Engineering · Standards
Standards kept.Gaps named.
Every protocol FOLD speaks is defined in an RFC. This page lists the ones a mail client is measured by and says, for each, what the code does today: implemented, partly implemented, open, or deliberately left out, and why.
Checked against the code on 2026-09-23
- Implemented
- 58
- Implemented and in use.
- Partial
- 8
- Part of it works; the note says which part.
- Open
- 10
- Not implemented yet.
- Deliberately not
- 6
- Deliberately not implemented; the note gives the reason.
Message format
How a message is built, read and shown.
| RFC | Standard | Status | In FOLD |
|---|---|---|---|
| RFC 5322 | Internet Message Format | Implemented | Strict when writing; when reading, tolerant of bare line feeds, 8-bit headers and date variants. |
| RFC 2045-2049 | MIME | Implemented | FOLD downloads the whole message and builds the MIME tree on the device. |
| RFC 2047 | MIME Encoded-Words | Implemented | Non-ASCII text in headers, decoded and encoded. |
| RFC 2231 | MIME Parameter Value and Encoded Word Extensions | Partial | Long and non-ASCII file names are read; FOLD does not yet write them in this form when sending. |
| RFC 2183 | Content-Disposition | Implemented | Inline versus attachment, and the file name. |
| RFC 2387 | multipart/related | Implemented | Messages with embedded images, read and written. |
| RFC 2392 | Content-ID and Message-ID URLs | Implemented | cid: links to embedded images resolve inside the message. |
| RFC 6532 | Internationalized Email Headers | Implemented | UTF-8 headers are always read; FOLD writes them only for international addresses and only when the server offers SMTPUTF8 or UTF8=ACCEPT.since 2026-09-21 |
| RFC 3676 | The Text/Plain Format and DelSp Parameters | Open | format=flowed text is not reflowed yet, and FOLD does not send it. |
| RFC 2369 | List Commands in Header Fields | Implemented | List-Unsubscribe as an action: FOLD sends the mail request itself, web links open in the browser. |
| RFC 2919 | List-Id | Implemented | Recognises mailing lists, so their typical signature breaks are not shown as forgeries. |
| RFC 8058 | One-Click Unsubscribe | Open | The header is recognised, but FOLD does not send the one-click request; unsubscribing uses mail or the web page. |
| RFC 8098 | Message Disposition Notification | Partial | FOLD can request a read receipt when sending, but deliberately never sends one. |
Reading and syncing (IMAP)
FOLD asks the server what it supports, again after login, and switches each extension on only when the server announces it, with a fallback to the plainer way.
| RFC | Standard | Status | In FOLD |
|---|---|---|---|
| RFC 3501 | IMAP4rev1 | Implemented | The baseline every server supports, including STARTTLS without a cleartext fallback. |
| RFC 9051 | IMAP4rev2 | Deliberately not | Recognised, not enabled: no server in the target group requires it; FOLD uses the rev1 extensions instead. |
| RFC 2177 | IDLE | Implemented | FOLD keeps IDLE on each account's inbox and renews it every 25 minutes; other folders are polled, on iPhone and iPad only while the app is open. |
| RFC 4315 | UIDPLUS | Implemented | UID EXPUNGE, so FOLD only ever removes its own messages. |
| RFC 6851 | MOVE | Implemented | With COPY and EXPUNGE as fallback; after a MOVE FOLD checks what stayed in the source. |
| RFC 7162 | CONDSTORE and QRESYNC | Implemented | Incremental sync including VANISHED (EARLIER). |
| RFC 5161 | ENABLE | Implemented | A switch counts only after the server confirms it with ENABLED. |
| RFC 6154 | SPECIAL-USE | Implemented | Folder roles come from the server's marks, common names serve only as a fallback, and missing folders are created with their role. |
| RFC 9208 | QUOTA | Implemented | Mailbox usage shown on the Mac. |
| RFC 7888 | LITERAL+ and LITERAL- | Implemented | Fewer round trips when uploading. |
| RFC 4959 | SASL-IR | Implemented | Login in one round trip. |
| RFC 5530 | IMAP Response Codes | Implemented | A wrong password and a temporarily unavailable server are told apart. |
| RFC 4731 | ESEARCH | Implemented | Compact results for the server search on iPhone and iPad; servers without ESEARCH get classic SEARCH.since 2026-09-21 |
| RFC 5258 | LIST-EXTENDED | Implemented | Folders and their roles in one command.since 2026-09-21 |
| RFC 5819 | LIST-STATUS | Implemented | Folder counters in the same LIST, without selecting each folder.since 2026-09-21 |
| RFC 6855 | UTF8=ACCEPT | Implemented | UTF-8 folder names and headers; switches the folder name encoding in one place.since 2026-09-21 |
| RFC 2342 | NAMESPACE | Open | The capability is recognised, but the command is never sent. |
| RFC 2971 | ID | Open | Some Yahoo servers want it before login. |
| RFC 4978 | COMPRESS=DEFLATE | Open | Deferred: it needs a partial flush that Apple's Compression framework lacks; zlib directly is the planned way. |
| RFC 8474 | OBJECTID | Open | Stable IDs across renames; not used yet. |
| RFC 8970 | PREVIEW | Open | Previews are built on the device from the loaded message. |
| RFC 8508 | REPLACE | Open | Drafts are saved on the device while writing and uploaded once when the composer closes; an earlier server copy is not replaced. |
| RFC 3516 | BINARY | Deliberately not | Not needed: FOLD decodes the MIME tree itself. |
| RFC 5256 | SORT and THREAD | Deliberately not | FOLD builds conversations locally from References and In-Reply-To, the same on every server. |
| RFC 5465 | NOTIFY | Deliberately not | Hardly any server in the target group offers it. |
Sending (SMTP)
How FOLD hands a message to your server.
| RFC | Standard | Status | In FOLD |
|---|---|---|---|
| RFC 5321 | Simple Mail Transfer Protocol | Implemented | Including correct dot-stuffing. |
| RFC 6409 | Message Submission for Mail | Implemented | Always with login before sending, on port 587 or 465. |
| RFC 4954 | SMTP Service Extension for Authentication | Implemented | Login with an initial response, and a clean abort when a method fails. |
| RFC 1870 | SIZE | Implemented | The size is announced when the server names a limit, and a message above it is refused before upload. |
| RFC 2920 | PIPELINING | Implemented | Sender and recipients in groups; DATA only after every envelope answer, so a message goes to all recipients or none.since 2026-09-21 |
| RFC 6152 | 8BITMIME | Implemented | Declared when the message contains 8-bit data; without server support FOLD does not send 8-bit.since 2026-09-21 |
| RFC 6531 | SMTPUTF8 | Implemented | International addresses and UTF-8 headers; if the server lacks it, FOLD stops with a clear message.since 2026-09-21 |
| RFC 3463 | Enhanced Mail System Status Codes | Implemented | Rejections are explained in plain words instead of a server code (with RFC 2034).since 2026-09-21 |
| RFC 3461 | Delivery Status Notifications | Open | Delivery reports on request are not implemented. |
| RFC 3030 | CHUNKING (BDAT) | Deliberately not | Recognised, not used; DATA covers every case. |
| RFC 8689 | REQUIRETLS | Deliberately not | Almost no server supports it yet. |
Connection and sign-in
Encryption of the connection, login methods and automatic setup.
| RFC | Standard | Status | In FOLD |
|---|---|---|---|
| RFC 8314 | Cleartext Considered Obsolete | Implemented | FOLD never connects without TLS and prefers implicit TLS where DNS offers both. |
| RFC 3207 | SMTP over TLS (STARTTLS) | Implemented | If the server does not offer STARTTLS, FOLD stops instead of sending in cleartext. |
| RFC 7817 | TLS Server Identity Check for Email | Implemented | Certificate chain and host name are checked by the system against the configured server. |
| RFC 4422 | SASL | Implemented | Framework for every login method below. |
| RFC 7677 | SCRAM-SHA-256 | Partial | Preferred for sending (SMTP), with a check of the server signature; IMAP sign-in still uses PLAIN. |
| RFC 4616 | PLAIN | Implemented | Only inside TLS, never in cleartext (deliberately stricter than the RFC). |
| RFC 6749 | OAuth 2.0 | Implemented | Sign-in with Google; XOAUTH2 for IMAP and SMTP, the method the large providers use. |
| RFC 7636 | PKCE | Implemented | For every OAuth sign-in, only S256; no client secret in the app. |
| RFC 8252 | OAuth 2.0 for Native Apps | Implemented | Sign-in in the system browser, never in an embedded web view. |
| RFC 7628 | OAUTHBEARER | Open | No provider in the target group requires it; XOAUTH2 covers them. |
| RFC 6186 | SRV Records for Email Submission and Access | Implemented | One of the sources for automatic setup. |
Encryption and signatures
S/MIME and OpenPGP, and the building blocks behind them.
| RFC | Standard | Status | In FOLD |
|---|---|---|---|
| RFC 5652 | Cryptographic Message Syntax | Implemented | The container format of S/MIME, own implementation on iPhone and iPad, the system's on the Mac. |
| RFC 8551 | S/MIME 4.0 | Partial | Sign, verify, encrypt and decrypt with RSA certificates and AES-CBC; AES-GCM, which S/MIME 4.0 requires, is not supported yet. |
| RFC 1847 | Security Multiparts for MIME | Implemented | The envelope of signed and encrypted mail. |
| RFC 3565 | AES in CMS | Implemented | AES for S/MIME encryption. |
| RFC 5754 | SHA-2 in CMS | Implemented | SHA-256 and stronger for S/MIME signatures. |
| RFC 5280 | X.509 Certificates | Implemented | Certificate paths are checked by the system's trust evaluation; revocation checks are optional. |
| RFC 9580 | OpenPGP | Partial | Version 4 keys (Ed25519, Curve25519, RSA) with AES-256 and an integrity check, tested against gpg; version 6 keys and AEAD encryption are not supported yet. |
| RFC 6637 | Elliptic Curve Cryptography in OpenPGP | Implemented | Curve25519 encryption keys, the format FOLD creates and uses. |
| RFC 3156 | MIME Security with OpenPGP | Implemented | PGP/MIME for signed and encrypted mail. |
| RFC 3394 | AES Key Wrap | Implemented | Wraps the session key for Curve25519 recipients. |
| RFC 7253 | OCB Authenticated Encryption | Implemented | Own implementation on top of the system AES, checked against the RFC test vectors; used to read GnuPG's OCB-encrypted messages. |
| RFC 9106 | Argon2 | Implemented | Key derivation of Fortress Mode, checked against the RFC test vector. |
| RFC 7693 | BLAKE2 | Implemented | Inside Argon2, own implementation checked against openssl. |
| RFC 5869 | HKDF | Implemented | From CryptoKit, for Fortress Mode. |
Sender authenticity
How FOLD checks who really sent a message.
| RFC | Standard | Status | In FOLD |
|---|---|---|---|
| RFC 6376 | DKIM Signatures | Implemented | Verified on the device: body hash and signature recomputed. |
| RFC 8463 | Ed25519 for DKIM | Implemented | Checked against the example message from the RFC. |
| RFC 8301 | DKIM Crypto Algorithm Usage | Implemented | Keys under 1024 bits and rsa-sha1 signatures are rejected. |
| RFC 8601 | Authentication-Results | Partial | Only results stamped under the account's IMAP host name are trusted; providers that use another name, Gmail among them, yield no result yet. |
| RFC 7489 | DMARC | Partial | FOLD uses the DMARC result your server recorded and checks alignment itself; the published policy is looked up only before showing a brand logo. |
| RFC 7208 | SPF | Partial | SPF needs the sending IP address; FOLD reads the result your server recorded. |
| BIMI | Brand Indicators for Message Identification (Internet-Draft) | Implemented | Logo only after DMARC passed under an enforcing policy and with a verified mark certificate; fetched once per message and stored with it. |
| RFC 9399 | Logotypes in X.509 Certificates | Implemented | The brand logo is taken from the verified mark certificate. |
Method
How this page is kept
The status comes from FOLD's conformance rules and an audit of the mail stack against the RFCs. Every row is checked against the source code before it appears here, and the page changes when the code does. The code cites 95 different RFCs in total; this page shows the ones that decide how well a mail client works with real servers.