Email header / CRLF / folding boundary

Separate email header line-break boundaries

Use fixed cases for CRLF, folding, the header/body separator, newline injection risk and unknown values to decide safe or needs-review. No email is sent, and this page does not communicate, store or send.

See the decisions Save a review note

Five line-break boundaries

A line break is more than a display separator. Separate header values, continuations and the body boundary, and stop inputs that could create another header.

CRLF = delimiter / folding = WSP continuation / CRLF CRLF = body boundary

boundary	review	decision
CRLF	CRLF separating header lines	needs review before assembling a value
folding	WSP-starting continuation	conditionally safe after specification check
body separator	CRLF CRLF	needs review; keep header and body separate
injection risk	CRLF followed by another header	Reject; never call it safe without review
unknown	unrecognized line-break form	Reject; needs review rather than guessing

Safe review order

Record the header name, value and line-break owner separately.
Do not treat CRLF and a WSP continuation as the same value.
Make CRLF CRLF an explicit header/body boundary.
Reject inputs that can create another header and unknown values before sending.

This page uses synthetic cases only. It does not send mail, make SMTP/HTTP requests, accept arbitrary headers, store data or send analytics.

Five fixed cases

case	fixed example	decision
`crlf-boundary`	`Subject: hello CRLF`	needs review
`legal-folding`	`Header: first CRLF WSP second`	conditionally safe
`header-body-separator`	`CRLF CRLF`	needs review
`newline-injection-risk`	`value CRLF Bcc:`	Reject / needs review
`unknown-header-value`	`unknown line break`	Reject / needs review