Choose contacts and read optional guidance
03Contact values are URIs: addresses with a scheme such as mailto:, tel: or https:. Several Contact lines can offer alternatives, while other fields provide policy, language and acknowledgment links.
Preferred-Languages: en, es is one field containing two equal-priority tags. Policy, Acknowledgments and Hiring point to separate optional resources.
Source for this drawing: RFC 9116 · Read RFC section 2.5.3 ↗
New to this? Start hereA quick picture + helpful background
A message needs an address.
Think of a packet as a small addressed envelope. Devices pass it onward; transport protocols decide what delivery promises an application gets.
Helpful first, if these ideas are unfamiliar
These pictures are analogies to help you learn. The linked RFC explains the actual rules.
Terms in this drawing
- URI scheme
- The prefix, such as mailto or https, that says what kind of address is used.
- Language tag
- A standardized natural-language label such as en or es, not a contact priority.
Related RFCs and changes
“Updates” changes part of an earlier RFC. “Obsoletes” replaces it. This list shows selected related documents.
Contact values MUST follow URI syntax. Web contact URIs MUST start with https://. Repeated contacts SHOULD be listed in preference order, first choice first.
- Contact values MUST follow URI syntax. Web contact URIs MUST start with https://. Repeated contacts SHOULD be listed in preference order, first choice first.
- Use mailto: for email and tel: for telephone numbers. A bare email address is not the required URI form. A percent-encoded address can contain %2B to represent a literal plus sign.
- Do not put several contact URIs into one comma-separated Contact line. Use separate Contact lines. In contrast, Preferred-Languages explicitly permits a comma-separated list of language tags.
- Preferred-Languages, when present, MUST contain at least one tag and MUST NOT repeat. The listed languages have equal priority: en, es does not rank English above Spanish. If absent, researchers may assume English.
- Policy points to disclosure practices, Acknowledgments to researcher recognition, and Hiring to security jobs. These are optional URI fields; web links MUST use HTTPS. Acknowledgments should avoid revealing information that enables future attacks.
The examples show mailto:security@example.com first and an HTTPS reporting page second. This is an organization’s chosen preference, not a rule that email always wins. Percent-decoding a URI is not HTML form decoding: do not turn every plus into a space. Language tags have different ordering semantics from Contact fields.
Read the RFC section ↗