On June 1, 2026, the global landscape of email authentication solidified its foundational standard with the official transition from DMARCbis to simply DMARC, marking a pivotal moment in the ongoing battle against email fraud and impersonation. This significant update, formalized through the publication of three new Request for Comments (RFCs) by the Internet Engineering Task Force (IETF) in May 2026, primarily refactors, clarifies, and modernizes the existing DMARC documentation. Crucially, while the underlying specifications have been meticulously updated to reflect current best practices and address ambiguities, the core DMARC evaluation model – requiring "aligned SPF or aligned DKIM" – remains fundamentally unchanged, providing continuity for senders already adhering to robust authentication protocols. This evolution underscores the escalating expectations of mailbox providers, who increasingly demand authenticated and aligned mail as the baseline for acceptable sender behavior, making DMARC compliance not merely a recommendation but an essential prerequisite for reliable email delivery.
The Genesis of DMARC: A Unified Front Against Email Fraud
To fully appreciate the significance of this modernization, it is essential to revisit the origins and purpose of DMARC (Domain-based Message Authentication, Reporting, and Conformance). Born out of a collaborative effort by major email senders and receivers, including industry giants like Google, Microsoft, and PayPal, DMARC emerged in 2012 as a critical third layer of email authentication. Prior to DMARC, two primary standards, SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail), existed independently. SPF, introduced in the early 2000s, allows domain owners to specify which mail servers are authorized to send email on behalf of their domain, preventing spammers from forging the sender’s domain in the ‘Return-Path’ header. DKIM, developed around the same time, provides a cryptographic signature that verifies the sender of an email and ensures that the message content has not been tampered with in transit.
While SPF and DKIM were vital steps, they had limitations. Neither standard inherently linked the authentication results to the visible ‘From:’ address that end-users see, leaving a significant vulnerability for phishers and spoofers who could authenticate their messages using a benign domain in the ‘Return-Path’ or DKIM signature while displaying a fraudulent ‘From:’ address (e.g., a bank’s domain) to deceive recipients. This disconnect allowed sophisticated phishing campaigns to bypass early authentication checks. DMARC was specifically designed to bridge this gap by enforcing alignment between the domain in the visible ‘From:’ header and the domains authenticated by SPF or DKIM. Furthermore, DMARC introduced a crucial reporting mechanism, allowing domain owners to receive feedback from mailbox providers about how their emails are being handled, providing unprecedented visibility into potential abuse and legitimate sending practices.
The IETF’s Role and the Path to Modernization
The original DMARC specification (RFC 7489) was published in 2015 as an Informational RFC, reflecting its status as an industry-driven consensus rather than a formal IETF standard. The subsequent years saw widespread adoption of DMARC, driven by its effectiveness in combating phishing and the increasing pressure from mailbox providers to improve email security. Statistics consistently showed that domains protected by DMARC with an enforcement policy (‘p=quarantine’ or ‘p=reject’) were significantly less likely to be spoofed in phishing attacks. As DMARC became a de facto industry standard, the need for a more formal, robust, and universally recognized specification grew. This led to the "DMARCbis" effort, a working group within the IETF dedicated to refining, clarifying, and standardizing DMARC. The "bis" (Latin for "twice" or "again") indicated that it was a second iteration of the specification, aimed at achieving full Standards Track status within the IETF framework.
The culmination of this multi-year effort arrived in May 2026 with the publication of three new RFCs:
- RFC 9989: "DMARC" (Core Protocol): This RFC supersedes RFC 7489 and defines the core DMARC protocol. It consolidates and clarifies the mechanisms for domain owners to publish DMARC policies via DNS, for receivers to evaluate these policies, and for the enforcement actions (none, quarantine, reject) to be applied. It addresses ambiguities found in the original specification and provides more precise definitions of terms and processes, ensuring greater interoperability and consistent implementation across the email ecosystem. Key clarifications include enhanced guidance on policy application in complex scenarios and refined definitions of alignment modes.
- RFC 9990: "DMARC Aggregate Report Format": This RFC standardizes the format for aggregate DMARC reports. These reports provide domain owners with a high-level overview of their email traffic, indicating which messages passed or failed DMARC checks, the authentication methods used (SPF, DKIM), and the originating IP addresses. The updated RFC refines the XML schema and content, making these reports more consistent and easier for automated systems to parse and analyze, thereby improving the efficiency of DMARC policy monitoring and adjustment. The clearer structure aims to reduce interpretation discrepancies among DMARC analysis tools.
- RFC 9991: "DMARC Failure Report Format": This RFC focuses on the format for forensic (or failure) reports. Unlike aggregate reports, forensic reports provide detailed information about individual messages that failed DMARC authentication, including headers, subjects, and sometimes even partial message bodies (with privacy considerations). These reports are invaluable for forensic analysis of phishing attacks and troubleshooting legitimate email delivery issues. RFC 9991 clarifies the structure and content of these reports, enhancing their utility while emphasizing the importance of responsible handling of potentially sensitive data and outlining mechanisms for redaction to protect recipient privacy.
The transition from "DMARCbis" to simply "DMARC" signifies that the standard has achieved its intended formal status within the IETF, shedding its "bis" moniker as a mature and ratified specification. An IETF spokesperson, speaking on background about the extensive review process, remarked, "The DMARC working group diligently addressed years of implementation experience and feedback from a global community. These new RFCs are not about reinventing the wheel but about meticulously engineering it for greater robustness, clarity, and future-proofing. It’s a testament to the collaborative spirit of the email security community and a crucial step towards a more secure global email infrastructure."
Why Authentication is No Longer Optional: Mailbox Provider Expectations
The modernization of DMARC comes at a time when email authentication has never been more critical. Major mailbox providers like Google, Yahoo, and Microsoft have been progressively tightening their email sending requirements, moving towards a future where unauthenticated email is increasingly likely to be rejected or routed to spam folders. This shift is driven by several factors:
- Combating Phishing and Spam: Email remains a primary vector for cyberattacks, with phishing attempts costing businesses billions annually. Strong authentication helps mailbox providers filter out malicious emails, protecting their users and the integrity of the email system. Industry reports consistently show that phishing attempts have surged in recent years, making robust authentication a front-line defense.
- Brand Protection: For legitimate organizations, DMARC prevents malicious actors from impersonating their brand, safeguarding their reputation and customer trust. A compromised brand can lead to significant financial losses and erosion of customer loyalty.
- Deliverability: Senders who consistently authenticate their mail and enforce DMARC policies are viewed as more trustworthy by mailbox providers, leading to improved deliverability rates for their legitimate communications. This directly impacts marketing campaigns, transactional emails, and critical business communications.
- Regulatory Compliance: Emerging data privacy regulations and cybersecurity mandates often implicitly or explicitly encourage robust email security measures, including DMARC, as part of a broader risk management strategy.
In early 2024, Google and Yahoo notably implemented new bulk sender requirements, mandating DMARC enforcement (at a policy of ‘p=none’ or stricter) for senders sending more than 5,000 emails per day to their users. While the immediate requirement was for basic DMARC deployment, these policies signaled a clear trajectory towards stricter enforcement and a higher bar for email senders. The updated DMARC RFCs provide the standardized, authoritative framework upon which these evolving requirements can be consistently built and enforced across the industry. An email security analyst noted, "This formalization of DMARC is perfectly timed. It provides a solid, shared foundation just as mailbox providers are escalating their demands for authenticated email. Non-compliance is no longer an edge case; it’s a direct path to the spam folder, or worse, outright rejection. Businesses neglecting DMARC are essentially accepting significant operational risks."
DMARC’s Core Mechanics: Alignment Remains Key
Despite the technical updates, the practical takeaway for email senders, including customers of platforms like Mailjet, remains straightforward: DMARC has been modernized, not reinvented. Your fundamental responsibility as a sender is still to authenticate your email using SPF and DKIM, ensure your authenticated domains align with your visible ‘From’ address, and diligently monitor your DMARC reporting.
A quick refresher on DMARC’s core mechanism reveals its enduring simplicity and power:
- Visible ‘From’ Address: This is the email address that recipients see in their inbox (e.g.,
[email protected]). This is the identity DMARC protects. - SPF Alignment: DMARC checks if the domain in the ‘Return-Path’ (also known as ‘MAIL FROM’ or ‘Envelope From’) aligns with the domain in the visible ‘From:’ address. If SPF passes for the ‘Return-Path’ domain and these domains align, SPF alignment for DMARC is achieved. Alignment can be ‘relaxed’ (where the organizational domains match, e.g.,
sub.example.comaligns withexample.com) or ‘strict’ (where the exact domains must match, e.g.,example.commust align withexample.com). - DKIM Alignment: DMARC checks if the domain in the ‘d=’ tag within the DKIM signature (which identifies the signing domain) aligns with the domain in the visible ‘From:’ address. If DKIM passes for the signing domain and these domains align, DKIM alignment for DMARC is achieved. Like SPF, DKIM alignment can be ‘relaxed’ or ‘strict’, following similar rules for organizational vs. exact domain matching.
For a DMARC check to pass, only one of these aligned authenticated identifiers (either SPF or DKIM) needs to succeed. It is not necessary for both SPF and DKIM to align simultaneously, though having both provides a robust fallback mechanism and enhances overall email resilience. The Mailjet DMARC help center article (linked within the original context) reinforces this point, clarifying that "one aligned authenticated identifier is enough for DMARC to pass."
The Critical Role of DMARC Reporting
The new RFCs, particularly 9990 and 9991, underscore the importance of DMARC’s reporting features. These reports are the eyes and ears for domain owners, providing crucial intelligence about their email ecosystem:
- Aggregate Reports (RUAs): These XML-formatted reports are sent daily to the email address specified in the DMARC record’s
ruatag. They summarize the DMARC authentication results for all emails purporting to be from your domain, categorized by sending IP, authentication result (pass/fail), and disposition (none, quarantine, reject). Analyzing RUA reports is essential for
