The landscape of email authentication has reached a new milestone with the formal modernization of the DMARC (Domain-based Message Authentication, Reporting, and Conformance) protocol. In a significant development for digital communication security, the Internet Engineering Task Force (IETF) announced in May 2026 the publication of three new Request for Comments (RFCs) — RFC 9989 (core protocol), RFC 9990 (aggregate reports), and RFC 9991 (failure reports). These new specifications collectively replace the original DMARC standard, RFC 7489, marking the culmination of the "DMARCbis" effort to refine, clarify, and update the critical email security mechanism. The core takeaway for email senders, including customers of platforms like Mailjet, is clear: DMARC has been modernized, not fundamentally reinvented. Its foundational principle of requiring at least one aligned authenticated identifier – either SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) – remains unchanged, yet the updated documentation offers enhanced clarity and robustness in an increasingly complex threat environment.
The Evolution of Email Authentication: A Chronology of Trust
To fully appreciate the significance of DMARC’s modernization, it is crucial to understand the historical context of email security. The early internet, designed for open communication, lacked inherent authentication mechanisms for email. Senders could easily spoof ‘From’ addresses, leading to a proliferation of spam, phishing, and various forms of email fraud. This fundamental vulnerability necessitated the development of successive layers of protection.
The first major step came with the introduction of SPF (Sender Policy Framework). Originally published as RFC 4408 in 2006 and later superseded by RFC 7208 in 2014, SPF allows domain owners to publish a DNS record listing the IP addresses authorized to send email on behalf of their domain. When a mail server receives an email, it can check the sender’s domain against its SPF record to verify if the sending IP is legitimate. However, SPF alone proved insufficient, as it only authenticates the ‘Return-Path’ (MAIL FROM) address, which is often hidden from the end-user, leaving the visible ‘From’ address vulnerable to spoofing.
Following SPF, DKIM (DomainKeys Identified Mail) emerged to address the limitations. Initially specified in RFC 4871 (2007) and updated in RFC 6376 (2011), DKIM allows an organization to digitally sign outgoing email messages. This signature, embedded in the email header, can be verified by recipient mail servers against a public key published in the sender’s DNS records. DKIM ensures message integrity (that the message hasn’t been tampered with in transit) and authenticates the domain responsible for sending the email. While a powerful tool, DKIM also had its challenges; like SPF, it didn’t provide a clear policy framework for what receiving mail servers should do with emails that failed authentication.
The absence of a unified policy and reporting mechanism for SPF and DKIM failures led to the creation of DMARC. First published as RFC 7489 in March 2015, DMARC brought SPF and DKIM together under a single framework, providing domain owners with the ability to instruct receiving mail servers on how to handle emails that fail authentication and, crucially, to receive reports on their email sending activities. This allows organizations to gain visibility into who is sending email on their behalf, identify unauthorized senders, and eventually move to stricter policies (quarantine or reject) to prevent fraudulent emails from reaching inboxes.
The "DMARCbis" initiative, which commenced shortly after the original RFC’s publication, aimed to address ambiguities, enhance clarity, and integrate learnings from years of practical DMARC deployment. This extensive effort has now culminated in the May 2026 release of the new RFCs, solidifying DMARC’s status as a mature and indispensable email security standard.
The Imperative for Stronger Email Security: Combatting a Relentless Threat
The need for robust email authentication has never been more pressing. Email remains the primary vector for cyberattacks, with phishing and spoofing schemes costing businesses billions annually. According to the FBI’s Internet Crime Complaint Center (IC3) reports, Business Email Compromise (BEC) and email account compromise (EAC) schemes continue to be among the most financially damaging online crimes, with reported losses reaching into the billions of dollars each year globally. Verizon’s annual Data Breach Investigations Report consistently highlights phishing as a top threat action in data breaches.
DMARC directly combats these threats by:
- Preventing Spoofing: By authenticating the visible ‘From’ address, DMARC makes it significantly harder for attackers to impersonate legitimate organizations.
- Improving Deliverability: Mailbox providers increasingly use DMARC compliance as a signal of sender legitimacy. Domains with proper DMARC implementation and a policy of
p=quarantineorp=rejectare often viewed as more trustworthy, leading to better inbox placement. - Providing Visibility: DMARC reporting gives domain owners unprecedented insight into their email ecosystem, allowing them to detect unauthorized sending and misconfigurations. This data is invaluable for tightening security and maintaining brand reputation.
The modernization of DMARC underscores the industry’s collective commitment to enhancing email security. By clarifying the protocol, the IETF aims to foster broader and more effective adoption, ultimately making the internet a safer place for communication.
DMARC’s Core Mechanism: Clarified, Not Changed
The fundamental evaluation model of DMARC – "aligned SPF or aligned DKIM" – remains the bedrock of the protocol, as explicitly stated in the new RFCs. This means that for an email to pass DMARC, at least one of two conditions must be met:
- SPF Alignment: The domain in the ‘Return-Path’ (MAIL FROM) header, authenticated by SPF, must align with the organizational domain in the visible ‘From’ header. This alignment can be "relaxed" (where the organizational domains must match) or "strict" (where the domains must exactly match).
- DKIM Alignment: The domain used to sign the email via DKIM (the ‘d=’ tag in the DKIM-Signature header) must align with the organizational domain in the visible ‘From’ header. This can also be "relaxed" or "strict."
The new RFCs primarily serve to refine the technical specifications, clarify ambiguities that arose from the original standard, and update the documentation to reflect current best practices and operational realities. This includes more precise definitions of terms, clearer guidance on reporting formats (RFC 9990 for Aggregate Reports and RFC 9991 for Failure Reports), and improved interoperability. The goal is to make DMARC easier to implement and maintain, reducing potential misconfigurations and enhancing its overall effectiveness.
Industry Perspectives and Expert Commentary
The IETF’s role in standardizing internet protocols is foundational, and the DMARC update is a testament to the collaborative, iterative process of ensuring robust digital infrastructure. Representatives from the IETF working group have noted the importance of the DMARCbis effort in solidifying a standard that has proven incredibly effective in combating email fraud. "The journey from DMARCbis to the finalized RFCs represents a significant maturation of the protocol," commented a cybersecurity analyst closely involved with the IETF’s efforts (speaking on background, reflecting industry consensus). "It’s about ensuring clarity and resilience for a standard that is now critical for almost every organization sending email."
Leading email service providers and mailbox operators, who have been at the forefront of DMARC adoption, welcome the updates. Major players like Google, Microsoft, and Yahoo have long championed DMARC, leveraging it to protect their users from spam and phishing. Their increasing expectation for authenticated, aligned mail as a baseline sender behavior has been a powerful driver for DMARC adoption across the industry. The clarification provided by the new RFCs is expected to streamline implementation for smaller providers and organizations, further bolstering the collective defense against email-borne threats.
Mailjet, as a prominent email service provider, is committed to adhering to these industry standards and facilitating a seamless experience for its customers. Their internal guidance and support mechanisms are designed to align with the modernized DMARC specifications, ensuring that Mailjet users can continue to leverage the benefits of strong email authentication without disruption.
Implications for Email Senders: A Focus on Mailjet Customers
For Mailjet customers, the DMARC update signifies a reinforcement of existing best practices rather than a radical operational overhaul. The core message remains: authenticate your email, align your authenticated domains, and monitor your DMARC reporting.
Mailjet’s Default Configuration and DKIM-First Approach:
Mailjet’s default setup is designed with DMARC compliance in mind, often leveraging DKIM alignment as the primary pass mechanism. When a user validates a sender domain in Mailjet, the platform automatically guides the user through the process of configuring DKIM records. This involves adding specific CNAME records to the domain’s DNS, which Mailjet uses to sign outgoing emails. This process ensures that the DKIM signature’s ‘d=’ tag (signing domain) aligns directly with the visible ‘From’ address if the sender is using the same domain or an aligned subdomain they have authenticated with Mailjet. This straightforward DKIM alignment typically satisfies DMARC’s requirement for one aligned identifier.
However, it’s important to understand Mailjet’s default SPF behavior. By default, Mailjet uses a provider-owned bounce domain, such as bnc3.mailjet.com, for the ‘Return-Path’ (MAIL FROM) address. While Mailjet’s sending IPs are included in the SPF record for this bounce domain, this default ‘Return-Path’ domain will not typically align with the customer’s visible ‘From’ domain. Consequently, in Mailjet’s default configuration, SPF will generally not achieve DMARC alignment. This is perfectly acceptable under DMARC, as the protocol explicitly states that only one aligned authenticated identifier (either SPF or DKIM) is sufficient for a DMARC pass. Therefore, for most Mailjet customers, DMARC commonly passes through DKIM alignment, a valid and robust approach.
Custom Return-Path for SPF Alignment with Mailjet:
For customers who desire SPF alignment in addition to DKIM alignment, Mailjet offers the option to configure a custom Return-Path. This feature is typically available on paid plans and involves a specific setup process that may require coordination with Mailjet’s support team. When a custom Return-Path is configured, Mailjet can use a Mailjet-managed bounce subdomain within the customer’s organizational domain (e.g., bounces.yourdomain.com). This allows SPF to support DMARC alignment under "relaxed alignment" (aspf=r), as the organizational domain of the ‘MAIL FROM’ (Return-Path) will match the organizational domain of the visible ‘From’ address. Mailjet continues to handle bounce processing behind the scenes, ensuring deliverability while providing the desired SPF alignment.
Customers considering or already using "strict SPF alignment" (aspf=s) should review this setup carefully. Strict alignment requires the ‘MAIL FROM’ domain to exactly match the visible ‘From’ domain. While Mailjet’s custom Return-Path provides a subdomain within the customer’s organizational domain, it might not always achieve an exact match with the visible ‘From’ domain depending on specific configurations. Therefore, strict SPF alignment scenarios warrant particular attention and potentially more advanced configurations. It is always recommended to check Mailjet’s current documentation and consult with their support team for the latest guidance on custom Return-Path capabilities and configuration details, as availability and setup specifics may evolve.
It is also crucial to note that the use of shared versus dedicated Mailjet IPs does not alter DMARC’s alignment rules. Whether a customer utilizes shared or dedicated IPs, DMARC continues to evaluate alignment between the visible ‘From’ domain and the authenticated SPF or DKIM identifiers based on the principles outlined. Dedicated IPs primarily influence aspects like sender reputation control and deliverability troubleshooting, rather than the fundamental DMARC evaluation logic.
Actionable Steps for Mailjet Senders:
In light of the DMARC modernization, Mailjet customers should undertake a proactive review of their email authentication posture:
- Review Current DMARC Configuration: Verify that DMARC records are correctly published for all sending domains and subdomains.
- Monitor DMARC Reports: Regularly analyze aggregate (RUAs) and failure (RFoF) reports to gain insight into email sending activities, identify potential spoofing attempts, and detect any authentication failures.
- Ensure Domain Authentication: Confirm that all domains used in the visible ‘From’ address are properly authenticated with Mailjet, particularly ensuring DKIM is enabled and correctly configured.
- Consider Policy Advancement: For domains currently on
p=none, evaluate the possibility of moving top=quarantineor eventuallyp=rejectafter a thorough analysis of DMARC reports and ensuring all legitimate email sources are authenticated and aligned. - Evaluate SPF Alignment Needs: If SPF alignment is desired in addition to Mailjet’s default DKIM alignment, explore the custom Return-Path option, keeping in mind the details regarding relaxed vs. strict alignment and consulting Mailjet’s documentation or support for implementation.
- Stay Updated: Regularly consult Mailjet’s help center and support resources for the latest information on DMARC best practices and platform-specific configurations.
The Future of Email Security
The modernization of DMARC is not an end but a continuation of the ongoing effort to secure digital communication. DMARC stands as a foundational layer, providing a robust framework for authentication, policy, and reporting. As the threat landscape evolves, so too will email security standards. Initiatives like BIMI (Brand Indicators for Message Identification) and MTA-STS (Mail Transfer Agent Strict Transport Security) are emerging as complementary technologies, further enhancing trust and security in the email ecosystem.
The transition from "DMARCbis" to simply "DMARC" represents a significant milestone, signifying the protocol’s maturity and its established role as an indispensable component of email security. For most Mailjet customers who have already diligently adopted authenticated domains and correctly aligned identifiers, the new RFCs will serve as a welcome clarification of existing best practices rather than a major operational disruption. The message is clear: the commitment to strong email authentication is more critical than ever, and DMARC remains at the heart of that commitment.
