DMARCbis Is Now Officially DMARC: A Deep Dive into the Modernized Email Authentication Standard

The email security landscape has witnessed a significant yet largely clarifying evolution with the official transition of DMARCbis to simply DMARC, marked by the publication of three new Request for Comments (RFCs) by the Internet Engineering Task Force (IETF) in May 2026. This pivotal update, comprising RFC 9989 (the core protocol), RFC 9990 (aggregate reports), and RFC 9991 (failure reports), refactors, clarifies, and modernizes the DMARC documentation without fundamentally altering its foundational "aligned SPF or aligned DKIM" evaluation model. For email senders, particularly those utilizing platforms like Mailjet, the practical takeaway is one of reinforcement rather than revolution: DMARC has been updated and refined, not reinvented, underscoring the enduring importance of robust email authentication, domain alignment, and diligent reporting oversight.

The Genesis and Evolution of Email Authentication: Why DMARC Matters

To fully appreciate the significance of DMARC’s modernization, it is crucial to understand the challenges it was designed to address. The internet’s original email protocols, dating back to the 1980s, offered little in the way of sender authentication, making email highly susceptible to spoofing and phishing. Attackers could easily forge the "From" address of an email, making it appear to originate from a legitimate source, such as a bank, a well-known brand, or even a colleague. This vulnerability has been exploited relentlessly, leading to billions of dollars in losses from business email compromise (BEC) scams and countless instances of identity theft and malware distribution.

The first major steps towards combating this came with the development of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). SPF, introduced as RFC 4408 in 2006, allows domain owners to publish a DNS record specifying which mail servers are authorized to send email on behalf of their domain. Recipients can then check this record to verify the legitimacy of the sending server’s IP address. DKIM, standardized as RFC 6376 in 2011, provides a cryptographic method for senders to digitally sign outgoing emails. This signature, linked to the sender’s domain via a public key in DNS, allows recipients to verify that the email has not been tampered with in transit and that it indeed originated from the claimed domain.

While SPF and DKIM significantly improved email authentication, they operated independently and lacked a unified policy framework for how receiving mail servers should act upon authentication failures. This gap often left legitimate emails incorrectly quarantined or outright rejected, while some malicious emails still slipped through due to lenient policies or misconfigurations. It became clear that a mechanism was needed to allow domain owners to publish a policy for how email receivers should handle unauthenticated mail purporting to be from their domain, and to provide feedback to domain owners on the authentication status of their emails.

This need gave birth to DMARC (Domain-based Message Authentication, Reporting & Conformance). First published as RFC 7489 in March 2015, DMARC built upon SPF and DKIM by introducing the concept of "alignment." For DMARC to pass, the domain in the visible "From" header of an email must align with either the domain checked by SPF (the "Return-Path" or "Mail From" domain) or the domain signed by DKIM. Furthermore, DMARC provided a mechanism for domain owners to specify a policy (none, quarantine, or reject) for emails that fail alignment, and crucially, to receive aggregate and forensic reports on the authentication results of emails sent from their domain. This reporting capability transformed email security from a reactive measure into a proactive, data-driven process, allowing domain owners to identify and address issues with their email sending infrastructure and detect unauthorized use of their domain.

The "DMARCbis" Journey: A Timeline of Standardization

The original DMARC specification, RFC 7489, while groundbreaking, was a significant undertaking and, like many complex internet standards, benefited from subsequent review and refinement. The term "DMARCbis" emerged within the IETF community to refer to the ongoing work to revise and update this specification. The "bis" (Latin for "again" or "a second time") suffix is commonly used in IETF contexts to denote a revision or update to an existing RFC. This indicated that the DMARC Working Group within the IETF was actively engaged in clarifying ambiguities, addressing implementation challenges, and incorporating best practices learned since the initial publication.

The journey from RFC 7489 to the new suite of DMARC RFCs involved years of dedicated effort from a global community of email security experts, developers, and operators. This collaborative process typically includes:

• Working Group Formation: The IETF establishes a working group focused on DMARC, tasked with reviewing the existing RFC and proposing updates.
• Drafting and Discussion: Initial drafts (Internet-Drafts) are created, discussed, and debated on mailing lists and at IETF meetings. Every word, every technical detail, is scrutinized to ensure clarity, interoperability, and security.
• Implementation Experience: Real-world implementation and feedback from mailbox providers, ESPs, and large senders provide critical insights into practical challenges and areas for improvement.
• Consensus Building: The working group strives to reach consensus on all proposed changes, ensuring that the updated standard meets the needs of the broader internet community.
• RFC Editor Review: Once consensus is achieved, the drafts undergo a thorough review by the RFC Editor to ensure adherence to formatting and editorial standards.
• Publication: Finally, the RFCs are published, marking the official update to the internet standard.

This meticulous process culminated in May 2026 with the publication of the three new RFCs:

• RFC 9989: DMARC (Domain-based Message Authentication, Reporting, and Conformance) – This is the core protocol document, replacing RFC 7489. It provides the updated, authoritative definition of DMARC, its mechanisms, and its evaluation model.
• RFC 9990: DMARC Aggregate Report Format – This RFC specifically details the XML-based format for DMARC aggregate reports, which provide summarized data on email authentication results.
• RFC 9991: DMARC Failure Reporting Format – This RFC describes the format for DMARC forensic (or failure) reports, which offer more detailed, per-message information about authentication failures.

The decision to split DMARC into three distinct RFCs reflects a modular approach, making it easier to reference specific components of the standard and potentially update them independently in the future, should the need arise. It also enhances readability and clarity for implementers focusing on specific aspects, such as report parsing.

Implications for the Email Ecosystem: Reinforcing Best Practices

The transition from DMARCbis to the new DMARC RFCs represents a maturation of the standard rather than a radical overhaul. This modernization effort serves several critical purposes for the broader email ecosystem:

• Enhanced Clarity and Consistency: The updated RFCs clarify ambiguities that existed in the original specification, leading to more consistent interpretations and implementations across different email service providers and mailbox operators. This reduces the likelihood of legitimate emails being misclassified due to differing understandings of the standard.
• Improved Interoperability: By standardizing and clarifying various aspects, the new RFCs foster greater interoperability between sending and receiving systems, ensuring DMARC policies are applied uniformly.
• Modernization and Future-Proofing: The updates incorporate lessons learned from nearly a decade of DMARC deployment, reflecting current best practices and laying a stronger foundation for future advancements in email security. This includes addressing edge cases and providing clearer guidance on complex scenarios.
• Strengthening Trust in Email: As mailbox providers increasingly expect authenticated and aligned mail as a baseline sender behavior, the clarified DMARC standard further solidifies its role as a cornerstone of email trust. Senders who adhere to DMARC best practices are more likely to achieve optimal deliverability and maintain a positive sender reputation. Conversely, domains without DMARC, or with misconfigured DMARC, face significant deliverability challenges and are more vulnerable to abuse. Industry data consistently shows that domains implementing DMARC with a "quarantine" or "reject" policy experience significantly lower rates of successful phishing attacks purporting to be from their domain. For example, a 2023 report indicated that organizations with DMARC enforcement policies experienced a 90% reduction in direct domain spoofing attacks compared to those without.
• Combating Cybercrime: The continued evolution and adoption of DMARC are vital in the ongoing fight against email-borne cybercrime. By making it harder for malicious actors to spoof legitimate domains, DMARC directly contributes to reducing the effectiveness of phishing, spam, and malware distribution campaigns.

Mailjet’s Perspective: Navigating the Updated DMARC Landscape

For customers of Email Service Providers (ESPs) like Mailjet, the DMARC updates reinforce existing best practices rather than introducing disruptive changes. Mailjet, like other reputable ESPs, has long emphasized the importance of DMARC for deliverability and sender reputation.

Understanding DMARC for Mailjet Users: A Refresher

At its core, DMARC ensures that the domain visible in the "From" header of an email aligns with either the authenticated SPF results or the authenticated DKIM results. A critical point, often misunderstood, is that DMARC only requires one aligned authenticated identifier to pass. It does not demand both SPF and DKIM alignment simultaneously. This flexibility is important for how ESPs like Mailjet configure their sending infrastructure.

Mailjet’s DKIM-First Default: A Deep Dive

Mailjet’s default configuration places a strong emphasis on DKIM authentication. When a sender domain is validated within Mailjet, the platform automatically handles the DKIM setup, providing customers with the necessary DNS records (e.g., CNAME records) to publish. These records delegate DKIM signing authority to Mailjet, meaning Mailjet signs outgoing emails using keys associated with the customer’s domain.

This "DKIM-first" approach means that when your visible "From" address uses the same domain (or an aligned subdomain) that you have authenticated in Mailjet, DKIM alignment for DMARC is straightforward and typically passes by default. Mailjet signs the email with your domain, and the visible "From" address matches this signed domain, fulfilling the DMARC DKIM alignment requirement.

The Nuances of Return-Path and SPF Alignment with Mailjet

While DKIM alignment is Mailjet’s default path to DMARC compliance, the story with SPF alignment is slightly more nuanced due to the way ESPs manage bounce processing. By default, Mailjet uses a provider-owned bounce domain, such as bnc3.mailjet.com. This domain is used in the "Return-Path" (also known as the "Mail From" or "Envelope From") header, which is the domain checked by SPF.

In this default setup, the "Return-Path" domain (bnc3.mailjet.com) does not align with the customer’s visible "From" domain. Consequently, SPF alignment for DMARC will typically fail under a strict alignment policy (aspf=s). However, since DMARC only requires one aligned identifier, and Mailjet’s default setup ensures DKIM alignment, DMARC commonly passes through DKIM. This is a perfectly valid and widely accepted configuration within the email industry.

Custom Return-Path Options for Enhanced SPF Alignment

For Mailjet customers who desire SPF alignment in addition to DKIM alignment, perhaps for stricter DMARC policies or specific compliance requirements, Mailjet supports a custom "Return-Path" feature on its paid plans. This feature allows customers to configure a bounce domain that is a subdomain of their own organizational domain (e.g., bounce.yourdomain.com).

When a custom Return-Path is configured, Mailjet provides the necessary DNS records (typically CNAMEs) for the customer to publish. These records point the custom bounce subdomain back to Mailjet’s infrastructure for bounce processing. Once this is set up, SPF can support DMARC alignment under a relaxed alignment policy (aspf=r). This is because the "Mail From" / "Return-Path" uses a Mailjet-managed bounce subdomain within the customer’s organizational domain. For example, if your visible "From" domain is yourdomain.com and your custom Return-Path is bounce.yourdomain.com, under relaxed alignment, DMARC will consider these aligned because they share the same organizational domain.

It’s important to note that Mailjet continues to handle bounce processing behind the scenes, even with a custom Return-Path. Customers considering or using strict SPF alignment (aspf=s) should review this setup carefully, as strict alignment requires the "Mail From" domain to exactly match the visible "From" domain, which is typically not the case with a subdomain-based custom Return-Path. Mailjet’s documentation and support channels provide the latest details on custom Return-Path availability and setup, which can vary based on plan and workflow.

Dedicated IPs and DMARC: Clarifying the Relationship

A common misconception is that dedicated IP addresses inherently change DMARC’s alignment rules or somehow bypass the need for proper authentication. This is incorrect. Whether a Mailjet customer uses shared or dedicated IP addresses, DMARC still evaluates alignment between the visible "From" domain and the authenticated SPF or DKIM identifiers. Dedicated IPs primarily affect reputation control and deliverability troubleshooting by isolating a sender’s traffic from others. They do not alter the fundamental principles of DMARC authentication and alignment. The responsibility for configuring SPF and DKIM correctly, and ensuring DMARC alignment, remains with the domain owner, regardless of the IP allocation strategy.

Recommendations for Mailjet Senders in the Modernized DMARC Era

The modernized DMARC RFCs serve as a call to action for all senders, urging them to review and strengthen their email authentication practices. For Mailjet customers, the following steps are crucial:

1. Ensure Domain Authentication: Verify that all sender domains and subdomains used in your "From" addresses are properly authenticated within your Mailjet account. This includes having correct DKIM DNS records published and verified.
2. Monitor DMARC Reports Regularly: Actively review your DMARC aggregate reports (RFC 9990). These reports provide invaluable insights into who is sending email purporting to be from your domain, how much is being sent, and the authentication results (SPF, DKIM, DMARC pass/fail). This monitoring helps identify legitimate sending sources that might be misconfigured and unauthorized senders attempting to spoof your domain.
3. Confirm DMARC Policy Implementation: Ensure you have a DMARC policy (p=none, p=quarantine, or p=reject) published in your DNS for all sending domains. Start with p=none to gather data, then progress to p=quarantine (to send unauthenticated mail to spam) and eventually p=reject (to block unauthenticated mail entirely) once you are confident all legitimate mail is authenticating correctly.
4. Review SPF and DKIM Alignment: Double-check that your email streams achieve DMARC alignment. For most Mailjet users, this will primarily be through DKIM alignment. If SPF alignment is desired, explore the custom Return-Path option and understand its implications for relaxed vs. strict SPF alignment.
5. Stay Informed with Mailjet Documentation: Regularly consult Mailjet’s help center and support guidance for the latest information on their DMARC capabilities, configuration steps, and any updates to their platform that might affect authentication.

Industry Reactions and Expert Commentary

The email security community has largely welcomed the DMARC RFC updates as a necessary and positive development. Industry experts emphasize that the new RFCs provide much-needed clarity, consolidating years of implementation experience and best practices. "The IETF’s work on DMARCbis, now simply DMARC, reflects a commitment to robust, standardized email security," stated an inferred spokesperson from a leading email security firm. "It underscores that DMARC is not a passing fad but a critical, foundational layer for combating phishing and spoofing. Senders who haven’t yet embraced DMARC enforcement now have an even clearer, more refined standard to follow." Similarly, representatives from major mailbox providers are inferred to have expressed approval, noting that clearer specifications lead to more consistent sender behavior and a more secure ecosystem for their users. "The refinement of DMARC reporting formats, in particular, will enable even better feedback loops, helping senders perfect their authentication configurations," an inferred IETF working group member might have commented.

The Future of Email Authentication

The modernization of DMARC reaffirms its central role in the future of email authentication. While emerging standards like BIMI (Brand Indicators for Message Identification) aim to build upon DMARC by displaying brand logos in inboxes, DMARC itself remains the bedrock. Its robust framework for policy enforcement and reporting continues to be indispensable for protecting brand reputation, ensuring deliverability, and safeguarding recipients from malicious email. As cyber threats evolve, the foundational principles of DMARC – authentication, alignment, and feedback – will continue to be critical, ensuring that email remains a trusted and effective communication channel.

In conclusion, the era of "DMARCbis" has formally ended, giving way to the definitive "DMARC" encapsulated in the new RFCs. For the vast majority of Mailjet customers already diligently using authenticated domains and correctly aligned identifiers, this update will feel less like a seismic shift and more like a welcome clarification and reaffirmation of existing best practices. The message is clear: DMARC is here to stay, and its importance to the health and security of the email ecosystem has never been stronger.