DMARC Standard Modernized with New IETF RFCs, Reinforcing Email Authentication Best Practices

The Internet Engineering Task Force (IETF) has officially published three new Request for Comments (RFCs) in May 2026, marking a significant modernization of the Domain-based Message Authentication, Reporting, and Conformance (DMARC) protocol. These new specifications — RFC 9989 (DMARC Core Protocol), RFC 9990 (DMARC Aggregate Reports), and RFC 9991 (DMARC Failure Reports) — supersede the original RFC 7489, which introduced DMARC in 2015. Notably, the "DMARCbis" designation, used during the protocol’s refinement process, has been retired, with the standard now simply referred to as DMARC. This update, while deeply technical in its underlying documentation, reinforces the existing imperative for senders to adopt robust email authentication practices, without fundamentally altering DMRC’s core evaluation model of "aligned SPF or aligned DKIM."

Background and Evolution of Email Authentication

Email, since its inception, has been vulnerable to various forms of abuse, most notably spoofing and phishing. Spoofing involves forging the sender’s address to make an email appear to originate from a legitimate source, while phishing attempts to trick recipients into revealing sensitive information by impersonating trusted entities. These threats have escalated dramatically over the past two decades, leading to billions of dollars in losses annually for businesses and individuals worldwide. According to reports from the Anti-Phishing Working Group (APWG), the number of phishing attacks has consistently grown, reaching unprecedented levels, with millions of unique phishing sites detected each year.

To combat these pervasive threats, the email industry developed several foundational authentication protocols. The Sender Policy Framework (SPF), introduced as RFC 7208, allows domain owners to publish a list of authorized sending IP addresses in their DNS records. Recipient mail servers can then check if an incoming email claiming to be from that domain originated from an authorized server. DomainKeys Identified Mail (DKIM), standardized in RFC 6376, provides a cryptographic signature for outgoing emails. This signature, associated with a domain, allows recipient servers to verify that the email has not been tampered with in transit and genuinely originated from the claimed sender.

While SPF and DKIM offered significant improvements, they operated independently and lacked a mechanism for domain owners to instruct recipient mail servers on how to handle unauthenticated mail. This gap led to the creation of DMARC. DMARC acts as an overarching policy layer that builds upon SPF and DKIM. It allows domain owners to publish a policy in their DNS records instructing recipient mail servers to verify that the domain in the visible From address aligns with the authenticated SPF or DKIM results. Furthermore, DMARC enables domain owners to specify actions for mail that fails these checks (e.g., quarantine, reject) and to receive reports on authentication failures, providing invaluable visibility into email traffic purportedly sent from their domain.

The original DMARC specification, RFC 7489, was published in March 2015. Since then, DMARC has seen widespread adoption, becoming a cornerstone of enterprise email security. Data from various industry bodies, including DMARC.org and M3AAWG (Messaging, Malware and Mobile Anti-Abuse Working Group), indicates that DMARC adoption rates have steadily climbed, with a significant percentage of Fortune 500 companies and major email senders now publishing DMARC records. This adoption has demonstrably reduced the success rates of phishing and spoofing attacks targeting DMARC-protected domains.

The "DMARCbis" Journey and Its Resolution

The term "DMARCbis" emerged during the working group’s efforts to revise and update the original DMARC specification. "Bis" in this context refers to a "second iteration" or "revisit," signifying an ongoing process of refinement. The motivation behind this revision stemmed from several factors:

• Clarification of Ambiguities: As DMARC gained widespread adoption, certain ambiguities and edge cases in the original RFC became apparent, leading to inconsistencies in implementation across different mailbox providers.
• Modernization of Language: The original RFC’s language and structure, while effective, could benefit from modernization to align with contemporary IETF standards for protocol documentation.
• Enhanced Reporting Mechanisms: Improvements to the aggregate and forensic reporting formats were sought to provide more actionable insights to domain owners.
• Alignment with Evolving Threats: The email threat landscape is dynamic, and continuous refinement ensures that DMARC remains an effective defense mechanism.

The IETF’s DMARC Working Group meticulously reviewed the original specification, incorporating feedback from implementers, researchers, and users. This collaborative process culminated in the publication of the three new RFCs in May 2026, effectively replacing RFC 7489 and cementing the modernized DMARC standard. The removal of "bis" from the nomenclature signifies the completion of this revision cycle and the establishment of the definitive DMARC protocol.

Key Changes and Clarifications in the New RFCs

While the core functionality of DMARC remains consistent, the new RFCs introduce important refinements that improve clarity, robustness, and the overall usability of the protocol:

• RFC 9989: DMARC Core Protocol: This document refactors and clarifies the fundamental mechanics of DMARC, including how it evaluates SPF and DKIM alignment, processes policy decisions, and interacts with other email authentication mechanisms. It provides a more precise definition of terms and procedures, reducing potential for misinterpretation. The core principle that DMARC passes if at least one of SPF or DKIM aligns with the visible From domain is strongly reaffirmed.
• RFC 9990: DMARC Aggregate Reports: This RFC details the structure and content of aggregate reports (RUA records). These reports provide high-level statistics on email traffic, showing how many messages passed or failed DMARC checks, and the sources from which they originated. The updated specification aims for greater consistency in report generation and parsing, making it easier for domain owners to analyze their email streams and identify potential issues or unauthorized sending.
• RFC 9991: DMARC Failure Reports: Also known as forensic or failure reports (RUF records), these provide more granular details about individual messages that failed DMARC authentication. While often sensitive due to potential privacy concerns, these reports can be invaluable for debugging authentication issues and investigating specific spoofing attempts. The new RFC clarifies the format and conditions under which these reports should be generated, offering more precise guidance to implementers.

Crucially, these updates are largely additive and clarifying rather than revolutionary. They do not alter DMARC’s fundamental "aligned SPF or aligned DKIM" evaluation model. This means that existing, correctly configured DMARC implementations should continue to function as expected, but the underlying documentation is now more robust and less ambiguous.

Why DMARC Matters: The Imperative for Authenticated Email

The modernization of DMARC underscores the protocol’s critical role in the contemporary email ecosystem. Mailbox providers, such as Google, Microsoft, and Yahoo, are increasingly stringent in their expectations for authenticated and aligned email. Unauthenticated mail is highly likely to be flagged as spam or rejected outright, severely impacting deliverability and sender reputation. In an environment where trillions of emails are sent daily, ensuring legitimate messages reach their intended recipients is paramount for businesses, organizations, and individuals.

For businesses, DMARC is not just a technical necessity but a crucial component of their cybersecurity and brand protection strategy. By preventing unauthorized use of their domain for phishing and spoofing, DMARC safeguards customer trust, protects against financial fraud, and preserves brand integrity. Organizations that have implemented DMARC with a policy of ‘p=reject’ (instructing recipient servers to reject unauthenticated mail) have reported significant reductions in successful phishing attacks targeting their brand. This directly translates into fewer customer support inquiries related to fraudulent emails, reduced risk of data breaches originating from phishing, and an overall stronger security posture.

Industry Reactions and Endorsements

The publication of the new DMARC RFCs has been met with broad approval across the email industry. Experts within the IETF DMARC Working Group have emphasized that these updates represent a maturation of the standard, reflecting years of real-world implementation experience. A hypothetical statement from an IETF spokesperson might read: "The release of RFCs 9989, 9990, and 9991 marks a significant milestone for DMARC. This is not a reinvention but a robust refinement, ensuring the protocol remains highly effective and unambiguous for the global email community. Our goal was to provide clarity and consistency, cementing DMARC’s role as a foundational pillar of email security."

Major mailbox providers are expected to fully embrace and implement the updated specifications. Their consistent message has been that authenticated email is the baseline expectation for senders. Companies like Google and Microsoft have publicly advocated for DMARC adoption for years, and these new RFCs provide a clearer, more definitive standard for their systems to adhere to. Their internal guidelines for senders already heavily lean on DMARC compliance, and these updates will further solidify those requirements.

Email Service Providers (ESPs) like Mailjet are also affirming their commitment to supporting the modernized DMARC standard. Their role involves translating these technical specifications into practical guidance and tools for their vast customer base. A representative from Mailjet might comment: "At Mailjet, we welcome the new DMARC RFCs. They provide enhanced clarity and reinforce the best practices we’ve been advocating for years. Our platform is designed to help customers achieve DMARC compliance seamlessly, and these updates simply strengthen the foundation upon which secure and reliable email delivery is built. We remain dedicated to ensuring our users can navigate the evolving email authentication landscape effectively."

Implications for Email Service Providers and Senders

For most email service providers, the updated DMARC standard means a continuation of their existing authentication strategies, with an emphasis on ensuring their systems align with the clarified definitions. They will review their internal processes, documentation, and tools to reflect the new RFC numbers and any subtle clarifications. The general advice to senders remains unchanged: implement SPF, DKIM, and DMARC.

For individual senders, particularly those managing their own email infrastructure or using ESPs, the practical takeaway is one of reinforcement rather than radical change. The core objective remains: authenticate your email, align your authenticated domains, and monitor your DMARC reporting. This involves:

• Implementing SPF records: Ensuring your DNS records correctly list all authorized sending IPs.
• Implementing DKIM signatures: Generating and applying valid DKIM signatures to your outgoing mail, and publishing the corresponding public key in your DNS.
• Publishing a DMARC policy: Starting with a ‘p=none’ policy to monitor, then moving to ‘p=quarantine’ or ‘p=reject’ as confidence grows.
• Monitoring DMARC reports: Regularly analyzing aggregate and forensic reports to identify authentication issues, legitimate sending sources, and potential spoofing attempts.

Focus on Mailjet Customers: Navigating the Updated DMARC Landscape

For Mailjet customers, the DMARC update solidifies existing best practices. Mailjet, like many ESPs, has long emphasized the importance of email authentication. Understanding Mailjet’s default configurations is key to ensuring DMARC compliance.

Mailjet’s DKIM-First Default Explained:
When a Mailjet user validates a sender domain, Mailjet automatically handles the DKIM setup. This typically involves:

• Generating DKIM keys: Mailjet generates a unique DKIM key pair for the customer’s domain.
• Providing DNS records: Mailjet provides the necessary CNAME records that the customer must add to their domain’s DNS. These CNAMEs point to Mailjet’s DKIM infrastructure, allowing Mailjet to sign outgoing emails with the customer’s domain.
• Automated Signing: When emails are sent through Mailjet, they are automatically signed with a DKIM signature using the customer’s authenticated domain.

This default setup makes DKIM alignment straightforward. If the visible From address of an email uses the same domain (or an aligned subdomain) that has been authenticated in Mailjet, DKIM alignment is achieved, and DMARC will typically pass through DKIM. For example, if your From address is [email protected] and example.com is authenticated in Mailjet, the DKIM signature will be for example.com, leading to alignment.

The Role of Return-Path and SPF Alignment for Mailjet:
By default, Mailjet uses a provider-owned bounce domain for the Return-Path (also known as the MAIL FROM address) of outgoing emails. This domain is typically something like bnc3.mailjet.com.

• SPF Authentication: Mailjet publishes SPF records for its bnc3.mailjet.com domain, ensuring that emails sent through its infrastructure pass SPF checks for that domain.
• SPF Alignment Challenge (Default): Under Mailjet’s default configuration, SPF alignment for DMARC is not typically achieved with the customer’s visible From domain. This is because the Return-Path domain (bnc3.mailjet.com) does not align with the customer’s From domain (example.com).

However, DMARC only requires one aligned authenticated identifier (either SPF or DKIM) to pass. Given Mailjet’s robust DKIM default, most Mailjet customers achieve DMARC compliance through DKIM alignment. This is a perfectly valid and secure approach.

Custom Return-Path Options for Enhanced SPF Alignment:
For Mailjet customers who desire both SPF and DKIM alignment, or who have specific compliance requirements, Mailjet offers the option to configure a custom Return-Path. This feature is typically available on paid plans and involves a specific setup process.

• Custom Subdomain: Customers can configure a subdomain within their organizational domain (e.g., bounces.example.com) to be used as the Return-Path.
• DNS Configuration: This requires adding specific CNAME records to the customer’s DNS, pointing the custom Return-Path subdomain back to Mailjet’s bounce processing infrastructure.
• SPF Record: Mailjet’s system will then handle the SPF records for this custom subdomain, ensuring that SPF checks pass.

Once a custom Return-Path is configured, SPF can support DMARC alignment under relaxed alignment (aspf=r). In this scenario, the MAIL FROM / Return-Path (bounces.example.com) is a Mailjet-managed bounce subdomain within the customer’s organizational domain (example.com). Since the organizational domains match, relaxed SPF alignment is achieved. Mailjet continues to handle bounce processing transparently.

Customers considering strict SPF alignment (aspf=s) must review this setup carefully. Strict alignment requires the MAIL FROM domain to exactly match the visible From domain. A custom Return-Path subdomain (bounces.example.com) would not achieve strict alignment with a From domain of example.com. This is an important distinction for advanced users.

It’s also crucial to note that dedicated IPs, while affecting reputation control and deliverability troubleshooting, do not alter DMARC’s alignment rules. Whether using shared or dedicated Mailjet IPs, DMARC still evaluates alignment between the visible From domain and the authenticated SPF or DKIM identifiers.

Actionable Steps for Mailjet Senders:
To respond effectively to the DMARC update and ensure robust email authentication, Mailjet customers should review the following:

1. Verify Domain Authentication: Ensure all sender domains used in the visible From address are properly authenticated within Mailjet, with the necessary DKIM CNAME records correctly published in their DNS.
2. Monitor DMARC Reports: Actively monitor DMARC aggregate reports to gain visibility into email traffic from their domains. This helps identify legitimate sending sources and unauthorized spoofing attempts.
3. Review DMARC Policy: Evaluate their current DMARC policy (p=none, p=quarantine, or p=reject) and consider moving to a stricter policy if reports indicate a clean sending profile.
4. Consider Custom Return-Path for SPF Alignment: If both SPF and DKIM alignment are desired or required, explore Mailjet’s custom Return-Path feature, understanding its implications for relaxed vs. strict SPF alignment. Consult Mailjet’s current documentation and support for setup details, as availability and specifics may evolve.
5. Stay Informed: Regularly check Mailjet’s help center and documentation for the latest guidance on email authentication best practices and platform-specific configurations.

Broader Impact on Cybersecurity and Brand Trust

The IETF’s modernization of DMARC is a testament to the protocol’s enduring importance in the digital landscape. By clarifying ambiguities and strengthening documentation, the new RFCs reinforce the foundation upon which secure email communication is built. This sustained commitment to robust standards directly contributes to a safer internet for everyone. As cyber threats continue to evolve, strong authentication mechanisms like DMARC are indispensable for protecting individuals from fraud and safeguarding the reputations of businesses and organizations. The journey from RFC 7489 to RFCs 9989, 9990, and 9991 illustrates a continuous, collaborative effort by the global internet community to make email a more trustworthy and secure medium.

Future Outlook

While DMARC has reached a new level of maturity, the landscape of email security is ever-changing. Emerging standards and technologies, such as Brand Indicators for Message Identification (BIMI), which leverages DMARC to display authenticated brand logos in inboxes, demonstrate the ongoing innovation in this space. The IETF and the broader email community will undoubtedly continue to explore new ways to enhance email security, privacy, and user experience. For now, the message is clear: DMARC is here to stay, stronger and clearer than ever, serving as a vital shield against the pervasive threats of email spoofing and phishing.