Visual RFC.
ALL RFCs / RFC 9116
Read the RFC ↗
RFC 9116 / SECURITY.TXT DISCLOSURE CONTACTS

Parse field lines and required information

02

The file is a sequence of named fields. Each field has a name, a colon, a space and a value on its own line. A parser checks the format before it treats the content as reporting information.

RFC 9116 · § 2EXAMPLE
3 / 3
Parse field lines and required informationThree complete small unsigned file fixtures illustrate line records. First, a comment precedes one Contact and exactly one Expires. Second, case-insensitive lowercase names preserve those required fields while unsupported X-Example is ignored. Third, duplicate Expires records make the fixture invalid despite valid-looking timestamps. These are static stepped field-anatomy scenes, not a network exchange or a claimed full ABNF parser.Each record has its own lineContact: mailto:security@example.comExpires: 2026-11-01T00:00:00ZExpires: 2026-12-01T00:00:00ZINVALID: two Expires recordsExpires MUST NOT appear more than onceDo not choose one and hide the conflict
03
Reject a repeated Expires field.

An otherwise plausible file with two Expires records violates the exactly-once rule. Do not silently choose the later timestamp.

Source for this drawing: RFC 9116 · Read RFC section 2 ↗

Protocol participantThreat or exceptionProtocol controlSimplified drawings · precise section references
New to this? Start hereA quick picture + helpful background

A message needs an address.

Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.

Helpful first, if these ideas are unfamiliar

These pictures are analogies to help you learn. The linked RFC explains the actual rules.

Terms in this drawing
Field
One named record, written as name: value.
Extension
An additional optional field; an unsupported reader must ignore it.
Related RFCs and changes

“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.

KEY POINT

Contact MUST be present at least once. Expires MUST be present exactly once. Each field MUST be on its own line; field names are case insensitive.

  • Contact MUST be present at least once. Expires MUST be present exactly once. Each field MUST be on its own line; field names are case insensitive.
  • Every line MUST end in CRLF or LF. Lines beginning with # are comments, and blank lines are allowed. The ABNF in section 4 defines the complete format.
  • Unless a field definition allows it, multiple values MUST NOT be chained in a single field. Unless otherwise stated, fields may repeat; Expires and Preferred-Languages cannot repeat.
  • Researchers MUST ignore fields they do not explicitly support. A new extension is optional, not a reason to discard an otherwise valid file.
  • The order of different field types is not important. Repeated Contact fields are the important ordering exception: their order SHOULD express preference. Verified erratum 6946 corrects the grammar comment to point to section 2.5.3.
DETAILS

The drawings show complete small unsigned fixtures. The valid examples each contain Contact and one Expires. The invalid example repeats Expires even though both timestamps look well formed. The examples use uppercase Z and CRLF or LF without claiming to resolve merely reported errata 7264 or 7743. The regression parser is a bounded fixture check, not a complete ABNF implementation.

Read the RFC section ↗

All chapters in RFC 9116

Drawing view

Scroll the drawing to see every part. Playback controls stay above it.

RFC 9700 / CHAPTERS

Chapters

For full details, tables, algorithms, and exceptions, read the original RFC.

RFC status and corrections ↗