IETF Breaks the Logjam on Broken Email Attachments

23 October 2026

Two decades after RFC 2183 standardized the Content-Disposition header to carry presentation information for email parts, the IETF has finally published a universal encoding scheme for non-ASCII attachment filenames. What took so long, and what still remains broken? Read on for the need-to-know.

From SMTP to MIME Content-Disposition

Email began with plain text in the 70s, but as attachments and international characters became ubiquitous, the 1990s saw a series of revisions that aimed to add structure to email. Chief among these: MIME, which introduced the Content-Type and Content-Disposition headers. Content-Type described the format of an email part, while Content-Disposition declared its disposition—whether it was inline, an attached file, or something else.

RFC 2183, published in August 1997, specified that the Content-Disposition header should carry a disposition-type of "inline" or "attachment", and a filename parameter to suggest a name for the file. At first glance, this would be the solution for broken attachment filenames. Here’s where one of the core bugs lies: RFC 2183 restricted filenames to US-ASCII, making it impossible to encode filenames using more than the standard Roman alphabet.

So how have we worked around restricting filenames to ASCII? That Filippos Filippakis blog post sums it up nicely. Later internet standards introduced "parameter values and parameter value continuations", a way to encode non-ASCII attachment filenames.

This is where it starts to get messy; this turns filename handling into a mess. The long and short of it is: in RFC 2231, filenames can be encoded using "standard syntax" like filename*0=blah. Instead, though, many systems use "encoded word" in the Content-Type. Real-world tests (see updates from 2016, 2021, and IETF’s work on the matter) reveal these practices remain incompatible with widespread email clients.

The stark age gap: What’s left to fix?

It's now 30 years later, and enterprise software is still struggling with RFC compatibility issues: See IBM’s JVM support for Outlook, which reasons about TODO? RFC 5987 would lead to Outlook showing only percent‑encoded filenames. The proposed solution was to serve encoding for both, which might sound cooperative—but is only a Band-Aid.

The real heart of the problem? Non-ASCII filename encoding is an implied layer of MIME rather than something with a specified endpoint and feedback cycle.

What’s next for email’s attachment file formatting?

The IETF’s RFC 4130bis team provides current server behavior guidelines. Beyond the header fields and their RFC 2231 limits, you can expect restrictions on number of attachments with filenames. Filenames can't be directories, likewise. Filenames can be up to 255 characters—with limitations still in place.

As ever, the guiding principle is: