Header Protection for Cryptographically Protected Email

Metadata

Publisher: IETF
Doc Type: Standard
Pages: 218
Abstract: S/MIME version 3.1 introduced a mechanism to provide end-to-end cryptographic protection of email message headers. However, few implementations generate messages using this mechanism, and several legacy implementations have revealed rendering or security issues when handling such a message. This document updates the S/MIME specification (RFC 8551) to offer a different mechanism that provides the same cryptographic protections but with fewer downsides when handled by legacy clients. Furthermore, it offers more explicit usability, privacy, and security guidance for clients when generating or handling email messages with cryptographic protection of message headers. The Header Protection scheme defined here is also applicable to messages with PGP/MIME (Pretty Good Privacy with MIME) cryptographic protections.
Publication Date: 2025-08-01
Status Note: Proposed Standard
DOI: 10.17487/RFC9788
Link: https://doi.org/10.17487/RFC9788
Author(s): Daniel Kahn Gillmor
Bernie Hoeneisen
Alexey Melnikov
Keyword(s): Header Protection, Email Encryption, Encryption, Signature, S/MIME, PGP/MIME, MIME, Privacy, HP

Latest version of IETF RFC 9788

Document Versions — IETF RFC 9788

▶ IETF RFC 9788 (2025-08-01)

THIS DOC [ACTIVE] [LATEST VERSION]

Normative Reference(s)

IETF RFC 2045 [Active*]
IETF RFC 2119 [Active*]
IETF RFC 3864 [Active*]
IETF RFC 5083 [Active*]
IETF RFC 5234 [Active, Amended*]
IETF RFC 5322 [Active, Amended*]
IETF RFC 5652 [Active*]
IETF RFC 8126 [Active*]
IETF RFC 8174 [Active*]
IETF RFC 8551 [Active*]
IETF RFC 9580 [Active*]
RFC9787 — RFC9787 EXTERNAL

Bibliographic Reference(s)

IETF.draft-autocrypt-lamps-protected-headers-03 — I-D.autocrypt-lamps-protected-headers EXTERNAL
IETF.draft-pep-email-03 — I-D.pep-email EXTERNAL
IETF.draft-pep-general-03 — I-D.pep-general EXTERNAL
W3C, "Using character escapes in markup and CSS", 12 August 2010, <https://www.w3.org/International/questions/qa-escapes#use>. EXTERNAL
Lawrence, D. C., "Signing Control Messages, Verifying Control Messages", <https://www.eyrie.org/~eagle/usefor/other/pgpverify>. EXTERNAL
Schechter, E., "Evolving Chrome's security indicators", Chromium Blog, May 2018, <https://blog.chromium.org/2018/05/evolving-chromes-security-indicators.html>. EXTERNAL
UUNET Technologies, Inc., "Authentication of Usenet Group Changes", 27 October 2016, <https://ftp.isc.org/pub/pgpcontrol/>. EXTERNAL
IETF RFC 1035 [Active, Amended*]
IETF RFC 2047 [Active*]
IETF RFC 2049 [Active*]
IETF RFC 3156 [Active*]
IETF RFC 3851 [Superseded*]
IETF RFC 4021 [Active*]
IETF RFC 5751 [Superseded*]
IETF RFC 5890 [Active*]
IETF RFC 5891 [Active*]
IETF RFC 6376 [Active*]
RFC7489 — RFC7489 EXTERNAL
RFC7929 — RFC7929 EXTERNAL
RFC8162 — RFC8162 EXTERNAL
RFC8617 — RFC8617 EXTERNAL
RFC9216 — RFC9216 EXTERNAL
W3C.WD-css22.20160412 — CSS EXTERNAL

Source Data (JSON)

Full registry record with provenance metadata. Open directly: /api/doc/RFC9788.json

Reference Tree

Explore all references and references to this document, as a navigable tree.

Open Reference Tree

Reference this Doc

Plain text (ISO 690 compliant)

Preview:

IETF RFC 9788, Header Protection for Cryptographically Protected Email. Available at https://doi.org/10.17487/RFC9788

Snippet:

IETF RFC 9788, Header Protection for Cryptographically Protected Email. Available at https://doi.org/10.17487/RFC9788

HTML (ISO 690 compliant)

Preview:

IETF RFC 9788, Header Protection for Cryptographically Protected Email. Available at https://doi.org/10.17487/RFC9788

Snippet:

<span class="citation"><cite>IETF RFC 9788</cite>, Header Protection for Cryptographically Protected Email. Available at <a href="https://doi.org/10.17487/RFC9788" target="_blank" rel="noopener">https://doi.org/10.17487/RFC9788</a></span>

SMPTE's HTML Pub

Preview:

IETF RFC 9788, Header Protection for Cryptographically Protected Email
doi: 10.17487/RFC9788
url: https://doi.org/10.17487/RFC9788

Snippet:

<li>
<cite id="bib-rfc9788">IETF RFC 9788</cite>, Header Protection for Cryptographically Protected Email
<span class="doi">10.17487/RFC9788</span>
</li>