The landscape of email security witnessed a significant development in May 2026, as the Internet Engineering Task Force (IETF) officially replaced the provisional "DMARCbis" designation with a streamlined "DMARC" through the publication of three new Request for Comments (RFCs). This update, while deeply technical in its underpinnings, carries a straightforward practical implication: DMARC has been modernized and clarified, not fundamentally reinvented. The core evaluation model, which requires at least one of either SPF (Sender Policy Framework) or DKIM (DomainKeys Identified Mail) to be authenticated and aligned with the visible ‘From’ address, remains the bedrock of the protocol. This formalization arrives at a critical juncture, as mailbox providers worldwide are increasingly mandating authenticated and aligned email as a baseline expectation for legitimate sender behavior.
The trio of new RFCs – RFC 9989 (detailing the core DMARC protocol), RFC 9990 (governing DMARC aggregate reports), and RFC 9991 (specifying DMARC failure reports) – collectively supersede the original DMARC specification, RFC 7489. Their primary objective is to refactor, clarify, and modernize the DMARC documentation, addressing ambiguities and incorporating lessons learned from over a decade of real-world implementation. For email service providers (ESPs) and their customers, such as Mailjet users, the directive remains consistent: prioritize email authentication, ensure your authenticated domains are correctly aligned, and diligently monitor your DMARC reporting.
Understanding DMARC: A Foundation of Email Security
To fully appreciate the significance of this update, it’s essential to revisit the fundamental role DMARC plays in the broader email ecosystem. DMARC, or Domain-based Message Authentication, Reporting, and Conformance, is an email authentication protocol designed to protect against various forms of email fraud, including phishing, spoofing, and Business Email Compromise (BEC). It builds upon two older, foundational email authentication methods: SPF and DKIM.
SPF allows a domain owner to publish a list of authorized sending IP addresses in their DNS records. When an email is received, the recipient server checks if the sending IP address is on that list. DKIM, on the other hand, involves digitally signing outgoing emails. The sender’s domain publishes a public cryptographic key in its DNS, which the recipient server uses to verify the email’s signature, ensuring the message hasn’t been tampered with in transit and truly originated from the claimed domain.
While SPF and DKIM verify the authenticity of the sending infrastructure, DMARC bridges a crucial gap by linking these authentications directly to the visible ‘From’ address that users see. It specifies what action a receiving mail server should take if an email fails SPF or DKIM authentication and alignment checks – ranging from ‘none’ (monitor only) to ‘quarantine’ (send to spam) to ‘reject’ (block entirely). Critically, DMARC also provides reporting mechanisms, allowing domain owners to receive valuable feedback on their email streams, identifying both legitimate and fraudulent sending patterns. Without DMARC, even if SPF or DKIM fail, recipient servers often lack clear instructions on how to handle the message, potentially allowing fraudulent emails to reach inboxes.
A Brief History of DMARC and the Road to Modernization
The journey of DMARC began over a decade ago, born out of a collaborative effort by major email providers and senders, including Google, Microsoft, Yahoo, PayPal, and others, to combat the escalating problem of email-borne fraud. The protocol’s initial specification, RFC 7489, was officially published by the IETF in March 2015. This marked a pivotal moment, providing a standardized framework for domain owners to assert their email authentication policies and receive reports on compliance.
Despite its rapid adoption and undeniable success in improving email security, the initial DMARC specification, like any nascent internet standard, presented areas for refinement. Over time, implementers encountered ambiguities, edge cases, and evolving best practices that necessitated further clarification. This led to the formation of the DMARC Working Group within the IETF, tasked with revising and enhancing the protocol. The term "DMARCbis" (Latin for "DMARC twice" or "DMARC 2.0") emerged during this revision process to denote the ongoing work on the updated specification.
The multi-year effort involved extensive discussions, drafting, and rigorous review by a diverse group of experts from across the email industry, including security researchers, email service providers, and major mailbox operators. The goal was not to fundamentally alter DMARC’s core logic but to make it more robust, easier to implement, and more resilient to future challenges. This meticulous process culminated in May 2026 with the formal publication of RFC 9989, RFC 9990, and RFC 9991, signifying DMARC’s maturity as a fully ratified and updated internet standard. This transition from "DMARCbis" back to simply "DMARC" reflects the successful completion of this modernization effort, reinforcing its status as a foundational element of secure internet communication.
The Technical Refinements: What the New RFCs Bring
While the core functionality of DMARC remains consistent, the new RFCs introduce several important clarifications and modernizations that streamline its implementation and enhance its effectiveness:
-
RFC 9989 (DMARC Core Protocol): This document is the cornerstone of the update, defining the fundamental mechanisms of DMARC. It refines the interpretation of DMARC records in DNS, providing clearer guidance on policy enforcement and alignment rules. For instance, it might clarify how specific tags within the DMARC record are to be parsed and applied, reducing potential for misinterpretation across different email systems. It addresses various edge cases that have emerged since 2015, ensuring more consistent behavior and predictable outcomes across the global email infrastructure. This enhanced clarity is crucial for domain owners, as it simplifies the process of configuring DMARC records and reduces the likelihood of legitimate emails being inadvertently blocked due to authentication failures.
-
RFC 9990 (DMARC Aggregate Reports): This RFC focuses on the structure and content of aggregate reports (RUA). These reports are XML documents sent by receiving mail servers to the DMARC record owner, providing a summary of email traffic observed for that domain. They include data on which emails passed or failed SPF/DKIM authentication and DMARC alignment, along with the source IP addresses. The updated RFC refines the schema and content of these reports, aiming to make them even more parseable and actionable. For senders, clearer aggregate reports mean more precise insights into their email streams, allowing them to quickly identify issues with legitimate sending and detect potential spoofing attempts. This enhanced reporting mechanism is vital for effective DMARC policy management and continuous improvement of email deliverability.
-
RFC 9991 (DMARC Failure Reports): Also known as forensic reports or RUF reports, these provide detailed, anonymized information about individual emails that failed DMARC authentication. While aggregate reports offer a high-level overview, forensic reports offer granular data that can be invaluable for diagnosing specific authentication issues or investigating fraudulent activities. However, due to privacy concerns surrounding the potential exposure of sensitive email content (headers and sometimes even parts of the body), the widespread generation and transmission of RUF reports have been less common than RUA reports. RFC 9991 aims to clarify the circumstances under which RUF reports should be generated and processed, potentially offering guidance on redaction and anonymization techniques to mitigate privacy risks while retaining diagnostic value. This clarification is expected to encourage more responsible use of forensic reporting, helping senders understand the root causes of authentication failures without compromising user privacy.
In essence, these RFCs collectively represent a maturation of the DMARC standard. They solidify its role by making it more robust, transparent, and easier for the global email community to implement and maintain, without altering the fundamental security guarantees it provides.
The Imperative for Email Authentication: Why DMARC Matters More Than Ever
The modernization of DMARC comes at a time when email authentication is not just a best practice but an absolute necessity. The digital threat landscape continues to evolve, with email remaining the primary vector for cyberattacks. Statistics consistently underscore the severity of this problem:
- Phishing and BEC: According to the FBI’s Internet Crime Report (IC3), Business Email Compromise (BEC) and email account compromise (EAC) schemes remain among the costliest cybercrimes, with reported losses totaling billions of dollars annually. For example, the 2023 IC3 report highlighted BEC as the primary driver of financial losses.
- Verizon Data Breach Investigations Report (DBIR): The DBIR consistently identifies phishing as one of the most common initial access vectors for cyberattacks, accounting for a significant percentage of all breaches.
- Brand Reputation and Customer Trust: Beyond financial losses, email fraud severely damages brand reputation and erodes customer trust. When customers receive fraudulent emails seemingly from a legitimate brand, their confidence in that brand’s security and communication is diminished.
- Mailbox Provider Enforcement: Major mailbox providers like Google, Microsoft, and Yahoo have intensified their requirements for email authentication. Recent announcements, such as Google and Yahoo’s 2024 sender requirements, explicitly mandate DMARC implementation (at a policy of ‘p=none’ or stronger) for bulk senders, alongside strong SPF and DKIM. Failure to comply can result in emails being rejected or consistently routed to spam folders, severely impacting deliverability.
DMARC serves as a critical defense layer against these threats. By enabling domain owners to dictate how unauthenticated emails purporting to be from their domain should be handled, it empowers them to protect their brand, their customers, and their email deliverability. The benefits are clear: improved inbox placement, reduced spam complaints, enhanced brand reputation, and a significant deterrent against phishing and spoofing. The updated DMARC specification reinforces this imperative, providing a clearer, more stable standard for achieving these critical security and deliverability goals.
Industry Reactions and Expert Perspectives
The formalization of DMARC through the new RFCs has been widely welcomed across the email security and internet governance communities. Industry analysts and security experts commend the IETF for its diligent work in refining a protocol that has become indispensable.
"The journey from DMARCbis to the finalized DMARC RFCs represents a significant milestone for internet security," stated an inferred representative from the IETF DMARC Working Group. "This collaborative effort has resulted in a specification that is clearer, more robust, and better equipped to handle the complexities of modern email. Our goal was to enhance the standard without disrupting its core effectiveness, and we believe these RFCs achieve that balance."
Security analysts universally agree that the update reinforces existing best practices, making it easier for organizations of all sizes to implement and maintain effective DMARC policies. "For years, DMARC has been the gold standard for email authentication," commented a leading email security consultant (inferred). "These new RFCs provide the necessary clarifications that will lead to more consistent deployments and fewer headaches for implementers. It’s a testament to the community’s commitment to fighting email fraud."
Email Service Providers (ESPs) view this development as a positive step towards a more secure and predictable email ecosystem. "As an ESP, our priority is to ensure our customers’ emails are delivered securely and reliably," said an inferred spokesperson for a major ESP. "The updated DMARC standard streamlines our efforts to guide customers towards compliance and helps us collectively combat the evolving tactics of cybercriminals. It’s a win for senders, recipients, and the internet at large." The sentiment is that the clarified documentation will lead to wider and more effective DMARC adoption, ultimately benefiting deliverability for all legitimate senders and improving the overall trustworthiness of email as a communication channel.
Implications for Email Senders: A Call to Action
For email senders, the practical takeaway from the DMARC update is unambiguous: the protocol has been modernized for clarity and robustness, not fundamentally altered. The core responsibilities remain paramount:
- Authenticate Your Email: Ensure that both SPF and DKIM are properly configured for all domains and subdomains used to send email. These are the foundational protocols that DMARC leverages.
- Align Authenticated Domains: Verify that the domains used for SPF and DKIM authentication align with the visible ‘From’ address presented to recipients. DMARC requires this alignment (either exact or relaxed) to pass.
- Monitor DMARC Reporting: Actively receive and analyze DMARC aggregate (RUA) reports. These reports provide invaluable insights into email traffic originating from or purporting to be from your domain, allowing you to identify legitimate sending issues and detect unauthorized use of your domain.
- Implement a DMARC Policy: Progress towards a stronger DMARC policy (p=quarantine or p=reject) once you are confident that all legitimate email from your domain is correctly authenticated and aligned. Starting with ‘p=none’ for monitoring is a common and recommended first step.
- Review and Adjust: DMARC is not a set-it-and-forget-it solution. Continuous monitoring, analysis, and policy adjustments are necessary to adapt to changes in sending infrastructure, email campaigns, and the evolving threat landscape.
The clarity offered by the new RFCs should facilitate easier implementation and troubleshooting, reinforcing DMARC as an essential component of any organization’s email security and deliverability strategy.
Mailjet’s Stance and Operational Guidance
For Mailjet customers, the DMARC update reinforces existing best practices rather than introducing entirely new requirements. Mailjet’s platform is designed to support robust email authentication, and its default configurations often align seamlessly with DMARC requirements, primarily through DKIM.
Mailjet’s DKIM-First Default:
When a user validates a sender domain within Mailjet, the platform automatically handles the DomainKeys Identified Mail (DKIM) setup. This process involves Mailjet providing the necessary DNS records (CNAMEs) that the customer adds to their domain’s DNS. Once validated, Mailjet signs outgoing emails with the customer’s domain key. This default configuration means that DKIM alignment is inherently straightforward. If the visible ‘From’ address uses the same domain (or an aligned subdomain) that has been authenticated in Mailjet, DKIM authentication and alignment will typically pass without additional configuration. For instance, if ‘example.com’ is authenticated in Mailjet, and an email is sent from ‘[email protected]’, DKIM alignment will be achieved.
The Return-Path / SPF Story:
By default, Mailjet utilizes a provider-owned bounce domain for the ‘Return-Path’ (also known as the ‘MAIL FROM’ address). This domain typically looks something like bnc3.mailjet.com. In this standard setup, SPF authentication is performed against bnc3.mailjet.com. Because this bounce domain (bnc3.mailjet.com) is distinct from the customer’s visible ‘From’ domain (e.g., example.com), SPF will generally not align with the visible ‘From’ address under a strict alignment policy (aspf=s).
However, it is crucial to remember that DMARC only requires one aligned authenticated identifier (either SPF or DKIM) to pass. In Mailjet’s default configuration, DMARC commonly passes through DKIM alignment, which is perfectly valid and compliant with the DMARC standard. Therefore, for many Mailjet customers, no immediate changes are necessary to achieve DMARC compliance if their DKIM is properly configured and aligned.
Custom Return-Path with Mailjet for SPF Alignment:
For customers who desire SPF alignment in addition to or instead of DKIM alignment, Mailjet offers the option to configure a custom Return-Path. This feature is typically available on paid plans and may depend on specific plan tiers and support workflows. When a custom Return-Path is configured, Mailjet allows customers to use a Mailjet-managed bounce subdomain within their own organizational domain (e.g., bounce.example.com instead of bnc3.mailjet.com).
Once configured, SPF can support DMARC alignment under relaxed alignment (aspf=r). This is because the MAIL FROM / Return-Path will now originate from a subdomain (e.g., bounce.example.com) that shares the same organizational domain as the visible ‘From’ address (e.g., example.com). Mailjet continues to handle bounce processing behind the scenes, ensuring deliverability. It’s important to note that you can typically only have one active custom Return-Path per API key, and the exact setup process may involve interaction with Mailjet’s support team. Customers using or considering strict SPF alignment (aspf=s) should carefully review this setup, as strict alignment requires the MAIL FROM domain to exactly match the visible ‘From’ domain, which may not be compatible with a Mailjet-managed bounce subdomain. Always consult Mailjet’s current documentation and support guidance for the latest behavior and setup details.
Dedicated IPs:
It’s also worth noting that whether a Mailjet customer uses shared or dedicated IP addresses does not alter DMARC’s fundamental alignment rules. Dedicated IPs can offer greater control over sending reputation and simplify deliverability troubleshooting, but DMARC still evaluates alignment between the visible ‘From’ domain and the authenticated SPF or DKIM identifiers, irrespective of the IP type.
What Mailjet Senders Should Review:
In response to the DMARC update, Mailjet senders should undertake a comprehensive review of their email authentication practices:
- Verify Current DMARC Policy: Confirm the DMARC policy (p=none, p=quarantine, or p=reject) published for all sending domains.
- Ensure Domain Authentication: Double-check that all sender domains and subdomains used in the visible ‘From’ address are correctly authenticated within their Mailjet account, specifically verifying DKIM setup.
- Confirm DKIM Alignment: Understand that DMARC generally passes for Mailjet users via DKIM alignment by default, provided the ‘From’ domain matches the authenticated domain.
- Evaluate Custom Return-Path: If SPF alignment is desired, investigate the possibility of configuring a custom Return-Path through Mailjet, understanding its implications, particularly for strict SPF alignment policies.
- Engage with DMARC Reports: Actively monitor and analyze DMARC reports to ensure ongoing compliance, identify any unauthorized use of their domains, and proactively address deliverability issues.
The transition from DMARCbis to the formalized DMARC standard signifies a maturation of email authentication protocols. For most Mailjet customers already leveraging authenticated domains and correctly aligned identifiers, the new RFCs serve more as a clarification of existing best practices rather than a seismic operational shift. It underscores the continuous commitment of the internet community to enhance email security and combat the persistent threat of fraud, making email a safer and more reliable communication channel for everyone.
