iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Vouch By Reference (VBR) is an IETF email protocol for adding third-party certification to a message. A sender identifies the domain responsible for the mail, labels its content type, and names certifiers; the receiving system validates the domain and checks a certifier it already trusts. A positive result is one input to the receiver’s handling decision—not proof that a message is safe or a command to deliver it.
What Vouch By Reference means
VBR stands for Vouch By Reference. The IETF defines it in RFC 5518 as a protocol for third-party email certification. In practical terms, it lets a domain associated with a message point a receiving system to an outside service that may vouch for that domain’s mail of a specified type.
VBR separates three questions that are easy to conflate: whether a message’s domain identity can be validated, whether a trusted third party vouches for that domain and type of mail, and what the receiver should do with those results. VBR addresses the second question; it does not replace identity validation or dictate the receiver’s local filtering policy.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How the VBR process works
- The sender adds VBR information. The message carries a
VBR-Infoheader with an accountable domain, a content label, and a list of certifier domains. - The receiver validates the domain identity. RFC 5518 recommends DKIM as an identity-validation method and recommends protecting the
VBR-Infoheader with the DKIM signature. Domain validation is a prerequisite in the VBR process. - The receiver chooses a certifier it trusts. A certifier appearing in the sender’s header is only a candidate. The receiver must independently trust the service; otherwise a sender could nominate a service that vouches for itself.
- The receiver checks the certifier’s DNS record. It looks up a TXT record using the accountable domain, the literal
_vouchlabel, and the certifier’s host name. The record indicates which message types that service certifies for the domain. - The receiver applies its own policy. A positive result may inform reputation or filtering, but the receiver decides how much weight to give it and what action to take.
What the VBR-Info header contains
RFC 5518 defines three required parameters:
mdidentifies the accountable domain.mcgives the message-content label.mvlists one or more certifier domains, separated by colons.
The RFC illustrates the format with this example:
VBR-Info: md=somebank.example; mc=transaction; mv=certifier-a.example:certifier-b.example;The example shows the syntax, not a guarantee that either certifier is trusted by a particular receiver.
#1 Best Overall
What the content labels mean
RFC 5518 defines three values for mc. The label is asserted by the sender and is intended to support auditing; it is not independent verification of a message’s nature.
| Label | Meaning in RFC 5518 |
|---|---|
all |
All mail from the sender. |
list |
Identical or very similar messages sent to multiple recipients. |
transaction |
A response to a user action or a notice about an event in the user’s account. |
What a positive VBR result does—and does not—tell you
A positive result means a certifier the receiver trusts is willing to vouch for the specified domain and type of mail. It does not establish that the message’s contents are harmless, that the recipient consented to receive it, or that it belongs in the inbox.
VBR results can be recorded using the vbr method in an Authentication-Results header. RFC 6212 registers that method and explains that the receiver’s local policy determines how to react to authentication results. Different receiving systems may therefore make different decisions based on the same VBR result.
Recommended Free Tools
Why the choice of certifier matters
When receivers use vouching results to adjust spam scores, certifiers can have meaningful operational influence over mail handling. RFC 5518 advises selecting them carefully. Using more than one certifier may reduce reliance on a single service, but it does not guarantee that the certifications are correct.
Where VBR fits among email checks
| Function | Question it addresses |
|---|---|
| Domain identity validation | Can the domain associated with the message be validated? |
| VBR certification | Does a selected, trusted third party vouch for that domain for this content type? |
| Receiver policy | How should the receiving system use those results when handling the message? |
These functions work together but are not interchangeable: VBR depends on domain validation, and the receiver retains control over the final handling decision.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.VBR’s standards status
RFC 5518, Vouch By Reference, is an IETF Standards Track document published in April 2009. Its Datatracker record says it is updated by RFC 8553 and lists a record update on May 20, 2026. RFC 6212, which registers VBR results for Authentication-Results, is also an IETF Standards Track document, published in April 2011.
The standards establish how the protocol is structured; they do not establish how widely it is deployed. The RFCs cited here provide no adoption statistics or market-size figures.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
