The SYS and AUTH POP Response Codes
Extracted elements (13)
RFC 2449's IN-USE and LOGIN-DELAY response codes were insufficient because clients could not determine whether an unrecognized error required new user credentials or merely a retry; some clients resorted to parsing free-text error strings from known servers to infer mailbox-lock status.
The SYS/TEMP vs SYS/PERM hierarchy distinguishes transient system failures (retry silently) from permanent ones (alert user and contact support), enabling clients to give appropriate user experience without exposing credential-unrelated failures as authentication errors.
The AUTH-RESP-CODE capability provides a guarantee to clients: if the server advertises AUTH-RESP-CODE, the client can be certain that any -ERR without the AUTH code is not a credential problem, enabling unambiguous determination of whether to prompt for new credentials.
It is strongly RECOMMENDED that servers not issue the AUTH response code in response to the USER command, to avoid confirming the existence of a user account.
Servers that include the AUTH response code with any authentication failure SHOULD support the CAPA command and SHOULD include the AUTH-RESP-CODE capability in the CAPA response, to assure clients that only AUTH-coded errors are credential-related.
The SYS response code is valid with an -ERR response to any POP3 command.
SYS/PERM signals a system problem unlikely to resolve without intervention, such as corrupted mailboxes or configuration errors; the user should be alerted and directed to support personnel.
SYS/TEMP signals a temporary system problem (e.g., locked resource, insufficient memory) where no immediate user alarm is necessary unless the failure persists.
The AUTH-RESP-CODE capability (CAPA tag: AUTH-RESP-CODE, no arguments) indicates that the server includes the AUTH response code with every authentication error caused by a problem with user credentials. It can be announced in both AUTHORIZATION and TRANSACTION states with no difference.
The AUTH response code informs the client that the failure is due to a problem with user credentials, covering incorrect passwords, unknown usernames, expired accounts, policy violations, and similar authentication issues. It is valid with -ERR responses to AUTH, USER, PASS, or APOP commands.
The SYS response code indicates that a POP3 failure is due to a system error rather than user credentials or an external condition. It is hierarchical with two sub-codes: SYS/TEMP for likely transient problems and SYS/PERM for problems requiring intervention. Case is not significant at any level.
IANA has added the AUTH-RESP-CODE capability to the POP3 capabilities list established by RFC 2449, and has added the SYS and AUTH response codes to the POP3 response codes list also established by RFC 2449.
Returning the AUTH response code to the USER command reveals to the client that the specified username exists, constituting an information disclosure. It is strongly RECOMMENDED that the server not issue the AUTH response code in reply to the USER command.