content-Type: multipart/oracle - Tapping into Format Oracles in Email End-to-End Encryption", Proceedings of the 32nd USENIX Security Symposium (USENIX Security 23), pp. 4175-4192, August 2023, <https://www.usenix.org/conference/usenixsecurity23/presentation/ising>. EXTERNAL
Autocrypt Team, "Autocrypt - Convenient End-to-End Encryption for E-Mail", <https://autocrypt.org/>. EXTERNAL
Aviram, N., Schinzel, S., Somorovsky, J., Heninger, N., Dankel, M., Steube, J., Valenta, L., Adrian, D., Halderman, J. A., Dukhovni, V., Käsper, E., Cohney, S., Engels, S., Paar, C., and Y. Shavitt, "DROWN: Breaking TLS using SSLv2", Proceedings of the 25th USENIX Security Symposium (USENIX Security 16), pp. 689-706, August 2016, <https://drownattack.com/drown-attack-paper.pdf>. EXTERNAL
Müller, J., Brinkmann, M., Poddebniak, D., Böck, H., Schinzel, S., Somorovsky, J., and J. Schwenk, ""Johnny, you are fired!" - Spoofing OpenPGP and S/MIME Signatures in Emails", Proceedings of the 28th USENIX Security Symposium (USENIX Security 19), pp. 1011-1028, August 2019, <https://www.usenix.org/system/files/sec19-muller.pdf>. EXTERNAL
Schechter, E., "Evolving Chrome's security indicators", Chromium Blog, May 2018, <https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html>. EXTERNAL
Poddebniak, D., Dresen, C., Müller, J., Ising, F., Schinzel, S., Friedberger, S., Somorovsky, J., and J. Schwenk, "Efail: Breaking S/MIME and OpenPGP Email Encryption using Exfiltration Channels", Proceedings of the 27th USENIX Security Symposium (USENIX Security 18), pp. 549-566, August 2018, <https://www.usenix.org/conference/usenixsecurity18/presentation/poddebniak>. EXTERNAL
Bong, D., Ed. and T. Cox, Ed., "PKCS #11 Specification Version 3.1", OASIS Standard, July 2023, <https://docs.oasis-open.org/pkcs11/pkcs11-spec/v3.1/os/pkcs11-spec-v3.1-os.html>. EXTERNAL
Felsch, D., Grothe, M., Schwenk, J., Czubak, A., and M. Szymane, "The Dangers of Key Reuse: Practical Attacks on IPsec IKE", Proceedings of the 27th USENIX Security Symposium, pp. 567-583, August 2018, <https://www.usenix.org/system/files/conference/usenixsecurity18/sec18-felsch.pdf>. EXTERNAL
IETF RFC 1939 [Active*]
IETF RFC 2045 [Active*]
IETF RFC 3207 [Active*]
IETF RFC 3274 [Active*]
IETF RFC 3370 [Active*]
IETF RFC 4511 [Active*]
IETF RFC 5322 [Active, Amended*]
IETF RFC 6376 [Active*]
IETF RFC 6409 [Active*]
IETF RFC 6532 [Active*]
IETF RFC 7292 [Active*]
IETF RFC 7435 [Active*]
IETF RFC 7929 [Active*]
IETF RFC 8162 [Active*]
IETF RFC 8621 [Active*]
RFC8823 — RFC8823 EXTERNAL
IETF RFC 9051 [Active*]
IETF RFC 9216 [Active*]
RFC9219 — RFC9219 EXTERNAL
IETF RFC 9580 [Active*]
W3C.CRD-mixed-content.20230223 — MIXED-CONTENT EXTERNAL
W3C.sri.20160623 — SRI EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9787.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9787, Guidance on End-to-End Email Security. Available at https://doi.org/10.17487/RFC9787

Snippet:

IETF RFC 9787, Guidance on End-to-End Email Security. Available at https://doi.org/10.17487/RFC9787

HTML (ISO 690 compliant)

Preview:

IETF RFC 9787, Guidance on End-to-End Email Security. Available at https://doi.org/10.17487/RFC9787

Snippet:

<span class="citation"><cite>IETF RFC 9787</cite>, Guidance on End-to-End Email Security. Available at <a href="https://doi.org/10.17487/RFC9787" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9787</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9787, Guidance on End-to-End Email Security
doi: 10.17487/RFC9787
url: https://doi.org/10.17487/RFC9787

Snippet:

<li>
<cite id="bib-rfc9787">IETF RFC 9787</cite>, Guidance on End-to-End Email Security
<span class="doi">10.17487/RFC9787</span>
</li>

Referenced By

IETF RFC 9788 [Active*]