# Accept UTF-8 headers only under internationalized mail syntax > Use RFC 6532 — Internationalized Email Headers to review this narrow operational decision without extending the source beyond its stated scope. - Canonical URL: https://update.dsesecurity.com/updates/accept-utf-8-headers-only-under-internationalized-mail-syntax/ - Publisher: Detection Systems & Engineering (DSE Security) - Author: DSE Security Editorial Team - Published: 2026-08-27T12:17:10+00:00 - Modified: 2026-08-27T12:36:15+00:00 - Last reviewed by DSE: 2026-08-26 - Resource type: Briefing - DSE priority: Advisory - Topics: Cybersecurity, Networks & Infrastructure - Reading time: 3 minutes ## What you need to know Use RFC 6532 — Internationalized Email Headers to review this narrow operational decision without extending the source beyond its stated scope. ## Potentially affected Teams, systems, services, or facilities within the stated scope of RFC 6532 — Internationalized Email Headers ## DSE recommendation Compare the observed state with the cited official source, document applicability and exceptions, and test any approved change with rollback safeguards. ## Article Use this document to resolve one bounded operational decision: Accept UTF-8 headers only under internationalized mail syntax. Only the official source and traced locations below supply facts. Confirm applicability before acting. ## Source fact: The official [RFC 6532 — Internationalized Email Headers](https://www.rfc-editor.org/rfc/rfc6532.html) from RFC Editor / Internet Engineering Task Force supports the following bounded statements: - Internationalized mail permits UTF-8 in header field bodies, while header field names remain ASCII-only. The research record locates this support at Section 3 (Changes to Message Header Fields). - UTF-8 header text should use NFC normalization and should not use NFKC when that would lose spelling distinctions. The research record locates this support at Section 3.1 (UTF-8 Syntax and Normalization). - A message/global message may be sent over SMTP only when the SMTPUTF8 extension authorizes that transport. The research record locates this support at Section 3.7 (The message/global Media Type). Only the traced statements above are asserted as source facts. Apply the review to sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling after confirming that the source and deployed context match. ## What the source does not establish This RFC evidence supports only the named mail-protocol decision; it does not prove provider support, deliverability, or compliance for a particular flow. The citation is not a substitute for observed state, authorization, compliance evidence, or dependency health. Examine authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers before translating the source into an operational decision. ## Applicability questions - For source statement 1 at Section 3 (Changes to Message Header Fields), which observable configuration, record, or test can confirm applicability here? - For source statement 2 at Section 3.1 (UTF-8 Syntax and Normalization), which observable configuration, record, or test can confirm applicability here? - For source statement 3 at Section 3.7 (The message/global Media Type), which observable configuration, record, or test can confirm applicability here? - Within sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, which versions, roles, and configuration states define the review population? - Could authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers invalidate the test, hide a failure, or change applicability? - Who owns the decision, and which observation requires stopping, escalation, or rollback? ## DSE recommendation: DSE recommends using the cited source as the evidence anchor for this decision. Begin by recording scope and current state before deciding whether a change is warranted. Record the source location, examined part of sending domains, receiving domains, message agents, headers, authentication results, policy records, and failure handling, observed and expected states, owner, and reason for deviation. Translate the conclusion into change control only after documenting dependencies, impact, test method, expected signals, failure signals, and restoration steps. Include authoritative DNS, certificates, time, gateways, identity stores, reputation services, and third-party mail providers, while excluding secrets and sensitive personal or topology data from ordinary tickets. ## Verification and evidence Build a reproducible chain from Section 3 (Changes to Message Header Fields); Section 3.1 (UTF-8 Syntax and Normalization); Section 3.7 (The message/global Media Type) to the observed environment. Useful domain evidence includes sanitized messages, DNS records, SMTP transcripts, authentication results, policy evaluation, and delivery or rejection logs; label every item with scope, timestamp, collector, and stable identifier. Close the review only when the evidence, exception handling, resulting action, and after-state are linked. Schedule a new review after material technical, organizational, incident, or source changes; today’s observation is not a continuing guarantee. ## Official references - [RFC 6532 — Internationalized Email Headers](https://www.rfc-editor.org/rfc/rfc6532.html) — RFC Editor / Internet Engineering Task Force ## Primary reference - Name: RFC 6532 — Internationalized Email Headers - Authority: www.rfc-editor.org - URL: https://www.rfc-editor.org/rfc/rfc6532.html - Source publication date: Not stated by the source ## Citation and use Preferred citation: “Accept UTF-8 headers only under internationalized mail syntax,” DSE Security, https://update.dsesecurity.com/updates/accept-utf-8-headers-only-under-internationalized-mail-syntax/ Publishing principles: https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/ Usage and citation policy: https://update.dsesecurity.com/usage/ Copyright © 2026 Detection Systems & Engineering. All rights reserved.