Netnews Article Format
obsoletes
Extracted elements (32)
Comments are prohibited in the Control, Distribution, Followup-To, Lines, Message-ID, Newsgroups, Path, Supersedes, and Xref header fields because news servers often need to process these fields very rapidly, and comment support would add parsing overhead that harms performance.
The Message-ID syntax is deliberately restricted compared to RFC 5322 because Netnews is more dependent on message identifier uniqueness and fast comparison than Email. Prohibiting comments, whitespace inside the identifier, and making id-right case-sensitive means a simple octet comparison always suffices to determine identity.
The posting-account parameter in Injection-Info SHOULD be given in a form opaque to other sites to limit personal data exposure, yet two messages from the same source SHOULD have the same value and different sources SHOULD have differing values, balancing privacy against the need for rate limiting and abuse detection.
Agents MUST accept date-time constructs that use the 'GMT' timezone zone even though it is part of RFC 5322 obsolete syntax, because its use is widespread in existing Netnews articles. Agents MUST NOT generate it.
The Netnews article format is a strict subset of RFC 5322: all conformant Netnews articles satisfy RFC 5322 syntax, but the converse is not guaranteed. Key additional restrictions are: mandatory space after ':', 250-octet msg-id limit, no comments in Message-ID, non-empty header field bodies, and acceptance of GMT timezone.
Agents conforming to this specification MUST generate only conformant articles. Articles using RFC 5322 obsolete syntax are non-conformant, with two narrow exceptions: obs-phrase constructs (which MUST NOT be generated but may appear) and the 'GMT' timezone zone.
All agents MUST generate header fields so that at least one space immediately follows the ':' separating the header field name and body, for compatibility with deployed NNTP servers. Agents MAY accept header fields lacking that space.
An article containing a Control header field MUST NOT also have a Supersedes header field.
Compliant software MUST NOT generate header field lines of more than 998 octets. Every line of a header field body (including the first and any folded lines) MUST contain at least one non-whitespace character, making empty header field bodies illegal.
Each Netnews article conformant with this specification MUST have exactly one of each of the following header fields: Date, From, Message-ID, Newsgroups, Path, and Subject.
Each of the news-specific header fields defined in this document MUST NOT occur more than once in a news article.
Implementations MUST NOT generate a Message-ID where the only difference from another Message-ID is the case of characters in the id-right part, because some software performs case-insensitive matching while others do case-sensitive matching on id-right.
Optional FWS in the Newsgroups newsgroup-list SHOULD NOT be generated because folding the Newsgroups header field over multiple lines has been shown to harm article propagation significantly, but it MUST be accepted.
Several newsgroup names are reserved and MUST NOT be used as normal newsgroup names: groups whose first component is 'example', 'to', or 'control'; groups containing 'all' or 'ctl'; the group 'poster'; and the group 'junk'.
The character set for header fields is US-ASCII. Where non-ASCII characters are required, they MUST be encoded using the MIME mechanisms defined in RFC 2047 and RFC 2231.
The Injection-Date header field MUST be inserted whenever an article is injected, but agents MUST accept articles without it (pre-standard software does not use it). Agents MUST NOT alter a pre-existing Date header field when adding Injection-Date.
The Lines header field is obsolescent: all agents SHOULD ignore it and SHOULD NOT generate it. Its historical use by the NNTP overview facility is deprecated, and it is likely to be removed entirely in a future version of this standard.
The msg-id MUST NOT be more than 250 octets in length, ensuring systems that accept message identifiers as parameters (e.g., NNTP per RFC 3977) can rely on a bounded length.
User agents MUST meet the definition of MIME conformance in RFC 2049 and MUST also support RFC 2231, providing internationalization and multimedia in message bodies and support for internationalization of header fields.
The Archive header field indicates the poster's intent regarding long-term preservation: a value of 'no' means the poster does not permit redistribution from public archives; 'yes' permits it. No parameters are currently defined.
The Control header field marks an article as a control message and specifies desired actions via a verb and optional arguments. Legal verbs and arguments are defined in RFC 5537. An article with a Control header field MUST NOT also have a Supersedes header field.
The Injection-Date header field records the date and time the article was injected into the network by a news server, enabling stale-article detection using a server-supplied timestamp rather than the user agent's composition-time Date. It replaces the deprecated NNTP-Posting-Date header.
The Injection-Info header field contains structured parameters added by the injecting news server: posting-host (FQDN/IP of origin), posting-account (opaque source identifier), logging-data (session reference), and mail-complaints-to (abuse address). Non-standard attributes MUST begin with 'x-'.
The Message-ID header field contains a unique message identifier distinguishing the article from every other article ever posted. Articles with the same message identifier are treated as identical regardless of body or header differences. Its syntax is stricter than RFC 5322 to enable fast comparison and NNTP compatibility.
The Newsgroups header field specifies one or more newsgroups to which the article is posted, as a comma-separated list of dot-separated components. Components consist of alphanumeric characters plus '+', '-', '_'; all-digit and uppercase components SHOULD NOT be used.
The Path header field records the route taken by an article since injection. Each agent that processes an article is required to prepend at least one path-identity. The diag-match '!!' indicates the left agent verified the identity of the right agent; path-diagnostic items may record IP addresses or keyword data.
The Supersedes header field contains exactly one message identifier specifying an article to be superseded upon arrival of the current article. It is equivalent to a 'cancel' control message for the specified article followed immediately by the new article without the Supersedes header.
IANA registered Netnews header fields in the Permanent Message Header Field Repository per RFC 3864. Active standard fields include: Approved, Archive, Control, Date, Distribution, Expires, Followup-To, From, Injection-Date, Injection-Info, Keywords, Message-ID, Newsgroups, Organization, Path, References, Reply-To, Sender, Subject, Summary, Supersedes, User-Agent, Xref. Deprecated/obsoleted: Lines, NNTP-Posting-Date, NNTP-Posting-Host, Date-Received, Posting-Version, Relay-Version, Also-Control, Article-Names, Article-Updates, See-Also.
Complex MIME parameter constructs exploiting the full range of encodings in RFC 2046 and RFC 2231 (e.g., tricky quoting within boundary parameters) may cause simple parsers to fail, and such parsing deficiencies may be exploited as part of an attack.
If a malicious agent can predict the message identifier of a forthcoming article, it can preempt that article by posting its own article with the same Message-ID to prevent the target from propagating. Therefore, agents generating message identifiers SHOULD ensure they are unpredictable.
The Netnews article format provides no security services such as confidentiality, sender authentication, or non-repudiation. Such services must be layered above using S/MIME (RFC 3851) or PGP/MIME (RFC 3156), or below using secure news transport protocols.
The msg-id is encoded as '<' id-left '@' id-right '>' where id-left is dot-atom-text and id-right is dot-atom-text or no-fold-literal. No comments or whitespace are permitted inside. The entire msg-id including angle brackets MUST NOT exceed 250 octets.