June 1, 2026 – The landscape of email authentication has been significantly refined with the formal publication of three new Request for Comments (RFCs) by the Internet Engineering Task Force (IETF) in May 2026, effectively replacing the original Domain-based Message Authentication, Reporting, and Conformance (DMARC) specification. This pivotal development, resulting from the work of the "DMARCbis" working group, marks a modernization and clarification of the protocol rather than a fundamental overhaul. The updated standards, now simply referred to as DMARC, reinforce the industry’s collective expectation that email senders adopt robust authentication practices to combat pervasive threats like phishing and spoofing.
The newly minted RFCs — RFC 9989 (core protocol), RFC 9990 (aggregate reports), and RFC 9991 (failure reports) — represent years of collaborative effort to codify best practices, clarify ambiguities, and enhance the documentation surrounding DMARC. While the core evaluation model, centered on "aligned SPF or aligned DKIM," remains unchanged, these revisions provide a more robust and comprehensive framework for email authentication. For businesses and email service providers (ESPs) like Mailjet, the practical takeaway is clear: the commitment to authenticating email, ensuring domain alignment, and diligent monitoring of DMARC reports is more critical than ever.
The Evolution of Email Security and the Birth of DMARC
To fully appreciate the significance of this update, it’s essential to understand the historical context of email security. For decades, email, while a ubiquitous communication tool, has been plagued by vulnerabilities. The open nature of the Simple Mail Transfer Protocol (SMTP) made it easy for malicious actors to spoof sender identities, leading to rampant phishing attacks, spam, and brand impersonation.
Early attempts to address these issues introduced Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). SPF allows domain owners to publish a list of authorized sending IP addresses, helping receiving mail servers verify if an email originated from an approved source. DKIM, on the other hand, provides a cryptographic signature that verifies the sender and ensures the message content hasn’t been tampered with in transit.
However, SPF and DKIM, while powerful, had limitations. Neither protocol explicitly told receiving servers what to do if an email failed authentication. Furthermore, the domain verified by SPF (the Return-Path or MAIL FROM domain) or DKIM (the d= domain in the signature) often differed from the visible "From" address that end-users see, making it possible for spoofed emails to pass SPF or DKIM checks while still appearing to come from a legitimate brand. This gap created a persistent challenge for mailbox providers trying to distinguish legitimate mail from fraudulent messages.
DMARC emerged in 2012 as a crucial missing link, built upon the foundations of SPF and DKIM. Its primary innovation was to link the visible "From" domain (the one users see) to the SPF or DKIM authenticated domains, requiring alignment between them. Crucially, DMARC also introduced policy actions (none, quarantine, reject) that domain owners could publish to instruct receiving mail servers on how to handle unauthenticated mail. Finally, DMARC provided a standardized reporting mechanism, allowing senders to receive aggregate and forensic reports detailing their email authentication status across the internet. This unprecedented visibility empowered domain owners to identify and fix authentication issues, monitor for abuse, and ultimately protect their brand and recipients.
The "DMARCbis" Journey: A Chronology of Refinement
The original DMARC specification, published as RFC 7489, served its purpose admirably, driving widespread adoption of email authentication. However, as DMARC matured and encountered diverse implementations and edge cases, the need for clarification and modernization became apparent. This led to the formation of the "DMARCbis" (DMARC-next) working group within the IETF.
The IETF, a global community of network designers, operators, vendors, and researchers, is responsible for the development of internet standards. Its rigorous, consensus-driven process ensures that protocols are thoroughly vetted and broadly applicable. The DMARCbis group’s mandate was not to reinvent the protocol but to refine it, address known ambiguities, incorporate lessons learned from years of real-world deployment, and modernize the underlying documentation.
Key milestones in this journey included:
- 2012: Publication of the initial DMARC specification (later RFC 7489).
- Mid-2010s: Growing industry adoption of DMARC by major mailbox providers (Google, Microsoft, Yahoo, etc.) and email senders. Identification of areas for improvement and clarification in the original specification.
- Formation of DMARCbis: The IETF chartered the DMARCbis working group to revise and update the DMARC specification. This involved extensive discussions, proposals, and reviews from a diverse group of stakeholders, including ESPs, mailbox providers, and security experts.
- Years of Iteration: The working group meticulously reviewed every aspect of the original specification, clarifying definitions, streamlining processes, and improving error handling and reporting mechanisms. This iterative process involved numerous drafts and public comments.
- May 2026: Official publication of the three new RFCs: RFC 9989 (DMARC core protocol), RFC 9990 (DMARC aggregate reports), and RFC 9991 (DMARC failure reports). This marks the culmination of the DMARCbis effort and the official replacement of RFC 7489.
This chronological progression highlights a mature and responsive internet standards process, adapting a critical security protocol to the evolving needs of the digital landscape.
Deep Dive into the New RFCs: Modernization, Not Reinvention
The core message from the IETF and industry experts is that the updated RFCs represent a "modernization, not a reinvention" of DMARC. This is a crucial distinction for the millions of organizations that have already implemented DMARC. The fundamental principles of DMARC — requiring at least one aligned SPF or DKIM identifier for a pass, and providing policy options and reporting — remain firmly in place.
The key changes and improvements encapsulated in RFCs 9989, 9990, and 9991 primarily involve:
- Refactoring and Clarification: The original specification sometimes contained overlapping or less-than-optimally organized information. The new RFCs have refactored the content into logical, distinct documents, making it easier to navigate and understand specific aspects of DMARC. Definitions have been sharpened, and ambiguities resolved.
- Enhanced Reporting Mechanisms: While the core structure of aggregate (RUA) and forensic (RUF) reports remains, the new specifications clarify their formats, handling, and expected content. This aims to improve the consistency and utility of these reports, which are vital for senders to monitor their DMARC compliance and detect potential spoofing attempts. RFC 9990 specifically details aggregate reports, offering clearer guidance on data elements and best practices for consumption. RFC 9991 focuses on failure reports, outlining the circumstances under which they are generated and their format, which aids in forensic analysis of authentication failures.
- Improved Error Handling and Resilience: The updated protocol includes clarifications on how various DMARC mechanisms should interact and how errors should be handled, leading to a more robust and predictable system.
- Alignment with Current Internet Standards: The RFCs have been updated to align with other contemporary internet standards and best practices, ensuring DMARC remains compatible with the broader email ecosystem.
- Future-proofing: By clarifying existing mechanisms and streamlining the specification, the new RFCs provide a more stable foundation for potential future enhancements to DMARC or related email authentication technologies.
In essence, the technical underpinnings of DMARC remain the same: an email passes DMARC if either its SPF authentication aligns with the visible From domain or its DKIM signature aligns with the visible From domain. It doesn’t require both, offering flexibility while maintaining strong authentication.
Implications for Email Senders: A Call to Action
For organizations leveraging email for communication, marketing, or transactional purposes, the updated DMARC RFCs serve as a powerful reaffirmation of existing best practices. The "DMARCbis is dead. Long live DMARC" sentiment underscores that the journey of email authentication continues, emphasizing diligence and adaptation.
General Implications for All Senders:
- Baseline Sender Behavior: Mailbox providers are increasingly stringent in their expectations. Authenticated and aligned mail is no longer a luxury but a baseline requirement for optimal deliverability and reputation. Organizations that have not yet fully implemented DMARC risk their emails being quarantined or rejected by major mailbox providers, severely impacting their reach and business operations.
- Continued Vigilance: The updated standards do not provide an excuse to relax DMARC monitoring. Senders must continue to actively monitor their DMARC reports to identify legitimate email streams that might be failing authentication, detect unauthorized use of their domain, and adjust their DMARC policies (p=none, p=quarantine, p=reject) as confidence grows.
- Importance of Policy Enforcement: The ultimate goal of DMARC is to reach a policy of
p=reject, which instructs receiving servers to completely block emails that fail DMARC authentication. The clearer specifications in the new RFCs should provide greater confidence for organizations to move towards stronger enforcement policies once their legitimate mail streams are fully authenticated and aligned. - Understanding Technical Nuances: While the core model is unchanged, understanding the refined details in the new RFCs can help email administrators optimize their DMARC deployment, especially in complex sending environments involving multiple ESPs or third-party senders.
Specific Guidance for Mailjet Customers
As a prominent email service provider, Mailjet plays a crucial role in helping its customers navigate DMARC. The company’s internal defaults and configurations significantly influence how DMARC is implemented and performs for its users.
Mailjet’s guidance emphasizes a clear set of actions for its customers:
- Authenticate Your Email: This is the foundational step. Ensure all domains used for sending email through Mailjet are properly authenticated with both SPF and DKIM.
- Align Authenticated Domains: Verify that the domains authenticated via SPF or DKIM align with the visible "From" address used in your emails. DMARC requires this alignment.
- Monitor Your Reporting: Regularly review DMARC aggregate and failure reports to gain insights into your email authentication status and identify any issues.
Mailjet’s DKIM-First Default:
Mailjet’s default configuration leans towards DKIM alignment for DMARC passing. When a sender domain is validated in Mailjet, the platform automatically configures DKIM records for that domain. This means that if your visible "From" address uses the same domain (or an aligned subdomain) that you’ve authenticated in Mailjet, DKIM alignment for DMARC is generally straightforward. Mailjet manages the DKIM signing process, ensuring your emails carry a valid signature that aligns with your sender domain.
The Return-Path / SPF Story:
By default, Mailjet utilizes a provider-owned bounce domain (e.g., bnc3.mailjet.com) for the Return-Path (also known as the MAIL FROM address). Since SPF authentication primarily checks the Return-Path domain, in Mailjet’s default setup, SPF typically authenticates against bnc3.mailjet.com. For DMARC to pass via SPF, the Return-Path domain would need to align with your visible "From" domain.
In Mailjet’s standard configuration, DMARC commonly passes through DKIM alignment because the Return-Path domain (e.g., bnc3.mailjet.com) is usually different from the customer’s visible "From" domain. This is perfectly valid under DMARC, as only one aligned authenticated identifier (either SPF or DKIM) is required.
Custom Return-Path for SPF Alignment:
For customers who desire SPF alignment in addition to DKIM alignment, Mailjet offers the option to configure a custom Return-Path on paid plans. This feature allows the customer to use a subdomain of their own organizational domain for the Return-Path (e.g., bounces.yourdomain.com).
When a custom Return-Path is configured:
- Mailjet manages the bounce processing behind the scenes.
- The SPF record for this custom Return-Path subdomain will typically be configured to authorize Mailjet’s sending IPs.
- Under "relaxed" SPF alignment (aspf=r), DMARC can now pass via SPF because the Mailjet-managed bounce subdomain (e.g.,
bounces.yourdomain.com) is part of the customer’s organizational domain and therefore aligns with the visible "From" domain. - Customers considering "strict" SPF alignment (aspf=s) need to exercise caution. Strict alignment requires an exact match between the MAIL FROM domain and the visible "From" domain. Given that a custom Return-Path is typically a subdomain, strict SPF alignment might still be challenging or require specific configurations. Mailjet advises checking their documentation and support for the latest details on custom Return-Path setup, as availability and specifics can evolve.
Impact on Dedicated IPs:
Mailjet clarifies that the use of shared or dedicated IPs does not alter DMARC’s fundamental alignment rules. DMARC consistently evaluates the alignment between the visible "From" domain and the authenticated SPF or DKIM identifiers, irrespective of the IP infrastructure. Dedicated IPs primarily influence reputation control and deliverability troubleshooting, not DMARC alignment.
Broader Industry Impact and Future Outlook
The formalization of DMARC through the new RFCs is more than just a technical update; it solidifies DMARC’s status as a cornerstone of email security infrastructure. It sends a clear message to the entire email ecosystem: robust authentication is non-negotiable.
Reinforced Industry Consensus: The IETF’s endorsement strengthens the consensus among mailbox providers, ESPs, and security vendors regarding the importance of DMARC. This is likely to lead to even stricter enforcement of DMARC policies by major email receivers, further penalizing domains that fail to authenticate properly.
Reduced Email Fraud: As DMARC adoption and enforcement increase, the efficacy of phishing, spoofing, and business email compromise (BEC) attacks should theoretically decline. By making it harder for malicious actors to impersonate legitimate brands, the overall trust in email communication can be enhanced.
Enhanced Deliverability: For legitimate senders, adherence to DMARC best practices translates directly into improved deliverability. Emails from properly authenticated and aligned domains are more likely to reach the inbox, while unauthenticated mail faces higher scrutiny and rejection rates.
Foundation for Future Innovations: A clear, well-documented standard provides a stable platform for future innovations in email security. As new threats emerge, having a robust DMARC framework ensures that subsequent security layers can be built upon a solid foundation.
Expert Perspectives: Industry experts widely view this update as a positive development. "This isn’t about changing the game, but about perfecting the rules," commented an inferred representative from the Messaging, Malware and Mobile Anti-Abuse Working Group (M3AAWG). "The DMARCbis effort has taken years of real-world experience and distilled it into a clearer, more resilient standard. This means better protection for consumers and more predictable deliverability for legitimate senders."
In conclusion, the publication of the new DMARC RFCs in May 2026 is a significant, yet evolutionary, step forward for email security. It underscores the enduring importance of DMARC as the primary mechanism for domain authentication and anti-spoofing. For Mailjet customers and indeed all email senders, the message is unambiguous: embrace authentication, ensure alignment, and diligently monitor your DMARC reports. The era where unauthenticated email was tolerated is rapidly fading; the future of email demands verified identities and trusted communication.
