How Many IETF RFCs Actually Become Standards?

The Internet Engineering Task Force (IETF) has 10K+ published Request For Comments (RFCs) documents. The industry hears about RFCs all the time. But, as the name implies (“request for comments”) that isn’t the final step in the process. A very small number of RFCs are promoted to Internet Standards, which are referred to as STDs — an unfortunate name, but we go on.

I always knew that something came after the RFC step in this story, but I didn’t know how it worked. One doesn’t hear about “Internet Standards” in the formal sense nearly as often as one hears about RFCs. That is because there are only ninety four STDs (by my count as of Q3, 2026) that have been published by the IETF. So, it doesn’t happen that often.

The Internet Engineering Task Force (IETF)

The Internet Engineering Task Force (IETF) is the principal standards development organization responsible for designing and maintaining the protocols that make the Internet function. Founded in 1986, the IETF is an open, international community of network engineers, researchers, vendors, and technology experts who collaborate to develop interoperable Internet technologies. Unlike many standards organizations, participation is open to anyone, and technical decisions are made through “rough consensus and running code” — meaning that practical, interoperable implementations carry as much weight as theoretical design.

Request for Comments (RFC)

An RFC is an official publication in the IETF document series. RFCs document Internet protocols, implementation guidance, operational best practices, informational material, and experimental technologies. Despite the name, an RFC is not a draft for public comment once published — it is a permanent archival document. RFCs can have several publication statuses, including Standards Track, Best Current Practice (BCP), Informational, Experimental, and Historic. Once assigned an RFC number, the document is never modified; if changes are needed, a new RFC is published that updates or obsoletes the previous one.

OAuth2, JWT, JWE, JWS, and TCP over Carrier Pigeon are all published RFCs.

Internet Standard

An Internet Standard is the highest maturity level defined by the IETF for a protocol specification. To achieve this designation, a protocol must demonstrate multiple independent, interoperable implementations, significant operational experience, technical stability, and broad community acceptance. When a Standards Track RFC is promoted to an Internet Standard, it retains its original RFC number but is also assigned an STD (Standard) number. Contrary to popular belief, only a small percentage of RFCs ever reach Internet Standard status — most remain Proposed Standards or serve other purposes such as informational guidance or best current practices. The Internet itself, however, is built upon this relatively small set of mature, widely implemented Internet Standards.

Although there are over 10K RFCs published (as of Q3, 2026), only a small fraction have ever become Internet Standards (i.e., been assigned an STD number). Most RFCs are Informational, Experimental, Best Current Practice (BCP), Historic, or remain at the Proposed Standard maturity level.

As of today:

• There are approximately 90 active Internet Standards (STD numbers).
• Those STD numbers correspond to roughly 160–180 RFCs, because many Internet Standards consist of multiple RFCs (for example, DNS is defined by RFC 1034 and RFC 1035 under STD 13).
• Fewer than 2% of all RFCs have reached Internet Standard status. The overwhelming majority never advance beyond Proposed Standard or were never on the standards track to begin with.

Why so few?

Historically, advancement required:

1. An Internet-Draft
2. Publication as a Proposed Standard RFC
3. Multiple interoperable implementations
4. Significant operational experience
5. IETF review and approval
6. Assignment of an STD number while retaining the same RFC number.

Since the publication of RFC 6410 in 2011, the process was simplified by eliminating the Draft Standard stage, but the bar for becoming an Internet Standard remains high.

Take OAuth as an example:

• RFC 6749 has become one of the most widely implemented RFCs on the Internet.
• Yet it is not an Internet Standard (STD).
• Instead, the OAuth working group has chosen to evolve the protocol by publishing new RFCs (PKCE, PAR, DPoP, Token Exchange, etc.) and by developing OAuth 2.1, rather than advancing RFC 6749 to STD status.

Summary

The same is true for many modern IETF technologies — practical adoption often outpaces formal advancement.

One interesting historical observation is that the Internet runs on a surprisingly small set of actual Internet Standards. Core protocols like IPv4, IPv6, TCP, UDP, DNS, SMTP, and a handful of others make up much of the foundation, while thousands of other RFCs define extensions, best practices, informational guidance, or specialized protocols. That’s one reason you’ll often see a technology become ubiquitous long before — or even without — being promoted to Internet Standard status.

Notes

• AI / GenAI / ChatGPT / etc were not used to generate the text of this article.
• ChatGPT was used to generate the images.
• I used em dashes in my writing before the current GenAI wave was a thing. Not planning on changing now.
• Names have been changed to protect the guilty.
• None of the hostnames or users used in examples actually exist.
• Feel free to post any comments or suggestions below.