International mail still has to authenticate

Answer International mail still has to authenticate. RFC 8616 is about email authentication for internationalized mail, the kind of address that does not fit in the old ASCII mailbox form. The work of the document is to say how authentication is supposed to function in that world. It is not a waiver. A solo ad aimed at those addresses does not get to skip SPF, DKIM, or DMARC because the address looks unfamiliar to an English-only operator.

The note that started this: RFC 8616, Email Authentication for Internationalized Mail, RFC 8616.

Unfamiliar is where sloppy shops get brave. They strip the address, refuse the row, or mail it from a domain that has never authenticated anything and call the chaos a language strategy. If you buy solo ads on a list whose addresses use a non-ASCII form, the strategy is the same as on any other list. Name the sending domain. Show a test that authenticates. Show that the address you tested still looks like the address on the file when it arrives.

This note will not invent a failure mode for you to memorize. Internationalized mail can break in boring ways and in specific ways, and the specific ways belong in a log, not in a guessed checklist. The buyer's question is outcome-shaped. Did authentication pass on a real message, and did the mailbox display the address without corruption? If the seller cannot produce that pair, they are not ready to sell the file, whatever the RFC allows in principle.

Does an internationalized email address skip authentication?

No. RFC 8616 is about making email authentication work for internationalized mail. The point of the document is that those addresses still have to authenticate. It is not an exemption.

Making it work means the specifications for authentication have something to say when the local part or the domain contains characters the older specs did not assume. The something is not a free pass. A receiver that cares about authentication can still require a pass. A sender who cannot produce a pass is in the same hole as any other unauthenticated sender, with the added problem that their tools may be lying about why.

Ask the seller to separate tool failure from policy failure. Tool failure is their platform mangling an address so the signature no longer matches. Policy failure is a receiver refusing mail that does not authenticate. Both end in a miss. The fix is different, and a buyer should not pay the seller to confuse them. A mangled test is a reason to pause the order. A clean pass is a reason to keep talking about the list.

• The test uses an address of the same kind as the file.
• The authentication results are shown, not described from memory.
• A non-ASCII address is not called exempt.
• Mangling and refusal are written as different outcomes.

What should a buyer ask before paying for a non-ASCII list?

Ask for a test message to and from the kind of address on the file, and ask for the authentication results on that message. A pass is a pass. A story about the script is not a pass.

To and from, because both directions teach you something. Mail to a non-ASCII address shows whether their sending path can carry it. Mail from a sender name in that script shows whether the headers survive, which is a cousin problem and not a substitute. You want the authentication line on the received copy. Pass or fail, with the domain. A paragraph about supporting the world is not a line.

Also ask how many rows they dropped because the software could not store them. A file that was quietly converted to ASCII lookalikes is a different file from the one in the pitch. Lookalikes are how the wrong person gets the mail. If they converted, they should say so, and you should decide if the converted file is the file you meant to buy.

Does authenticated international mail reach the inbox?

Authentication is a check, not a placement. A pass supports a claim about the message and the domain. The mailbox provider still decides where the message goes. Ask the seller not to sell the script, or the pass, as delivery.

The script is not a charm. People ignore mail in every alphabet when the mail is not for them. Providers file mail in every alphabet when the history is bad. A pass means you cleared a check you were not allowed to skip. Clearing a check is the ordinary price of being taken seriously. It is not the product. The product is a person who can read the offer and has a reason to.

RFC 8616 keeps internationalized mail inside the authentication project. Leave it there. Another script is not a hall pass. It is a reason to test the real address before you pay for a crowd you have not seen.