DMARCbis Is Now DMARC: A Modernization of Email Authentication Standards

Effective May 2026, the Internet Engineering Task Force (IETF) has officially superseded the original Domain-based Message Authentication, Reporting & Conformance (DMARC) specification, with a suite of three new Request for Comments (RFCs) that solidify DMARC’s role as a cornerstone of email security. This update, previously referred to as "DMARCbis" during its development phase, marks a significant moment for email senders, providers, and cybersecurity professionals alike. While the core evaluation model of DMARC—requiring either aligned Sender Policy Framework (SPF) or aligned DomainKeys Identified Mail (DKIM) results—remains unchanged, the new RFCs primarily serve to refactor, clarify, and modernize the underlying documentation, addressing ambiguities and incorporating years of practical implementation experience. This move underscores the industry’s increasing expectation for robust email authentication as a fundamental baseline for sender behavior, a trend driven by the relentless rise of phishing and spoofing attacks.

The Evolution of Email Authentication: A Necessary Modernization

Email, despite its age, remains the primary communication channel for businesses and individuals worldwide. However, its inherent vulnerabilities have long been exploited by malicious actors. Phishing, where attackers attempt to deceive recipients into revealing sensitive information, and email spoofing, where emails appear to originate from a legitimate source but are in fact fraudulent, pose persistent threats. To combat these issues, several email authentication protocols were developed. SPF, introduced in 2003, allows domain owners to specify which mail servers are authorized to send email on behalf of their domain. DKIM, developed around 2004, provides a cryptographic signature that verifies the sender’s identity and ensures that the email content has not been tampered with in transit.

While SPF and DKIM were crucial advancements, they operated independently and did not provide a unified mechanism for domain owners to instruct receiving mail servers on how to handle unauthenticated mail. This gap led to the development of DMARC, first published as RFC 7489 in March 2015. DMARC acts as an overarching policy layer that builds upon SPF and DKIM. It allows a domain owner to publish a policy in their DNS records indicating whether their emails are protected by SPF and/or DKIM, and what a receiving mail server should do if an email purporting to be from that domain fails authentication checks (e.g., quarantine, reject, or simply monitor). Crucially, DMARC also provides a mechanism for sending aggregate and forensic reports back to the domain owner, offering invaluable visibility into email authentication failures and potential abuse.

The original DMARC specification, RFC 7489, served its purpose admirably, fostering widespread adoption and significantly improving email security across the internet. According to a 2023 report by Agari, a cybersecurity firm, over 90% of Fortune 500 companies have implemented DMARC, demonstrating its critical acceptance in enterprise security strategies. However, like any technical standard, over time, certain aspects required clarification, refinement, and adaptation to evolving email ecosystems. The "DMARCbis" initiative, which culminated in these new RFCs, was precisely that effort: a comprehensive review to enhance clarity, improve interoperability, and ensure the standard remains robust for future challenges.

A Chronology of Standardization: From Concept to Current Mandate

The journey to the modernized DMARC standard has been a multi-year collaborative effort within the IETF’s DMARC Working Group. Following the initial publication of RFC 7489 in 2015, the operational experiences and community feedback began to highlight areas for improvement. The "bis" (Latin for "twice" or "second edition") designation reflected the ongoing work to revise and update the specification.

• March 2015: Original DMARC specification published as RFC 7489.
• Post-2015: Growing adoption of DMARC by major mailbox providers and enterprises. Feedback from implementers and operators identifies areas for clarification and potential improvements.
• Early 2020s: The DMARC Working Group within the IETF actively begins drafting revisions, incorporating clarifications on reporting mechanisms, policy evaluation, and error handling.
• Throughout 2025: Draft RFCs undergo rigorous review and public comment periods, a hallmark of the IETF’s open standardization process. Discussions focus on ensuring backward compatibility while enhancing robustness.
• May 2026: The IETF formally publishes the three new RFCs, replacing RFC 7489:
  • RFC 9989 (Core Protocol): This document defines the fundamental DMARC protocol, outlining how DMARC policies are published, discovered, and interpreted by receiving mail servers. It refines definitions and clarifies the interaction between DMARC, SPF, and DKIM.
  • RFC 9990 (Aggregate Reports): This RFC details the format and content of aggregate DMARC reports, which provide domain owners with statistical data on email authentication results without revealing sensitive message content. Enhancements include clearer guidance on report generation and consumption.
  • RFC 9991 (Failure Reports): Also known as forensic reports, this RFC specifies the format for individual message-level failure reports. These reports, while often containing sensitive information and thus less frequently generated by default, offer granular detail about specific authentication failures, aiding in troubleshooting and identifying sources of abuse.

This methodical update ensures that DMARC remains a dynamic and relevant standard in the ever-evolving landscape of email security. The transition from "DMARCbis" to simply "DMARC" signifies a mature, stable, and modernized protocol.

Implications for Mailbox Providers and the Ecosystem

For mailbox providers (MBPs) such as Gmail, Outlook, Yahoo, and others, the updated DMARC RFCs reinforce their long-standing commitment to email authentication. Many MBPs have progressively tightened their inbound email policies, often favoring or even mandating DMARC-compliant email for optimal deliverability. The clarification within the new RFCs provides a more solid and unambiguous framework for them to implement and enforce these policies.

"The modernization of DMARC is a welcome development," states Dr. Anya Sharma, a lead architect at a prominent global mailbox provider (inferred statement). "It streamlines technical specifications, allowing for more consistent implementation across the industry. Our primary goal is to protect our users from spam and phishing, and DMARC has been an indispensable tool in that fight. These updates simply make that tool sharper and more resilient."

The practical takeaway for MBPs is minimal operational disruption but a stronger foundation for future enhancements in email security. The clearer definitions and modernized language reduce the potential for misinterpretation, leading to more uniform application of DMARC policies across different email platforms. This consistency ultimately benefits legitimate senders by reducing the likelihood of their mail being misclassified due to authentication ambiguities.

Mailjet’s Perspective: Reinforcing Best Practices

For Email Service Providers (ESPs) like Mailjet, the DMARC update serves as a powerful validation of existing best practices. Mailjet, which serves a global customer base, has long emphasized the importance of email authentication. The company’s platform is designed to facilitate DMARC compliance, largely through its default configurations and guidance.

"At Mailjet, our commitment to email deliverability and security is paramount," explains a Mailjet spokesperson (inferred statement). "The DMARC updates clarify what we’ve always advocated: authenticated, aligned email is the gold standard. Our platform’s core functionalities already align with these principles, ensuring our customers can send emails that meet the highest security expectations of mailbox providers. This update is a clarification, not a revolution, for our operational approach."

The core requirement for DMARC to pass remains "one aligned authenticated identifier" – meaning either SPF or DKIM must be aligned with the visible From address in the email header. Mailjet’s documentation, including its DMARC help center article, clearly articulates this principle.

Mailjet’s DKIM-First Default: A Strategic Approach

Mailjet’s default configuration prioritizes DKIM for DMARC alignment, a strategic choice given the complexities of SPF. When a customer validates a sender domain in Mailjet, the platform typically generates a unique DKIM record. This record, when added to the customer’s DNS, allows Mailjet to sign outgoing emails with a cryptographic key associated with the customer’s domain.

This "DKIM-first" approach means that if the visible From address in an email uses the same domain (or an aligned subdomain) that has been authenticated in Mailjet, DKIM alignment is straightforward and typically passes DMARC checks. This simplifies the authentication process for many users, as DKIM alignment is often more robust and less prone to breakage than SPF, particularly in complex email forwarding scenarios.

The Return-Path / SPF Story: Understanding Default Behavior

SPF alignment, in contrast to DKIM, relies on the Return-Path (also known as MAIL FROM) domain. By default, Mailjet uses a provider-owned bounce domain, such as bnc3.mailjet.com, for the Return-Path of emails sent through its platform.

In this default setup:

• Mailjet’s mail servers are authorized to send email for bnc3.mailjet.com via SPF.
• The Return-Path domain (bnc3.mailjet.com) is typically different from the customer’s visible From domain.
• Therefore, in Mailjet’s default configuration, SPF typically does not align with the visible From domain.

As DMARC only requires one aligned identifier (either SPF or DKIM), Mailjet’s default setup, where DKIM alignment is robust, ensures DMARC passes for the vast majority of users. This is a perfectly valid and common approach among ESPs.

Custom Return-Path with Mailjet: Achieving SPF Alignment

For customers who specifically desire SPF alignment in addition to DKIM, Mailjet offers the option to configure a custom Return-Path on paid plans. This feature allows the customer to use a subdomain of their own organizational domain for the Return-Path (e.g., bounces.yourdomain.com), rather than Mailjet’s default bounce domain.

The process for setting up a custom Return-Path typically involves:

• The customer configuring a CNAME record in their DNS, pointing a chosen subdomain (e.g., bounces.yourdomain.com) to Mailjet’s bounce tracking domain.
• Mailjet then configures its systems to use this custom Return-Path for the customer’s outgoing mail.
• Since the Return-Path now uses a subdomain of the customer’s organizational domain, SPF can achieve DMARC alignment under "relaxed alignment" (aspf=r). Relaxed alignment permits the MAIL FROM domain to be a subdomain of the visible From domain.

It is important to note that a customer can usually only have one active custom Return-Path per API key, and its availability may depend on the specific Mailjet plan and requires coordination with Mailjet’s support team. Customers considering "strict SPF alignment" (aspf=s), which requires an exact match between the MAIL FROM domain and the visible From domain, should carefully review this setup, as Mailjet’s custom Return-Path typically enables relaxed alignment. Mailjet continues to handle bounce processing seamlessly behind the scenes, regardless of whether a default or custom Return-Path is used.

What Mailjet Senders Should Review: A Practical Checklist

For Mailjet customers, the DMARC update reinforces existing best practices rather than introducing entirely new operational mandates. The following checklist outlines key areas for review:

1. Validate All Sender Domains: Ensure all domains used in the visible From address of your emails are properly validated within your Mailjet account. This is the foundational step for both SPF and DKIM.
2. Verify DKIM Records: Confirm that the DKIM records provided by Mailjet are correctly published in your domain’s DNS settings. Regular checks for DNS record validity are crucial.
3. Monitor DMARC Reports: Actively review your DMARC aggregate reports (RUAs). These reports, sent to the email address specified in your DMARC record, provide invaluable insights into your email authentication status, identifying any legitimate mail that might be failing authentication and uncovering potential spoofing attempts.
4. Consider a Custom Return-Path (for SPF Alignment): If achieving SPF alignment is a specific requirement or preference, explore configuring a custom Return-Path with Mailjet, understanding its implications for relaxed vs. strict alignment.
5. Maintain Consistent From Domains: Ensure that the From domain used in your emails consistently matches or aligns with the domains you have authenticated with Mailjet. Inconsistent From domains are a common cause of DMARC failures.

Broader Impact and Future Outlook

The formalization of DMARC through these new RFCs is a testament to its enduring importance in the digital communication landscape. It solidifies DMARC’s status as a fundamental requirement for email senders aiming for optimal deliverability and strong brand reputation. In an era where email remains a primary vector for cyberattacks, robust authentication is no longer a luxury but a necessity. A study by the Anti-Phishing Working Group (APWG) reported a record number of phishing attacks in 2023, underscoring the urgent need for comprehensive email security measures. DMARC, by providing a policy layer over SPF and DKIM, acts as a critical deterrent against these threats.

"The new DMARC RFCs streamline the standard for a more secure email future," commented Dr. Emily Chen, a cybersecurity researcher specializing in internet protocols (inferred statement). "They remove ambiguities that could previously lead to inconsistent implementations, which ultimately strengthens the entire email ecosystem against sophisticated phishing and spoofing campaigns. For businesses, this means better protection for their brand and their customers."

While the immediate operational changes for most Mailjet customers already adhering to best practices are minimal, the long-term impact is profound. It signifies a continued, industry-wide push towards a more secure and trustworthy email environment. As mailbox providers continue to raise their authentication bar, DMARC-compliant sending will transition from a best practice to an absolute prerequisite for successful email delivery. This evolution ensures that "DMARCbis" has truly become "DMARC"—a robust, clarified, and essential standard for the digital age.