Visual RFC.
ALL RFCs / RFC 3848
Read the RFC ↗
RFC 3848 / MAIL TRANSMISSION TRACE

Record successful authentication with the A suffix

02

SMTP AUTH is the extension used to authenticate a client to a receiving server. ESMTPA records that this authentication succeeded on the ESMTP hop.

DIAGRAMRead RFC section 1 ↗
RFC 3848 · § 1EXAMPLE
3 / 3
Record successful authentication with the A suffixThree separate AUTH evidence cases. Advertised AUTH alone does not add A. Successful SMTP AUTH returns2352.7.0 and an ESMTP hop without STARTTLS property uses ESMTPA. Separate5355.7.8 invalid-credential failure without either property yields ESMTP on a hypothetical accepted reception, not advice to accept failed-auth mail. AUTH success identifies a client to the receiver, not automatically the message From author. No secrets are shown.A records successful client authenticationClientReceiving relay535 5.7.8 · invalid credentialsESMTPSeparate case: no successful AUTH or TLSIf this reception is accepted, no A suffixNot advice to accept failed-auth mail
03
Keep the suffix off after failure.

A separate AUTH attempt returned 535 5.7.8. On this hypothetical accepted ESMTP reception with no successful AUTH and no STARTTLS, the type remains ESMTP. This is not advice to accept failed-authentication mail.

Source for this drawing: RFC 3848 · Read RFC section 1 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

RFC 5321 SMTP RFC 5322 Email message format RFC 3207 SMTP STARTTLS

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Advertising or attempting AUTH is not successful authentication.

  • ESMTPA means ESMTP with successful SMTP AUTH, not merely an AUTH keyword in an EHLO reply.
  • Current AUTH RFC 4954 §4 specifies 235 on successful authentication; 535 is the invalid-credentials failure. Its §7 says a server SHOULD use ESMTPA or ESMTPSA when appropriate after success.
  • The authenticated client identity is not automatically the identity asserted in the message From field. No credential values are shown.
DETAILS

These are separate successful and failed examples, not an instruction to retry credentials.

Read the RFC section ↗

All chapters in RFC 3848

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗