Network Working Group M. Nottingham
Internet-Draft Cloudflare
Obsoletes: [6838, 9694] (if approved) P. Resnick
Intended status: Best Current Practice Episteme Technology Consulting
Expires: 27 September 2026 26 March 2026
Media Type Specifications and Registration Procedures
draft-ietf-mediaman-6838bis-08
Abstract
This document defines procedures for the specification and
registration of media types for use in HTTP, MIME, and other Internet
protocols.
About This Document
This note is to be removed before publishing as an RFC.
Status information for this document may be found at
https://datatracker.ietf.org/doc/draft-ietf-mediaman-6838bis/.
information can be found at https://datatracker.ietf.org/wg/mediaman/
about/.
Source for this draft and an issue tracker can be found at
https://github.com/ietf-wg-mediaman/6838bis/.
Status of This Memo
This Internet-Draft is submitted in full conformance with the
provisions of BCP 78 and BCP 79.
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
This Internet-Draft will expire on 27 September 2026.
Nottingham & Resnick Expires 27 September 2026 [Page 1]
Internet-Draft Media Type Registration March 2026
Copyright Notice
Copyright (c) 2026 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents (https://trustee.ietf.org/
license-info) in effect on the date of publication of this document.
Please review these documents carefully, as they describe your rights
and restrictions with respect to this document. Code Components
extracted from this document must include Revised BSD License text as
described in Section 4.e of the Trust Legal Provisions and are
provided without warranty as described in the Revised BSD License.
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Conventions Used in This Document . . . . . . . . . . . . 4
2. Media Type Registration Requirements . . . . . . . . . . . . 4
2.1. Functionality . . . . . . . . . . . . . . . . . . . . . . 4
2.1.1. Specification Availability . . . . . . . . . . . . . 4
2.1.2. Intellectual Property . . . . . . . . . . . . . . . . 5
2.2. Canonicalization and Interoperability . . . . . . . . . . 5
2.3. Naming . . . . . . . . . . . . . . . . . . . . . . . . . 6
2.4. Parameters . . . . . . . . . . . . . . . . . . . . . . . 7
2.5. Encoding . . . . . . . . . . . . . . . . . . . . . . . . 8
2.6. Fragment Identifiers . . . . . . . . . . . . . . . . . . 9
2.7. Security . . . . . . . . . . . . . . . . . . . . . . . . 9
2.8. Intended Usage . . . . . . . . . . . . . . . . . . . . . 10
2.9. Contact Information . . . . . . . . . . . . . . . . . . . 10
2.10. Additional Information . . . . . . . . . . . . . . . . . 11
3. Top-Level Media Types . . . . . . . . . . . . . . . . . . . . 12
3.1. Additional Top-Level Types . . . . . . . . . . . . . . . 12
3.1.1. Required Criteria . . . . . . . . . . . . . . . . . . 12
3.1.2. Additional Considerations . . . . . . . . . . . . . . 13
3.1.3. Negative Criteria . . . . . . . . . . . . . . . . . . 14
4. Media Subtypes . . . . . . . . . . . . . . . . . . . . . . . 14
4.1. Registration Trees . . . . . . . . . . . . . . . . . . . 14
4.1.1. Standards Tree . . . . . . . . . . . . . . . . . . . 15
4.1.2. Vendor Tree . . . . . . . . . . . . . . . . . . . . . 17
4.1.3. Personal Tree . . . . . . . . . . . . . . . . . . . . 17
4.1.4. Unregistered x. Tree . . . . . . . . . . . . . . . . 18
4.1.5. Additional Registration Trees . . . . . . . . . . . . 18
4.2. Structured Syntax Suffixes . . . . . . . . . . . . . . . 18
4.2.1. Use Cases . . . . . . . . . . . . . . . . . . . . . . 19
4.2.2. Fragment Identifiers and Structured Syntax
Suffixes . . . . . . . . . . . . . . . . . . . . . . 20
Nottingham & Resnick Expires 27 September 2026 [Page 2]
Internet-Draft Media Type Registration March 2026
4.2.3. Security Considerations for Structured Syntax Suffix
Processing . . . . . . . . . . . . . . . . . . . . . 20
5. Media Type Registration Procedures . . . . . . . . . . . . . 21
5.1. Preliminary Community Review . . . . . . . . . . . . . . 21
5.2. Submit Request to IANA . . . . . . . . . . . . . . . . . 21
5.3. Review and Approval . . . . . . . . . . . . . . . . . . . 22
5.4. Comments on Media Type Registrations . . . . . . . . . . 22
5.5. Change Procedures . . . . . . . . . . . . . . . . . . . . 23
5.6. Registration Template . . . . . . . . . . . . . . . . . . 23
6. Structured Syntax Suffix Registration Procedures . . . . . . 25
6.1. Change Procedures . . . . . . . . . . . . . . . . . . . . 26
6.2. Registration Template . . . . . . . . . . . . . . . . . . 26
7. Security Considerations . . . . . . . . . . . . . . . . . . . 27
8. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 27
8.1. Top-Level Types Registry . . . . . . . . . . . . . . . . 27
8.2. Recognized Standards Organisations . . . . . . . . . . . 27
8.3. Provisional Registrations . . . . . . . . . . . . . . . . 27
9. Acknowledgments . . . . . . . . . . . . . . . . . . . . . . . 28
10. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 28
11. References . . . . . . . . . . . . . . . . . . . . . . . . . 28
11.1. Normative References . . . . . . . . . . . . . . . . . . 28
11.2. Informative References . . . . . . . . . . . . . . . . . 30
Appendix A. Historical Note . . . . . . . . . . . . . . . . . . 31
Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 32
1. Introduction
Internet application protocols (including but not limited to HTTP
[RFC9110] and MIME [RFC2045]) are capable of carrying arbitrary
labeled content.
Those labels are known as media types. A media type consists of a
top-level type (Section 3) and a subtype (Section 4), which is
further structured into a tree (identified by a prefix). A subtype
can also be associated with a structured syntax (identified by
suffix). Optionally, a media type can be defined to allow companion
data, known as parameters.
Section 2 defines the criteria for registering media types.
Section 5 outlines the procedures used to do so. The location of the
media type registry is:
https://www.iana.org/assignments/media-types/
Section 6 outlines the procedures for managing the registry for
structured syntax suffixes. It is located at:
https://www.iana.org/assignments/media-type-structured-suffix/
Nottingham & Resnick Expires 27 September 2026 [Page 3]
Internet-Draft Media Type Registration March 2026
1.1. Conventions Used in This Document
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and
"OPTIONAL" in this document are to be interpreted as described in
BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all
capitals, as shown here.
This specification makes use of the Augmented Backus-Naur Form (ABNF)
[RFC5234] notation, including the core rules defined in Appendix B of
that document.
2. Media Type Registration Requirements
Media type registrations are expected to conform to various
requirements laid out in the following sections. Note that specific
requirements can vary depending on the registration tree
(Section 4.1).
Other than IETF registrations in the standards tree, the registration
of a media type does not imply endorsement, approval, or
recommendation by the IANA or the IETF, and does not indicate that
the specification is adequate for any particular purpose.
Additional requirements specific to the registration of XML media
types are specified in [RFC7303].
2.1. Functionality
Media types MUST function as actual media formats. Registration of
things that are better thought of as a transfer encoding, as a
charset, or as a collection of separate entities of another type, is
not allowed. For example, although applications exist to decode the
base64 transfer encoding [RFC2045], base64 cannot be registered as a
media type.
This requirement applies regardless of the registration tree
involved.
2.1.1. Specification Availability
A permanent and readily available public specification of the format
for the media type MUST exist for all types registered in the
standards tree. This specification needs provide sufficient detail
so that interoperability between independent implementations using
the media type is possible. If not part of the media type
registration proposal, this specification needs to be referenced by
it.
Nottingham & Resnick Expires 27 September 2026 [Page 4]
Internet-Draft Media Type Registration March 2026
A specification need not be publicly available for media types
registered in the vendor and personal trees. Note, however, that the
public availability of a specification will often make the difference
between having a name reserved and having the potential for useful
interoperation.
2.1.2. Intellectual Property
The registration of media types involving patented technology is
permitted. However, the restrictions set forth in BCP 79 [RFC8179]
and BCP 78 [RFC5378] on the use of patented technology in IETF
Standards Track protocols must be respected when the specification of
a media type is part of a Standards Track protocol. In addition,
other standards-related organizations making use of the standards
tree may have their own rules regarding intellectual property that
must be observed in their registrations.
Intellectual Property Rights (IPR) disclosures for registrations in
the vendor and personal trees are encouraged but not required.
Copyright on the registration template MUST allow the IANA to copy it
into the IANA registry.
2.2. Canonicalization and Interoperability
All registered media types MUST employ a single, canonical data
format, regardless of registration tree.
Ideally, media types will be defined so they interoperate across as
many systems and applications as possible. However, some media types
will inevitably have problems interoperating across different
platforms. For example, problems with different versions, byte
ordering, and specifics of gateway handling can arise.
Universal interoperability of media types is not required, but known
interoperability issues should be identified whenever possible.
Publication of a media type does not require an exhaustive review of
interoperability, and the interoperability considerations section is
subject to continuing evaluation.
Universal support and implementation of a media type are NOT a
requirement for registration.
The recommendations in this subsection apply regardless of the
registration tree involved.
Nottingham & Resnick Expires 27 September 2026 [Page 5]
Internet-Draft Media Type Registration March 2026
2.3. Naming
All registered media types MUST be assigned top-level type and
subtype names. The combination of these names serves to uniquely
identify the media type, and the subtype name facet (or the absence
of one) identifies the registration tree. Both top-level type and
subtype names are case-insensitive.
Type and subtype names MUST conform to the following ABNF:
type-name = restricted-name
subtype-name = restricted-name
restricted-name = restricted-name-first *126restricted-name-chars
restricted-name-first = ALPHA / DIGIT
restricted-name-chars = ALPHA / DIGIT / "!" / "#" /
"$" / "&" / "-" / "^" / "_"
restricted-name-chars =/ "." ; Characters before first dot always
; specify a facet name
restricted-name-chars =/ "+" ; Characters after last plus always
; specify a structured syntax suffix
Note that this syntax is more restrictive than what is allowed by
Section 5.1 of [RFC2045] or Section 4.2 of [RFC4288]. Also note that
while this syntax allows type and subtype names of up to 127
characters, implementation limits may make such long names
problematic. For this reason, 'type-name' and 'subtype-name' SHOULD
be limited to 64 characters.
Although this syntax treats "." as equivalent to any other character,
characters before any initial "." always specify the registration
facet. Note that this means that facet-less standards tree
registrations cannot use periods in the subtype name.
Similarly, the final "+" in a subtype name introduces a structured
syntax specifier suffix. Structured syntax suffix requirements are
specified in Section 4.2.
While it is possible for a given media type to be assigned more than
one name, the use of different names to identify the same media type
is discouraged.
These requirements apply regardless of the registration tree
involved.
Nottingham & Resnick Expires 27 September 2026 [Page 6]
Internet-Draft Media Type Registration March 2026
2.4. Parameters
Media types can be defined to allow or require use of media type
parameters. Additionally, some parameters may be automatically made
available to the media type by virtue of being a subtype of a content
type that defines a set of parameters applicable to any of its
subtypes.
In either case, the names, values, and meanings of any parameters
MUST be fully specified when a media type is registered in the
standards tree, and should be specified as completely as possible
when media types are registered in the vendor or personal trees.
Parameter names have the same syntax as media type names and values:
parameter-name = restricted-name
Note that this syntax is more restrictive than what is allowed by the
ABNF in [RFC2045] and amended by [RFC2231].
Parameter names are case-insensitive and no meaning is attached to
the order in which they appear. It is an error for a specific
parameter to be specified more than once.
There is no defined syntax for parameter values; therefore, it needs
to be specified upon registration. Additionally, some transports
impose restrictions on parameter value syntax, so care needs be taken
to limit the use of potentially problematic syntaxes; for example,
binary valued parameters, while permitted in some protocols, are best
avoided.
Some parameters are reused across multiple media type definitions to
provide common functionality. For example, the 'Codecs' and
'Profiles' Parameters for "Bucket" Media Types [RFC6381] identify
media codecs used inside the container and their parameters. RTP
payload formats have several common parameters: see [RFC4855], and
[RFC8851].
Note that a protocol can impose further restrictions on parameter
value syntax, depending on how it chooses to represent parameters.
MIME [RFC2045] [RFC2231] allows binary parameters as well as
parameter values expressed in a specific charset, but other protocols
may be less flexible. For example, HTTP obsoletes field values
containing characters outside the ASCII range (Section 5.5 of
[RFC9110]), requiring field definitions to use encoding mechanisms
like [RFC8187] to support other characters.
Nottingham & Resnick Expires 27 September 2026 [Page 7]
Internet-Draft Media Type Registration March 2026
Media types registered in the standards tree MUST NOT subsequently
add backwards-incompatible functionality through the addition of
parameters. New parameters MAY be used to convey additional
information so long as its processing is backwards-compatible, so
that existing implementations can still handle the message
successfully. Media types registered in the vendor and personal
trees SHOULD NOT violate this requirement.
Changes to parameters (including the introduction of new ones) is
managed in the same manner as other changes to the media type; see
Section 5.5.
2.5. Encoding
Some transports impose restrictions on the type of data they can
carry. For example, Internet mail traditionally was limited to 7bit
US-ASCII text. Encoding schemes are often used to work around such
transport limitations.
An "encoding considerations" field is provided to note what sort of
data a media type can consist of as part of its registration.
Possible values of this field are:
7bit: The content of the media type consists solely of CRLF-
delimited 7bit US-ASCII text.
8bit: The content of the media type consists solely of CRLF-
delimited 8bit text.
binary: The content consists of an unrestricted sequence of octets.
framed: The content consists of a series of frames or packets
without internal framing or alignment indicators. Additional out-
of-band information is needed to interpret the data properly,
including but not limited to knowledge of the boundaries between
successive frames and knowledge of the transport mechanism. Note
that media types of this sort cannot be stored in a file or
transported as a stream of octets without further context;
therefore, such media types are thus unsuitable for use in many
traditional protocols. A commonly used transport with framed
encoding is the Real-time Transport Protocol, RTP. Additional
rules for framed encodings defined for transport using RTP are
given in [RFC4855].
Additional restrictions on 7bit and 8bit text are given in
Section 4.1.1 of [RFC2046].
Nottingham & Resnick Expires 27 September 2026 [Page 8]
Internet-Draft Media Type Registration March 2026
2.6. Fragment Identifiers
Media type registrations can specify how applications should
interpret fragment identifiers (specified in Section 3.5 of
[RFC3986]) associated with the media type.
Media types that use a structured syntax suffix MUST follow any
fragment identifier rules specified for it.
Media types are encouraged to adopt fragment identifier schemes that
are used with semantically similar media types.
2.7. Security
All registrations of types in the standards tree MUST include an
analysis of security issues. A similar analysis for media types
registered in the vendor or personal trees is encouraged but not
required.
All descriptions of security issues need to be as accurate as
possible regardless of registration tree. In particular, the
security considerations MUST NOT state that there are "no security
issues associated with this type". Security considerations for types
in the vendor or personal tree MAY say that "the security issues
associated with this type have not been assessed".
There is no requirement that media types registered in any tree be
secure or completely free from risks. Nevertheless, all known
security risks need to be identified in the registration of a media
type, again regardless of registration tree.
The security considerations section of all registrations is subject
to continuing evaluation and modification, and in particular can be
extended by use of the "comments on media types" mechanism described
in Section 5.4 below.
Issues that need to be described in a security analysis of a media
type include:
* Processing of complex media types might modify or delete a
recipient's files or trigger actions on other resources. If
unrestricted, this could have devastating effects. See the
registration of the application/postscript media type in [RFC2046]
for an example of description and handling of these issues.
Nottingham & Resnick Expires 27 September 2026 [Page 9]
Internet-Draft Media Type Registration March 2026
* Any security analysis MUST state whether or not the format employs
such "active content"; if it does, it MUST state what steps have
been taken (or are required be taken by applications) of the media
type to protect users of the media type.
* Processing of complex media types might institute actions that,
while not directly harmful to the recipient, may result in
disclosure of information that either facilitates a subsequent
attack or else violates a recipient's privacy in some way. Again,
the registration of the application/postscript media type
illustrates how such directives can be handled.
* A media type that employs compression may provide an opportunity
for sending a small amount of data that, when received and
evaluated, expands enormously to consume all of the recipient's
resources. All media types should state whether or not they
employ compression; if they do, they should discuss what steps
need to be taken to avoid such attacks.
* A media type might be designed for applications that require an
assurance of security without providing that assurance. For
example, a media type could be defined for storage of sensitive
medical information that in turn requires external confidentiality
and integrity protection services, or which is designed for use
only within a secure environment. Types should always document
whether or not they need such services in their security
considerations.
2.8. Intended Usage
The "Intended usage" field in the registration template MUST contain
one of "COMMON", "LIMITED USE", or "OBSOLETE".
Registrations intended for general use should be registered as
COMMON. LIMITED USE accommodates media types that are only intended
to be used in closed or specialized systems. OBSOLETE indicates that
the media type should no longer be used.
Limited-use media types should also note in the applications list
whether or not that list is exhaustive.
The "Restrictions on usage" field can convey additional information
about restrictions on where the media type can be used.
2.9. Contact Information
The registration template contains distinct fields for contact
information:
Nottingham & Resnick Expires 27 September 2026 [Page 10]
Internet-Draft Media Type Registration March 2026
* The "Person to contact for further information" is intended to be
used by those with questions about the media type and its use.
This might be an individual with technical knowledge or a support
address.
* The "Author" is the person(s) to be attributed with creation of
the media type specification.
* The "Change controller" is the party who will authorise any future
changes to the status or details of the registration.
Each should contain a name (of a person or other entity) and e-mail
address. Optionally, they may also include a URL.
All three are required for permanent registrations; only the change
controller is required for provisional registrations.
2.10. Additional Information
The following optional information should be included in the
specification of a media type if it is available:
* Deprecated Aliases. In some cases, a single media type may have
been widely deployed using multiple names prior to registration.
In such cases, a preferred name MUST be chosen for the media type,
and applications are required to use this to be compliant with the
type's registration. However, a list of deprecated aliases by
which the type is known can be supplied as additional information
in order to assist applications in processing the media type
properly.
* Magic number(s) (length, octet values). Magic numbers are byte
sequences that are always present at a given place in the file,
and can be used to identify it as being of a given media type.
* File name extension(s) commonly used on one or more platforms to
indicate that some file contains a given media type.
* macOS Uniform Type Identifier (a string), if it makes sense to
exchange media of this type through user-triggered exchange
mechanisms such as copy-and-paste or drag-and-drop on macOS and
related platforms (see [MacOSUTIs] for definitions and syntax).
* Windows clipboard name (a string), if it makes sense to exchange
media of this type through user-triggered exchange mechanisms such
as copy-and-paste or drag-and-drop on Microsoft Windows and
related platforms (see [windowsClipboardNames] for definitions and
syntax).
Nottingham & Resnick Expires 27 September 2026 [Page 11]
Internet-Draft Media Type Registration March 2026
When registering a media type in the standards tree, specification
authors can provide this information in the formal specification of
the format, by incorporating the IANA media type registration form
into the specification itself.
3. Top-Level Media Types
The list of top-level types is maintained in the IANA Top-Level Media
Types registry at:
https://www.iana.org/assignments/top-level-media-types/
Top-level types can place various restrictions on the media types
that use them. New media types MUST conform to the restrictions (if
any) of their top-level type.
3.1. Additional Top-Level Types
In some cases, a new media type may not be easily classified under
any currently defined top-level type names. Such cases are expected
to be quite rare. However, if such a case does arise, a new top-
level type can be defined to accommodate it.
Registration of a new top-level type requires Standards Action in the
IETF and, hence, the publication of a RFC on the Standards Track.
3.1.1. Required Criteria
Definitions of new top-level types are required to fulfil the
following criteria:
* The top-level type is defined in a Standards Track RFC (see
Section 4.9 of [RFC8126]). This will make sure there is
sufficient community interest, review, and consensus.
* The IANA Considerations section of that RFC requests that IANA add
this new top-level type to the registry of top-level types.
* The criteria for what types do and do not fall under the new top-
level type are defined clearly. This will help the Designated
Expert(s) to evaluate whether a subtype belongs below the new type
or not, and whether the registration template for a subtype
contains the appropriate information. If the criteria cannot be
defined clearly, this is a strong indication that whatever is
being talked about is not suitable as a top-level type.
* The RFC clearly documents security considerations applying to all
or a significant subset of subtypes.
Nottingham & Resnick Expires 27 September 2026 [Page 12]
Internet-Draft Media Type Registration March 2026
* At the minimum, one subtype (not including a potential 'example'
subtype) is described. A top-level type without any subtype
serves no purpose. The only exception is the 'example' top-level
type, which disallows registration of subtypes.
3.1.2. Additional Considerations
Additional considerations for the definition of a new top-level type
include:
* Existing wide use of an unregistered top-level type may be an
indication of a need, and therefore an argument for formally
defining a new top-level type. On the other hand, the use of
unregistered top-level types is highly discouraged.
* Use of an IETF Working Group to define a new top-level type is not
needed, but may be advisable in some cases. There are examples of
new top-level type definitions without a Working Group
([RFC2077]), with a short, dedicated WG ([RFC8081]), and with a
Working Group that included other related work ([RFC9695]).
* The document defining the new top-level type should include
initial registrations of actual subtypes. The exception may be a
top-level type similar to 'example'. This will help to show the
need for the new top-level type, will allow checking the
appropriateness of the definition of the new top-level type, will
avoid separate work for registering an initial slate of subtypes,
and will provide examples of what is considered a valid subtype
for future subtype registrations.
* The registration and actual use of a certain number of subtypes
under the new top-level type should be expected. The existence of
a single subtype should not be enough; it should be clear that new
similar types may appear in the future. Otherwise, the creation
of a new top-level type is likely unjustified.
* The proposers of the new top-level type and the wider community
should be willing to commit to emitting and consuming the new top-
level type in environments that they control.
* The fact that a group of (potential) types have (mostly) common
parameters may be an indication that these belong under a common
new top-level type.
* Top-level types can help humans with understanding and debugging.
Therefore, evaluating how a new top-level type helps humans
understand types may be crucial.
Nottingham & Resnick Expires 27 September 2026 [Page 13]
Internet-Draft Media Type Registration March 2026
* Common restrictions may apply to all subtypes of a top-level type.
Examples are the restriction to CRLF line endings for subtypes of
type 'text' (at least in the context of electronic mail), or on
subtypes of type 'multipart'.
* Top-level types are also used frequently in dispatching code. For
example "multipart/*" is frequently handled as multipart/mixed,
without understanding of a specific subtype. The top-level types
'image', 'audio', and 'video' are also often handled generically.
Documents with these top-level types can be passed to applications
handling a wide variety of image, audio, or video formats. HTML
generating applications can select different HTML elements (e.g.
or