The landscape of email authentication has been officially clarified and modernized with the Internet Engineering Task Force’s (IETF) recent publication of three new RFCs in May 2026. These updated specifications — RFC 9989 (core protocol), RFC 9990 (aggregate reports), and RFC 9991 (failure reports) — collectively replace the original DMARC (Domain-based Message Authentication, Reporting, and Conformance) standard, effectively formalizing its evolution from "DMARCbis" back to simply "DMARC." This significant development underscores the growing imperative for robust email security and authentication in an increasingly complex digital environment, setting a clearer baseline for sender behavior that mailbox providers universally expect.
The Enduring Mandate for Authenticated Email
At its core, DMARC remains an indispensable pillar of email security, designed to combat email spoofing, phishing, and other forms of cyber fraud. Its fundamental evaluation model, requiring either aligned SPF (Sender Policy Framework) or aligned DKIM (DomainKeys Identified Mail) results, continues unchanged. The recent RFCs primarily serve to refactor, clarify, and update the DMARC documentation, making it more robust and accessible without altering its foundational principles. This clarification is particularly timely as major mailbox providers globally, including giants like Google (Gmail), Microsoft (Outlook), and Yahoo, have progressively tightened their requirements for authenticated and aligned email, pushing senders towards a higher standard of digital trust. Failure to adhere to these standards can result in significantly reduced deliverability, with legitimate emails being quarantined in spam folders or outright rejected, impacting communication, marketing, and transactional flows.
A Brief History of DMARC’s Evolution
The journey to the new DMARC RFCs reflects a continuous effort by the internet community to strengthen email security. DMARC emerged from a collaborative effort by major email senders and receivers, including PayPal, Google, Microsoft, and Yahoo, in the early 2010s. Its initial specification, published in 2012, quickly became a de facto industry standard, providing a mechanism for email senders to indicate that their emails are protected by SPF and DKIM, and to tell receiving mail servers what to do if an email fails these authentication checks. This early version was instrumental in providing a unified policy layer atop SPF and DKIM, addressing their individual limitations.
Over the years, as the internet evolved and email attacks grew more sophisticated, the need for formal standardization and refinement became apparent. The "DMARCbis" designation emerged during the IETF working group’s efforts to revise and update the original specification. "Bis," Latin for "a second time," indicated that this was a revision in progress, aimed at incorporating lessons learned from a decade of DMARC deployment, clarifying ambiguities, and modernizing the protocol to meet contemporary security challenges. This meticulous process, involving numerous drafts, discussions, and revisions, culminated in the May 2026 publication, solidifying DMARC’s status as a foundational internet standard.
Deconstructing the New RFCs: Clarification, Not Reinvention
The publication of RFC 9989, 9990, and 9991 represents a significant milestone, codifying DMARC within the official IETF framework. While the practical takeaway for most email senders remains that DMARC has been modernized rather than reinvented, understanding the role of these specific RFCs provides deeper insight:
- RFC 9989 (DMARC Core Protocol): This document defines the fundamental DMARC protocol. It details how DMARC records are published in DNS, how receiving mail servers perform DMARC checks, and the conditions under which an email "passes" or "fails." The updates here focus on clarifying existing mechanisms, improving robustness against edge cases, and streamlining the language for better comprehension by implementers and operators. It reinforces the core principle of domain alignment, ensuring that the visible "From" address aligns with either the domain asserted by SPF or the domain signed by DKIM.
- RFC 9990 (DMARC Aggregate Reports): This RFC specifies the format and content of aggregate reports. These reports, sent daily by receiving mail servers to the email addresses specified in a sender’s DMARC record, provide invaluable insights into email traffic patterns. They offer a high-level overview of which emails passed DMARC, which failed, and the reasons for failure, without revealing sensitive content. The updates likely streamline report formats, clarify data fields, and potentially introduce mechanisms for more efficient parsing and analysis, making it easier for senders to monitor their DMARC compliance and detect potential abuse.
- RFC 9991 (DMARC Failure Reports): Also known as forensic reports, these documents detail individual email failures, providing more granular information, often including sanitized headers and sometimes even portions of the message body. While less commonly used than aggregate reports due to privacy concerns and potential for information leakage, they can be crucial for diagnosing specific authentication issues or identifying the source of spoofed emails. The new RFC likely clarifies the conditions under which these reports are generated, their format, and privacy considerations surrounding their use.
The emphasis across all three RFCs is on refining the technical specification, removing ambiguities that may have arisen from the original document, and incorporating best practices developed over a decade of real-world deployment. This meticulous engineering ensures DMARC remains a resilient and adaptable standard in the face of evolving cyber threats.
The Mechanics of DMARC: SPF, DKIM, and Alignment
For many, the terms SPF, DKIM, and DMARC can sound deeply technical. However, their combined function is elegantly simple: to verify that an email truly originates from the domain it claims to be from.
- SPF (Sender Policy Framework): SPF allows a domain owner to publish a list of authorized mail servers in their DNS records. When a mail server receives an email, it checks the SPF record of the "Return-Path" (or "MAIL FROM") domain. If the sending IP address is on the authorized list, SPF passes. The challenge with SPF alone is that attackers can often spoof the "From" address while using an authorized "Return-Path" from a different domain.
- DKIM (DomainKeys Identified Mail): DKIM adds a digital signature to emails, linked to a cryptographic key published in the sender’s DNS. The receiving mail server uses this public key to verify the signature. If the signature is valid, it confirms that the email has not been tampered with in transit and originated from a server authorized by the domain that signed the email.
- DMARC (Domain-based Message Authentication, Reporting, and Conformance): DMARC acts as the policy layer atop SPF and DKIM. It checks whether the domain in the visible "From" address (the one users see) aligns with the domain that passed SPF or DKIM. "Alignment" means that the domain in the "From" header must match or be a subdomain of the domain that passed SPF (the Return-Path domain) or DKIM (the signing domain). If at least one of these (SPF or DKIM) aligns and passes, DMARC passes. If DMARC fails, the policy set by the sender (none, quarantine, or reject) dictates the receiving server’s action.
This "aligned SPF or aligned DKIM" evaluation model is crucial. It closes the loophole where SPF or DKIM might pass for a domain (e.g., a mailing list provider) but the visible "From" address is spoofed to appear as a different, legitimate brand. DMARC ensures that the domain the user sees is the domain that has been authenticated.
Mailjet’s Operational Framework in a DMARC-Enhanced World
For customers leveraging Mailjet for their email operations, understanding how the platform integrates with DMARC is paramount. Mailjet’s configuration defaults are designed to facilitate DMARC compliance, primarily through a "DKIM-first" approach.
Mailjet’s DKIM-First Default:
When a user validates a sender domain within Mailjet, the platform automatically generates and provides CNAME records for DKIM. These records, when added to the customer’s DNS, enable Mailjet to sign outgoing emails with a DKIM signature associated with the customer’s domain. This means that DKIM alignment becomes straightforward: if the visible "From" address uses the same domain (or an aligned subdomain) that has been authenticated in Mailjet, DKIM will pass, and consequently, DMARC will pass under this aligned identifier. This robust default setup means that for the majority of Mailjet customers, DMARC compliance is achieved by simply authenticating their sending domains correctly and ensuring their "From" addresses align with these authenticated domains.
The Return-Path / SPF Story with Mailjet:
By default, Mailjet utilizes a provider-owned bounce domain, such as bnc3.mailjet.com, for the "Return-Path" or "MAIL FROM" address. This is a common practice among Email Service Providers (ESPs) to manage bounce processing efficiently and to consolidate the reputation of their sending infrastructure. In this default configuration, SPF checks are performed against bnc3.mailjet.com. While Mailjet’s own SPF records ensure these checks pass, they typically do not align with the customer’s visible "From" domain unless that domain is mailjet.com itself (which is not the case for customers).
Therefore, in Mailjet’s default setup, DMARC commonly passes through DKIM alignment. This is perfectly valid and compliant with DMARC, as the protocol explicitly states that only one aligned authenticated identifier (either SPF or DKIM) is required for a pass. This design provides a reliable path to DMARC compliance without requiring customers to manage SPF records for Mailjet’s sending infrastructure directly.
Custom Return-Path for SPF Alignment:
For organizations that desire both SPF and DKIM alignment for their DMARC compliance, Mailjet offers the option to configure a custom Return-Path on paid plans. This feature allows customers to use a Mailjet-managed bounce subdomain within their own organizational domain (e.g., bnc.yourdomain.com). By setting up a custom Return-Path, the MAIL FROM address will now align with the customer’s organizational domain.
Once configured, SPF can support DMARC alignment under "relaxed alignment" (aspf=r). Under relaxed alignment, the Return-Path domain (e.g., bnc.yourdomain.com) only needs to share the same organizational domain as the visible "From" address (e.g., [email protected]). Mailjet continues to handle bounce processing seamlessly behind the scenes, abstracting the technical complexities from the sender.
It is critical for customers considering or using "strict SPF alignment" (aspf=s) to review this setup carefully. Strict alignment requires an exact match between the MAIL FROM domain and the visible "From" domain. While a custom Return-Path allows the MAIL FROM domain to be a subdomain of the visible "From" domain, this typically passes under relaxed alignment, not strict. Customers with strict alignment policies might need to consult Mailjet support for specific guidance or consider the implications for their DMARC enforcement.
Dedicated IPs and DMARC:
The use of shared versus dedicated Mailjet IP addresses impacts factors like reputation control and deliverability troubleshooting, but it fundamentally does not alter DMARC’s alignment rules. Whether sending through shared or dedicated Mailjet IPs, DMARC consistently evaluates the alignment between the visible "From" domain and the authenticated SPF or DKIM identifiers. The core principles of authentication and alignment remain constant, regardless of the underlying IP infrastructure.
Broader Industry Impact and Implications
The formalization of DMARC through new RFCs marks a maturing of the email security ecosystem. This move provides several critical benefits:
- Enhanced Trust and Reliability: By standardizing and clarifying DMARC, the IETF reinforces the protocol’s role in building trust in email. When recipients can be more confident that an email truly comes from the claimed sender, the overall integrity of email communication improves. This is vital in an era where email remains a primary vector for cyberattacks.
- Reduced Email Fraud: DMARC is a potent weapon against phishing, spoofing, and Business Email Compromise (BEC) attacks. With clearer specifications, implementation across the industry can become more consistent, leading to a more effective collective defense against these pervasive threats. Data from organizations like the Global Cyber Alliance consistently show that domains protected by DMARC are significantly less likely to be spoofed.
- Improved Deliverability: As mailbox providers increasingly enforce DMARC, legitimate senders who implement it correctly will see better deliverability rates. Their emails are more likely to reach the inbox, avoiding spam filters that aggressively flag unauthenticated mail. This is a direct benefit to businesses relying on email for critical communications.
- Simplified Implementation for Developers: The refactoring and clarification in the new RFCs will aid developers and email service providers in implementing and integrating DMARC more consistently and correctly. This reduces the likelihood of misconfigurations and ensures that the protocol functions as intended across diverse email systems.
- Foundation for Future Innovations: A clear, standardized DMARC protocol provides a stable foundation upon which future email security innovations can be built. As new threats emerge, having a well-defined core allows for more agile and effective development of complementary technologies.
Actionable Steps for Mailjet Senders
For Mailjet customers, the update to DMARC RFCs serves as a reaffirmation of existing best practices rather than a call for a radical operational shift. However, a review of current configurations is always prudent:
- Verify Domain Authentication: Ensure all sending domains are properly authenticated within Mailjet, with CNAME records for DKIM correctly configured in your DNS. This is the bedrock of DMARC compliance.
- Confirm From Address Alignment: Regularly check that the "From" addresses used in your email campaigns align with your authenticated domains. This means the visible "From" domain should match or be a subdomain of the domain for which DKIM is configured.
- Monitor DMARC Reports: Actively monitor your DMARC aggregate reports (RFC 9990). These reports provide crucial insights into your email ecosystem, helping you identify potential authentication failures, detect unauthorized sending, and track your DMARC compliance progress.
- Review DMARC Policy: Evaluate your current DMARC policy (p=none, p=quarantine, p=reject). While "p=none" is a good starting point for monitoring, moving to "p=quarantine" or "p=reject" as confidence in your DMARC implementation grows is essential for full protection against spoofing.
- Consider Custom Return-Path for SPF Alignment: If your organizational policy or specific use cases necessitate SPF alignment in addition to DKIM, explore Mailjet’s custom Return-Path feature. Consult Mailjet’s documentation and support for current availability and setup procedures, particularly if you operate under strict SPF alignment requirements.
DMARCbis is dead. Long live DMARC. For the vast majority of Mailjet customers already diligently utilizing authenticated domains and aligned identifiers, the new RFCs solidify and clarify existing best practices rather than mandating a significant operational overhaul. This refinement reinforces DMARC’s critical role in securing the digital communication channels, paving the way for a more trustworthy and resilient email ecosystem for businesses and consumers alike. The message is clear: robust email authentication is no longer optional; it is the definitive baseline for reliable and secure digital correspondence.
