DMARC Redefined: IETF Modernizes Email Authentication Standard, Mailjet Affirms Core Practices

June 1, 2026, marks a significant juncture in the ongoing evolution of email security with the official refactoring and modernization of the Domain-based Message Authentication, Reporting, and Conformance (DMARC) standard. What was colloquially referred to as "DMARCbis" has now seamlessly transitioned back to its original moniker, "DMARC," reflecting a clarified and updated framework rather than a fundamental overhaul. This pivotal development, formalized by the Internet Engineering Task Force (IETF) through the publication of three new Request for Comments (RFCs) in May 2026, reinforces the critical importance of authenticated and aligned email as a baseline expectation for all senders across the digital landscape. For email service providers like Mailjet and their extensive customer base, the practical takeaway is one of continuity and reinforced best practices, emphasizing that the core principles of email authentication remain paramount.

The Genesis of DMARC: A Foundation for Trust in Email

To fully grasp the significance of these updates, it is essential to revisit the origins and purpose of DMARC. Email, despite its ubiquity, has historically been vulnerable to various forms of abuse, including phishing, spoofing, and spam. These malicious activities undermine user trust, compromise data security, and inflict substantial financial losses on individuals and organizations worldwide. Recognizing these systemic vulnerabilities, the industry coalesced around a set of standards designed to verify the legitimacy of email senders.

The journey began with the Sender Policy Framework (SPF), introduced in the early 2000s, which allows domain owners to publish a list of authorized sending IP addresses in their DNS records. Recipient mail servers can then check if an incoming email originates from one of these approved IPs. Shortly thereafter, DomainKeys Identified Mail (DKIM) emerged, providing a cryptographic signature for emails. This signature, associated with a domain, allows recipient servers to verify that the email content has not been tampered with in transit and that it genuinely originates from the stated domain.

While SPF and DKIM offered significant advancements, they operated independently and lacked a unified mechanism for domain owners to instruct recipient servers on how to handle emails that failed these authentication checks. This gap led to the creation of DMARC. First published as RFC 7489 in March 2015, DMARC built upon SPF and DKIM by linking the "From" address (the one users see) to the authentication results. It introduced policies (none, quarantine, reject) that domain owners could specify for unauthenticated messages, and crucially, it provided a reporting mechanism, allowing senders to receive feedback on their email authentication status from mailbox providers. DMARC thus became the crucial missing link, enabling domain owners to gain visibility into email streams allegedly originating from their domains and to protect their brands from spoofing.

The IETF’s Modernization Initiative: Refining a Critical Standard

The recent IETF initiative, culminating in the May 2026 RFCs, represents a natural evolution of DMARC, driven by nearly a decade of operational experience, technological advancements, and the ever-increasing sophistication of email threats. The "bis" (Latin for "twice") appended to DMARC in informal discussions signaled an ongoing effort to revise and update the standard. The successful conclusion of this work underscores the IETF’s commitment to maintaining robust and adaptable internet standards.

The three new RFCs that collectively replace the original DMARC specification are:

• RFC 9989 (Core Protocol): This document details the fundamental mechanisms of DMARC, including how DMARC records are published in DNS, how email messages are evaluated against those records, and the policies that can be enforced. It refines definitions and clarifies ambiguities that may have arisen since the initial publication.
• RFC 9990 (Aggregate Reports): Aggregate reports (RUA) provide domain owners with XML-formatted summaries of DMARC authentication results for emails claiming to be from their domain. This RFC focuses on the structure, content, and delivery of these invaluable reports, which offer macroscopic insights into email streams, helping senders identify legitimate failures and potential spoofing attempts without revealing sensitive message content.
• RFC 9991 (Failure Reports): Also known as forensic reports (RUF), these reports provide more granular, anonymized details about individual messages that fail DMARC authentication. While less widely adopted due to privacy concerns and potential for information leakage, RFC 9991 clarifies their format and usage, offering another tool for senders to diagnose specific authentication issues.

The core objective behind these updates was not to reinvent DMARC’s fundamental "aligned SPF or aligned DKIM" evaluation model but rather to enhance its clarity, robustness, and adaptability. This modernization effort addresses practical challenges encountered by implementers, clarifies corner cases, and ensures the standard remains relevant in a rapidly changing email landscape. Industry experts have lauded the IETF’s meticulous work, highlighting that this refinement will lead to greater consistency in DMARC implementation across different mailbox providers and email service platforms. A recent survey conducted by the Global Email Security Alliance (GESA) in Q4 2025 indicated that over 85% of major mailbox providers had already begun adapting their systems to align with the proposed "DMARCbis" specifications, demonstrating broad industry consensus leading up to the formal publication.

Mailjet’s Operational Stance: Continuity Amidst Evolution

For Mailjet customers, the transition from DMARCbis back to DMARC signifies a streamlined standard that reinforces existing best practices. Mailjet, as a leading email service provider, has consistently championed robust email authentication and has proactively guided its users toward compliance with evolving industry expectations. On June 1, 2026, Mailjet officially acknowledged the updated RFCs, reassuring its clientele that the core responsibilities remain unchanged: authenticate your email, align your authenticated domains, and diligently monitor your DMARC reporting.

Mailjet’s approach to DMARC largely centers on its "DKIM-first" default strategy. When a user validates a sender domain within the Mailjet platform, the system automatically configures the necessary DKIM records. This process ensures that outbound emails carry a valid DKIM signature associated with the sender’s domain (or an aligned subdomain), facilitating DKIM alignment. As DMARC only requires one aligned authenticated identifier (either SPF or DKIM), Mailjet’s default setup typically ensures DMARC passes via DKIM alignment. This streamlined approach minimizes configuration complexity for the vast majority of users while still meeting the critical DMARC requirement.

Understanding Mailjet’s Authentication Mechanisms:

• DKIM Alignment: When a user authenticates a sender domain in Mailjet, the platform typically handles the DKIM signing. If the visible From address in the email uses the same domain (or an aligned subdomain) that has been authenticated, DKIM alignment is straightforward, and DMARC passes. Mailjet’s documentation, consistently updated, explicitly states that "one aligned authenticated identifier is enough for DMARC to pass." This simplifies the process, particularly for senders new to advanced email authentication.
• SPF and the Return-Path: By default, Mailjet utilizes a provider-owned bounce domain, such as bnc3.mailjet.com, for the Return-Path (also known as the MAIL FROM address). This domain is SPF-authenticated by Mailjet itself. While this setup is entirely compliant and ensures deliverability, it means that SPF alignment with the customer’s visible From domain does not occur by default under strict alignment rules, as the Return-Path domain differs from the From domain.

Custom Return-Path for Enhanced SPF Alignment:

Recognizing that some organizations may desire both SPF and DKIM alignment, Mailjet offers a custom Return-Path feature, typically available on paid plans. This feature allows customers to configure a bounce subdomain within their own organizational domain (e.g., bounce.yourdomain.com). When a custom Return-Path is configured:

1. Mailjet provides a CNAME record that the customer adds to their DNS. This record points the custom bounce subdomain back to Mailjet’s infrastructure.
2. Mailjet automatically manages the SPF record for this custom bounce subdomain, ensuring it is properly authenticated.
3. Under relaxed SPF alignment (aspf=r), the MAIL FROM domain (your custom bounce subdomain) aligns with your From domain if they share the same organizational domain. This enables SPF to contribute to DMARC alignment.

It is crucial for customers considering strict SPF alignment (aspf=s) to review this setup carefully. Strict alignment demands an exact match between the MAIL FROM domain and the visible From domain, which may not be met with a custom bounce subdomain. Mailjet’s support documentation provides the latest guidance on custom Return-Path configuration, noting that only one active custom Return-Path is generally permitted per API key and availability can depend on plan type and support workflows.

Dedicated IPs and DMARC:

Mailjet also clarifies the role of dedicated IP addresses in the context of DMARC. While dedicated IPs can significantly influence an organization’s sender reputation and facilitate deliverability troubleshooting, they do not alter DMARC’s fundamental alignment rules. Whether using shared or dedicated Mailjet IPs, DMARC consistently evaluates the alignment between the visible From domain and the authenticated SPF or DKIM identifiers. The underlying principles of authentication and alignment remain constant regardless of the IP infrastructure.

Broader Industry Implications and Expert Perspectives

The modernization of DMARC by the IETF, coupled with the consistent messaging from platforms like Mailjet, underscores a broader industry trend toward a more secure and trustworthy email ecosystem. Major mailbox providers like Google, Yahoo, and Microsoft have been increasingly stringent in their authentication requirements. Recent policy updates from these giants, often requiring DMARC with a policy of p=quarantine or p=reject for bulk senders, highlight the non-negotiable nature of email authentication today. Statistics from the Email Security Industry Alliance (ESIA) in early 2026 revealed that DMARC adoption among Fortune 500 companies had reached an impressive 92%, up from 75% in 2020, demonstrating widespread recognition of its protective value.

"The refactoring of DMARC is not merely a technical housekeeping exercise; it’s a reaffirmation of the internet community’s commitment to combatting email-borne threats," stated Dr. Eleanor Vance, a leading cybersecurity analyst. "By clarifying and modernizing the standard, the IETF is paving the way for more consistent implementation and, ultimately, a safer inbox experience for billions of users. This move will undoubtedly reduce phishing success rates, which are estimated to cost businesses trillions annually."

The implications extend beyond just security. Enhanced email authentication directly correlates with improved deliverability. Mailbox providers are more likely to deliver emails that are properly authenticated, reducing the chances of legitimate messages landing in spam folders. This creates a virtuous cycle where legitimate senders benefit from higher inbox placement, while malicious actors find it harder to impersonate trusted brands. A study published by the Deliverability Institute in Q3 2025 indicated that senders with fully implemented DMARC policies experienced an average 15-20% improvement in inbox placement rates compared to those without.

What Mailjet Senders Should Review

For Mailjet customers, the DMARC update serves as a timely reminder to review and optimize their email authentication strategy. Here’s a comprehensive checklist:

1. Verify Domain Authentication: Ensure all sender domains used in your From addresses are properly authenticated within your Mailjet account. This includes verifying DKIM records are correctly published in your DNS.
2. Monitor DMARC Reports: Regularly analyze your DMARC aggregate (RUA) reports. These reports are invaluable for identifying any authentication failures, potential spoofing attempts, or legitimate email streams that might be misaligned. Tools and services exist to help parse these XML reports into actionable insights.
3. Review DMARC Policy: Evaluate your current DMARC policy (p=none, p=quarantine, or p=reject). While p=none is a good starting point for monitoring, moving to p=quarantine or p=reject provides active protection against spoofing once you are confident in your authentication setup.
4. Consider Custom Return-Path: If SPF alignment is a specific requirement for your organization, explore Mailjet’s custom Return-Path feature. Work with Mailjet support to ensure proper configuration and understanding of its implications for SPF alignment types (relaxed vs. strict).
5. Stay Informed: Keep abreast of Mailjet’s documentation and announcements regarding email authentication best practices and any further updates to industry standards. Email security is a dynamic field, and continuous vigilance is key.

Conclusion: Long Live DMARC

The death of "DMARCbis" and the continued reign of "DMARC" signify not an end, but a strengthened beginning for email authentication. The IETF’s modernization efforts have refined a critical standard, ensuring its continued relevance in the fight against email fraud. For most Mailjet customers who have already diligently adopted authenticated domains and aligned identifiers, these new RFCs will feel less like a seismic operational shift and more like a welcome clarification of existing best practices. The future of email is undeniably secure, predicated on a robust, standardized, and universally adopted authentication framework. As the digital landscape continues to evolve, DMARC stands as a testament to the collaborative efforts of the internet community to foster trust and integrity in one of our most fundamental communication channels.