Email Industry Tech Update – RFC 9788: A New Era for S/MIME and PGP Headers

The publication of RFC 9788, “Header Protection for Cryptographically Protected Email,” on August 22, 2025, is poised to have a significant, albeit nuanced, impact on the email ecosystem. The new standard, which updates RFC 8551, directly addresses long-standing issues with metadata exposure and ambiguities when messages are protected using S/MIME or OpenPGP.

This RFC defines a mechanism for protecting headers that have historically been exposed in cryptographically protected emails. The goal is to ensure that critical metadata, like the subject line, remains confidential and is not inadvertently modified in transit. This is a crucial step for maintaining the integrity and security of end-to-end encrypted email communications.

Some Key Takeaways for Email Geeks

The new standard has several important implications for various players in the email space:

• Email Clients (MUAs): Email client developers will need to update their software to correctly handle the new header-protection method. This will be a key factor in ensuring seamless interoperability and proper rendering of signed and encrypted messages.
• Gateways and Security Solutions: Email gateways that perform wrapping or transformation of message headers will need to align with RFC 9788’s requirements. This change is essential to prevent breaking cryptographic signatures and to ensure that the original message integrity is preserved.
• Archiving and Journaling Systems: Businesses that rely on email archiving and journaling for compliance must verify that their systems can correctly preserve both the outer headers (which are still visible) and the new validation context provided by the RFC. This is critical for eDiscovery and regulatory compliance.
• DMARC and ARC: The new RFC does not alter how DMARC (Domain-based Message Authentication, Reporting, and Conformance) or ARC (Authenticated Received Chain) work with the outer, visible headers of a message. However, the client-side rendering and signature validation pathways may see some changes.

Actionable Recommendations for the community

Take proactive steps to prepare for the rollout and adoption of RFC 9788.

1. Educate Your Teams: Brief clients, security personnel, and engineering teams on the new standard and its relevance.
2. Conduct Testing: Implement and test your S/MIME and PGP header handling against the new specifications. This is particularly important for developers and system administrators.
3. Update Documentation: Ensure that internal and customer-facing documentation for signed and encrypted workflows reflects the changes introduced by RFC 9788.
4. Monitor Implementations: Keep an eye on how major email clients and platforms are adopting the new standard to ensure your systems remain compatible.

The publication of RFC 9788 represents a step forward in email security and privacy. While the impact is largely focused on cryptographic protection of messages, it is a testament to the ongoing work by the IETF and the email community to make a decades-old protocol more robust and fit for todays world. The new RFC is another piece in the puzzle of building a more secure and trustworthy email ecosystem for everyone.