DMARC Standard Modernized with New IETF RFCs, Reinforcing Email Authentication Imperatives

The Internet Engineering Task Force (IETF) has announced a significant modernization of the Domain-based Message Authentication, Reporting & Conformance (DMARC) standard, with the publication of three new Request for Comments (RFCs) in May 2026. This pivotal update effectively retires the informal "DMARCbis" designation, bringing the widely adopted email authentication protocol under a unified and refined specification. The core message emanating from this update is clear: DMARC, now simply "DMARC," has been enhanced for clarity and contemporary relevance, rather than fundamentally altered in its operational mechanics. For email senders, particularly those leveraging platforms like Mailjet, the established best practices of authenticating email, aligning domains, and diligently monitoring reports remain paramount.

A Chronology of Email Authentication and DMARC’s Evolution

The journey towards robust email authentication began decades ago, a direct response to the escalating threats of spam, phishing, and email spoofing. Early attempts to combat these issues included basic sender checks, but these proved insufficient against sophisticated attackers. The turn of the millennium saw the introduction of two foundational protocols: Sender Policy Framework (SPF) in the early 2000s and DomainKeys Identified Mail (DKIM) shortly thereafter.

SPF, formalized as RFC 7208, allows domain owners to publish a DNS record specifying which mail servers are authorized to send email on behalf of their domain. Recipients can then check this record to verify if an incoming email originates from an approved source. DKIM, specified in RFC 6376, adds a digital signature to email headers, cryptographically linking an email message to its sending domain. This signature verifies that the message has not been tampered with in transit and that it indeed originated from the claimed sender.

While SPF and DKIM provided powerful tools for authentication, they lacked a crucial component: a mechanism for domain owners to instruct recipient mail servers on how to handle unauthenticated mail, and a way to receive feedback on authentication failures. This gap led to the genesis of DMARC.

DMARC emerged from a collaborative effort involving major email providers and financial institutions, including PayPal, Google, Microsoft, and Yahoo!, who recognized the urgent need for a unified policy framework. The original DMARC specification, RFC 7489, was published in March 2015, standardizing a protocol that builds upon SPF and DKIM. DMARC introduced the concept of "alignment," requiring that the visible From: address domain (the one users see) align with either the domain checked by SPF (the Return-Path or MAIL FROM domain) or the domain signed by DKIM. It also provided policy options (p=none, p=quarantine, p=reject) and reporting mechanisms (aggregate and forensic reports) to give senders visibility and control over their domain’s email traffic.

The period following DMARC’s initial standardization saw widespread adoption and identified areas for refinement, leading to the development of "DMARCbis" – an unofficial working title for the ongoing efforts to clarify, modernize, and address ambiguities in the original specification. This collaborative work culminated in the publication of the new RFCs in May 2026.

The New IETF RFCs: A Modernization, Not a Revolution

The IETF’s recent publication comprises three distinct, yet interconnected, RFCs that collectively supersede RFC 7489:

• RFC 9989: The DMARC Core Protocol: This document refactors and clarifies the fundamental DMARC protocol, outlining how email receivers perform DMARC checks, how policy is applied, and the overarching architecture of the system. It incorporates years of operational experience, addressing edge cases and improving the robustness of the standard.
• RFC 9990: DMARC Aggregate Reports (RUA): This RFC focuses specifically on the structure and content of aggregate reports. These XML-formatted reports provide domain owners with invaluable data on their email streams, showing which messages pass or fail DMARC, the authentication results (SPF and DKIM), and the sending sources. The updates aim to enhance the utility and interpretability of these reports.
• RFC 9991: DMARC Failure Reports (RUF): This document details the format and delivery of forensic or failure reports. These reports, while less commonly used due to privacy concerns and potential for information leakage, provide more granular detail about individual authentication failures. The new RFC clarifies their structure and best practices for their use.

The practical takeaway for senders and providers is that these updates primarily serve to consolidate, clarify, and modernize the DMARC documentation. The foundational evaluation model – requiring at least one of either aligned SPF or aligned DKIM to pass DMARC – remains unchanged. This continuity is crucial, ensuring that existing DMARC deployments continue to function as expected while benefiting from a more robust and clearly defined standard.

Broader Industry Implications: The Imperative of Authenticated Email

The modernization of DMARC underscores an ongoing, critical trend in the email ecosystem: the increasing expectation from mailbox providers for authenticated and aligned mail as a baseline sender behavior. Major players like Google, Yahoo, and Microsoft have progressively tightened their requirements for sender authentication, making DMARC an indispensable component for ensuring email deliverability and protecting sender reputation.

Data from various industry sources consistently highlights the positive impact of DMARC adoption. According to reports from organizations like M3AAWG (Messaging, Malware and Mobile Anti-Abuse Working Group) and security firms like Valimail and Agari, domains with DMARC policies at p=quarantine or p=reject experience significantly lower rates of successful phishing and spoofing attacks. For instance, some studies indicate that DMARC can reduce brand impersonation by over 90% for fully protected domains. This translates not only to enhanced security for recipients but also to substantial brand protection for legitimate senders, mitigating the damage caused by fraudulent emails purporting to be from their domain.

The IETF’s role in stewarding this standard is vital. By providing a neutral, consensus-driven platform for technical development, the IETF ensures that DMARC evolves in a way that benefits the entire internet community. The "bis" process allowed for a methodical review of the standard, incorporating lessons learned from real-world deployment across millions of domains and billions of email messages daily. This iterative approach is characteristic of robust internet standards, ensuring they remain relevant and effective against evolving threats.

For email service providers (ESPs) like Mailjet, these updates serve as a reinforcement of their ongoing commitment to facilitating DMARC compliance for their customers. ESPs are at the forefront of implementing and supporting these authentication protocols, providing the technical infrastructure and guidance necessary for senders to protect their domains and ensure high deliverability.

DMARC for Mailjet Customers: Understanding Default Behavior and Configuration

For Mailjet customers, the DMARC modernization solidifies existing best practices rather than introducing new operational hurdles. Mailjet’s platform is designed to help users meet these authentication requirements, primarily through its default DKIM-first approach.

DMARC Refresher for Senders:
At its core, DMARC checks whether the domain in the visible From: header of an email aligns with the authenticated results of either SPF or DKIM.

• SPF Alignment: The domain in the Return-Path (also known as MAIL FROM) must align with the visible From: domain. Alignment can be "relaxed" (organizational domain match) or "strict" (exact domain match).
• DKIM Alignment: The domain used to sign the DKIM signature (d= tag) must align with the visible From: domain. Again, this can be relaxed or strict.
• DMARC Pass: Only one of these (aligned SPF or aligned DKIM) needs to pass for the DMARC check to succeed.

Mailjet’s DKIM-First Default:
Mailjet’s platform streamlines domain authentication with a strong emphasis on DKIM. When a sender domain is validated within Mailjet:

• Mailjet automatically configures DKIM signing for the messages sent from that domain. This involves providing customers with CNAME records to add to their DNS, which delegate DKIM signing authority to Mailjet.
• The DKIM signature generated by Mailjet typically uses a selector within the customer’s authenticated domain (or an aligned subdomain).

This default configuration means that DKIM alignment is straightforward and automatically achieved when the visible From: address uses the same domain (or an aligned subdomain) that has been authenticated in Mailjet. Consequently, DMARC commonly passes through DKIM alignment for most Mailjet users.

The Return-Path / SPF Story with Mailjet:
By default, Mailjet employs a provider-owned bounce domain for the Return-Path address of outgoing emails. For instance, emails might use a Return-Path like bnc3.mailjet.com.

• The Return-Path domain is what SPF checks for authorization.
• Since Mailjet’s default Return-Path domain (bnc3.mailjet.com) is different from the customer’s visible From: domain, SPF alignment (where the Return-Path domain aligns with the From: domain) will typically fail under this default setup.
• However, as DMARC only requires one aligned authenticated identifier (either SPF or DKIM), and Mailjet’s default configuration ensures DKIM alignment, the overall DMARC check still passes.

This is a valid and common approach for ESPs, ensuring DMARC compliance without requiring customers to manage complex SPF configurations for the Return-Path.

Custom Return-Path for SPF Alignment with Mailjet:
For customers who specifically require SPF alignment in addition to DKIM, Mailjet offers the option to configure a custom Return-Path on paid plans. This feature allows senders to have their Return-Path domain align with their visible From: domain.

• Configuration: Implementing a custom Return-Path typically involves adding a CNAME record to the customer’s DNS, pointing a subdomain (e.g., bounces.yourdomain.com) to a Mailjet-managed bounce subdomain.
• SPF Alignment: Once configured, SPF can support DMARC alignment under relaxed alignment (aspf=r). This is because the MAIL FROM / Return-Path now uses a Mailjet-managed bounce subdomain that resides within the customer’s organizational domain, allowing for the organizational domain match required for relaxed alignment. Mailjet continues to handle bounce processing seamlessly behind the scenes.
• Strict SPF Alignment (aspf=s): Customers considering or using strict SPF alignment should review this setup carefully. Strict alignment requires the MAIL FROM domain to exactly match the visible From: domain. Mailjet’s custom Return-Path setup, using a subdomain, typically achieves relaxed alignment but not strict alignment unless the From: domain itself is configured as the Return-Path, which is less common for ESPs.
• Caveats: It’s important to note that Mailjet typically supports only one active custom Return-Path per API key. Availability and setup details may depend on the customer’s specific plan and require coordination with Mailjet’s support workflow. Senders are always encouraged to consult Mailjet’s latest documentation and support guidance for current specifics.

Dedicated IPs and DMARC:
It is crucial for Mailjet users to understand that using dedicated IP addresses, while offering benefits for reputation control and deliverability troubleshooting, does not alter DMARC’s fundamental alignment rules. Whether sending via shared or dedicated Mailjet IPs, DMARC still evaluates the alignment between the visible From: domain and the authenticated SPF or DKIM identifiers. The IP address itself is primarily relevant for sender reputation and SPF record evaluation, but not for the DMARC alignment check itself.

Recommended Actions for Mailjet Senders:
In light of the DMARC standardization and the ongoing emphasis on email authentication, Mailjet senders should review their configurations and practices:

1. Verify Your DMARC Policy: Ensure your domain has a DMARC record published in DNS. For optimal protection and reporting, move beyond p=none to p=quarantine (to direct unauthenticated mail to spam) or p=reject (to block it entirely) once you are confident in your authentication setup.
2. Confirm SPF and DKIM Configuration: Regularly check that your SPF record is correctly published and includes Mailjet’s sending IPs/mechanisms, and that your DKIM CNAME records for Mailjet are properly configured and resolving. Tools are available online to verify these records.
3. Actively Monitor DMARC Reports: Utilize DMARC reporting tools to analyze the aggregate reports (RUA) sent to your designated email address. These reports provide invaluable insights into your email ecosystem, revealing legitimate sending sources, identifying unauthorized senders, and highlighting any authentication failures. Consistent monitoring is key to maintaining a healthy email program.
4. Review Authentication Alignment: Regularly verify that your visible From: domain aligns with at least one of your authenticated identifiers (SPF or DKIM) when sending through Mailjet. For most Mailjet users, this will be DKIM alignment by default.
5. Consider a Custom Return-Path for SPF Alignment: If your organization has a specific requirement for SPF alignment, explore Mailjet’s custom Return-Path feature. Work with Mailjet support to understand the setup process and ensure it meets your specific alignment needs, particularly regarding relaxed vs. strict SPF alignment.

Conclusion: Long Live DMARC

The death of "DMARCbis" and the birth of the modernized DMARC standard represent a significant, yet evolutionary, step forward for email security. The IETF’s new RFCs provide a clearer, more robust framework for DMARC, solidifying its position as a cornerstone of email authentication and deliverability. For the vast majority of Mailjet customers already adhering to best practices by using authenticated domains and correctly aligned identifiers, these updates will feel more like a clarification of existing mandates than a major operational paradigm shift.

As the digital landscape continues to evolve, with new threats emerging constantly, the commitment to strong email authentication remains paramount. DMARC, now streamlined and fortified, continues to empower domain owners to protect their brands, enhance deliverability, and build trust in the global email ecosystem. Proactive management and continuous monitoring of DMARC policies are not merely technical tasks but essential components of a robust digital communication strategy in the 21st century.