SMTP Service Extension for Message Size Declaration
obsoleted by
- rfc-1870 — SMTP Service Extension for Message Size Declaration
obsoletes
- rfc-1427 — SMTP Service Extension for Message Size Declaration
Extracted elements (16)
Client-side size heuristics should be chosen so that the declared message size is usually larger than the actual message size. This makes the question of whether SMTP DATA dots are counted largely academic, since over-estimation errs on the side of caution.
The extension was created because MIME-enabled SMTP is expected to carry a much wider range of message sizes than previously, increasing demands on server resources such as disk space. Without this extension, a client only learns of size-related failures after transmitting the entire message.
A minimal client may use this extension only to compare its estimated message size against the server's advertised fixed maximum from the EHLO SIZE parameter, without ever issuing the extended MAIL command. Such a client cannot detect temporary resource limits or per-recipient limits.
A minimal server must accept the extended MAIL command and return 552 if the declared size exceeds its fixed limit, but need not detect temporary resource limitations. If the SIZE keyword is returned with no parameter, the server must check resource availability before issuing a 250 response to an extended MAIL command with a SIZE specification.
A server implementing this extension may return 452 or 552 in response to a RCPT command based on unwillingness to accept the declared message size for a particular recipient. A 452 allows the client to requeue for later delivery; a 552 means the client may not requeue for that recipient.
A server is permitted but not required to accept a message that is actually larger than declared in the extended MAIL command, as may occur when the client used an inaccurate size-estimation heuristic.
A successful 250 reply to the extended MAIL command is not an absolute guarantee that the message transfer will succeed. Clients must still be prepared to handle 452 and 552 reply codes after the DATA command or after message transfer.
If the declared message size exceeds the server's fixed maximum, the server responds with code 552. If the server currently lacks sufficient resources to accept a message of the indicated size but may be able to do so later, it responds with code 452.
On receiving a 452 response to the extended MAIL command, the client should send RSET or QUIT, then retry the message to the server at a later time. On receiving 552, the client should send RSET or QUIT and declare the message undeliverable, returning notification to the sender if a sender address was present.
Once a server has agreed via the extended MAIL command to accept a message of a particular size, it should not return a 552 reply code after the DATA transfer phase unless the actual transferred message size is greater than the declared message size.
Servers MUST NOT use the SIZE parameter to determine end of content in the DATA command.
Message size is defined as the number of octets, including CR-LF pairs, but not the SMTP DATA command's terminating dot or doubled quoting dots, transmitted by the client after receiving reply code 354 to the DATA command.
The extended MAIL command adds a SIZE parameter after the sender address. The value is a decimal representation of the declared message size in octets, including headers, body, and CR-LF sequences, but excluding the DATA terminating dot or doubled quoting dots. Only one SIZE parameter may appear in a single MAIL command.
The 'Message Size Declaration' SMTP service extension is identified by the EHLO keyword 'SIZE'. An optional decimal numeric parameter on the SIZE keyword indicates the server's fixed maximum message size in bytes; a value of 0 means no fixed maximum; omission means no information is conveyed.
The SIZE parameter and extended MAIL command make it somewhat quicker and easier to mount a service denial attack by allowing an attacker to probe server resource limits efficiently. However, unless implementations are very weak, no new vulnerability is created that did not already exist with standard SMTP.
The EHLO SIZE parameter syntax is 'size-param ::= [1*DIGIT]', representing the server's fixed maximum message size in bytes. The MAIL FROM SIZE value syntax is 'size-value ::= 1*DIGIT', a decimal octet count of the declared message size.