This document redefines how the explicit congestion notification (ECN) field of the IP header should be constructed on entry to and exit from any IP-in-IP tunnel. On encapsulation@ it updates RFC 3168 to bring all IP-in-IP tunnels (v4 or v6) into line with RFC 4301 IPsec ECN processing. On decapsulation@ it updates both RFC 3168 and RFC 4301 to add new behaviours for previously unused combinations of inner and outer headers. The new rules ensure the ECN field is correctly propagated across a tunnel whether it is used to signal one or two severity levels of congestion; whereas before@ only one severity level was supported. Tunnel endpoints can be updated in any order without affecting pre-existing uses of the ECN field@ thus ensuring backward compatibility. Nonetheless@ operators wanting to support two severity levels (e.g.@ for pre-congestion notification -- PCN) can require compliance with this new specification. A thorough analysis of the reasoning for these changes and the implications is included. In the unlikely event that the new rules do not meet a specific need@ RFC 4774 gives guidance on designing alternate ECN semantics@ and this document extends that to include tunnelling issues.