Standards
Every standard, and where Herald uses it
Email works because everyone speaks the same protocols. Herald implements them as they’re written, so your mail is understood, authenticated and trusted wherever it lands.
Sending
| Standard | What it is | In Herald |
|---|---|---|
| RFC 5321 | Simple Mail Transfer Protocol | Delivery, submission and the MX |
| RFC 5322 | Internet Message Format | Every message Herald composes; its header policy |
| RFC 2045–2049 | MIME | Multipart messages, attachments and inline images |
| RFC 6531 | SMTPUTF8 | Internationalised addresses |
| RFC 5890 | IDNA | Domains compared as A-labels; mixed-script look-alikes flagged |
| RFC 6409 | Message submission | SMTP on 587 |
| RFC 8314 | Implicit TLS for submission | SMTP on 465 |
| RFC 3207 | STARTTLS | Required on 587; always tried when delivering |
| RFC 4954 | SMTP AUTH | Your API key as the password, only after TLS |
Authentication
| Standard | What it is | In Herald |
|---|---|---|
| RFC 6376 | DKIM | Every message signed for your domain, and for Herald’s |
| RFC 8463 | Ed25519 for DKIM | A second, modern signature, if you choose |
| RFC 7208 | SPF | Aligned through the return path; checked on mail Herald receives |
| RFC 7489 | DMARC | Aligned by design; required for Proclamations; checked on inbound |
| RFC 8617 | ARC | Checked on mail Herald receives |
| RFC 8601 | Authentication-Results | What the MX found, recorded with each inbound message |
Transport security
Unsubscribes, bounces and complaints
| Standard | What it is | In Herald |
|---|---|---|
| RFC 8058 | One-click unsubscribe | On every Proclamation, recorded before the answer |
| RFC 2369 | List-Unsubscribe and friends | On every Proclamation |
| RFC 2919 | List-Id | On every broadcast |
| RFC 3464 | Delivery status notifications | Late bounces, matched by Herald’s own token |
| RFC 3463 | Enhanced status codes | How a bounce is classed |
| RFC 5965 | Abuse reporting format | Complaints from enrolled feedback loops only |
| RFC 3834 | Automatic responses | Out-of-office replies are never counted as bounces |
The API
| Standard | What it is | In Herald |
|---|---|---|
| RFC 9110 | HTTP semantics | The REST API |
| RFC 9457 | Problem details | Every error, with Resend’s names alongside |
| RFC 6750 | Bearer tokens | API keys in the Authorization header |
| OpenAPI 3.1 | API description | Generated from the schemas that check each request |
| Standard Webhooks | Signed webhooks | Every webhook signed, with Svix’s header names too |
| RateLimit fields | Rate limit headers (IETF draft) | On every response |
| RFC 9116 | security.txt | Where to report a weakness |
Cryptography and sign-in
| Standard | What it is | In Herald |
|---|---|---|
| WebAuthn | Passkeys | The only way into Console and Backoffice |
| RFC 9180 | HPKE | Inbound mail sealed to its project on arrival |
| NIST SP 800-38D | AES-256-GCM | Each project’s data, under its own key |
| RFC 2104 | HMAC | Tokens, API key hashes and webhook signatures |
| RFC 9106 | Argon2id | Recovery codes |