DMARCbis is now DMARC, Marking a Significant Modernization of Email Authentication Standards

On June 1, 2026, a pivotal shift in the landscape of email authentication was officially recognized as "DMARCbis" transitioned to simply "DMARC," signaling the formal adoption of updated specifications by the Internet Engineering Task Force (IETF). This critical evolution, enshrined in three new Request for Comments (RFCs) published in May 2026, does not fundamentally alter the core mechanism of DMARC – its reliance on either aligned SPF or aligned DKIM for validation – but rather refactors, clarifies, and modernizes the underlying documentation. The practical implication for senders and mailbox providers alike is a reinforced expectation for robust email authentication as a baseline for trusted communication.

The Evolution of Email Authentication: A Journey to Trust

To fully grasp the significance of this update, it is essential to understand the journey of email authentication. For decades, email suffered from a fundamental flaw: the sender’s address displayed to the recipient (the "From" header) could easily be forged, leading to rampant phishing, spoofing, and spam. This vulnerability undermined trust in email as a communication channel and posed significant security risks to individuals and organizations.

The initial attempts to address this problem came in the form of Sender Policy Framework (SPF) and DomainKeys Identified Mail (DKIM). SPF, first standardized in 2006 (RFC 4408, later updated to RFC 7208), allows domain owners to publish a list of authorized sending IP addresses in their DNS records. When an email server receives a message, it can check the sender’s domain against its SPF record to verify if the sending IP is legitimate. DKIM, standardized in 2007 (RFC 4871, later updated to RFC 6376), employs cryptographic signatures. A sending server signs outgoing emails with a private key, and the recipient server uses a public key published in the sender’s DNS to verify the signature, ensuring the message hasn’t been tampered with in transit and originated from an authorized domain.

While SPF and DKIM provided powerful authentication mechanisms, they had a critical shortcoming: they authenticated technical domains (like the "Return-Path" for SPF or the "d= domain" for DKIM) but did not explicitly link these to the visible "From" address that users see. This gap allowed sophisticated spoofing attacks where an email might pass SPF or DKIM checks for a legitimate technical domain, while displaying a forged "From" address to trick recipients. This is where DMARC (Domain-based Message Authentication, Reporting, and Conformance) entered the scene.

DMARC: Bridging the Authentication Gap

DMARC was developed collaboratively by major email providers (including Google, Microsoft, Yahoo, and PayPal) to address the limitations of standalone SPF and DKIM. Its primary innovation was to introduce the concept of "alignment." DMARC mandates that the domain in the visible "From" header must "align" with either the domain checked by SPF (the Return-Path domain or "MAIL FROM" domain) or the domain signed by DKIM (the "d= domain"). This alignment requirement ensures that the authenticated technical domains are indeed associated with the brand or entity displayed to the end-user.

Furthermore, DMARC introduced reporting mechanisms, allowing domain owners to receive aggregated feedback reports (RUA records) and forensic failure reports (RUF records) from recipient mail servers. These reports provide invaluable insights into who is sending email purporting to be from their domain, enabling organizations to identify legitimate sending sources that need authentication and detect malicious actors attempting to spoof their brand. DMARC also introduced policy options (p=none, p=quarantine, p=reject) that instruct recipient servers on how to handle emails that fail alignment, ranging from simply monitoring to sending to spam, or outright blocking.

The original DMARC specification, RFC 7489, was published in March 2015. Over the subsequent years, as DMARC gained widespread adoption and practical implementation, the need for refinements, clarifications, and modernizations became apparent. This iterative process led to various working drafts and unofficial revisions, often colloquially referred to as "DMARCbis" – indicating a "second version" or "revision in progress." The formalization of these updates by the IETF in May 2026 marks the culmination of this refinement, cementing DMARC as a robust and essential pillar of email security.

The IETF and the Standardization Process

The Internet Engineering Task Force (IETF) is a global community of network designers, operators, vendors, and researchers concerned with the evolution of the Internet architecture and the smooth operation of the Internet. It is the principal body engaged in the development of new Internet standard specifications, known as RFCs. The process of creating an RFC is rigorous, involving extensive discussion, review, and consensus-building among experts. The publication of RFCs signifies a mature and widely accepted standard that can be implemented by the global Internet community. The transition of DMARC from its initial RFC to a set of updated RFCs underscores its critical role and the IETF’s commitment to evolving Internet standards to meet contemporary challenges.

May 2026: A Deep Dive into the New DMARC RFCs

The official declaration that DMARCbis is now simply DMARC is anchored by the publication of three new RFCs in May 2026, which supersede the original DMARC specification (RFC 7489). These new standards are:

• RFC 9989: The DMARC Core Protocol: This RFC defines the fundamental DMARC mechanism, including how DMARC records are published in DNS, how recipient servers evaluate DMARC policies based on SPF and DKIM alignment, and the various policy options (none, quarantine, reject). The "refactoring" aspect here means a clearer, more modular presentation of the protocol, making it easier for implementers to understand and for future extensions to be integrated. It consolidates best practices and addresses ambiguities identified in the original specification over years of real-world deployment.
• RFC 9990: DMARC Aggregate Reports: This RFC details the format and content of aggregate DMARC reports (RUA reports). These XML-based reports provide a high-level overview of email streams purporting to be from a domain, indicating how many messages passed or failed DMARC checks, and providing insights into the sending sources (IP addresses, SPF/DKIM domains). The updates likely include clarifications on report generation, handling of reporting errors, and potentially new fields or more precise definitions for existing ones, enhancing the utility and interoperability of these crucial reports. For instance, the original RFC left some room for interpretation on how certain reporting elements should be structured, and the new RFCs likely tighten these definitions to ensure consistency across reporting entities.
• RFC 9991: DMARC Failure Reports: This RFC specifies the format and content of forensic or failure reports (RUF reports). These reports provide more granular, anonymized details about individual messages that fail DMARC, often including headers and snippets of the message body. While less commonly used due to privacy concerns and the potential for overwhelming volume, they can be invaluable for forensic analysis of specific spoofing attempts. The new RFC likely clarifies the conditions under which these reports are generated, their structure, and privacy considerations, aiming to make them more actionable when deployed responsibly.

The overarching theme of these updates is modernization and clarification rather than reinvention. The core logic of "aligned SPF or aligned DKIM" remains untouched. This continuity is a testament to the robustness of the original DMARC design while acknowledging the need for the specification to evolve with the broader email ecosystem.

The Broader Implications for the Email Ecosystem

The formalization of DMARC under these new RFCs carries significant implications across the email industry:

• Heightened Expectations for Mailbox Providers: With an updated and clarified standard, mailbox providers (like Gmail, Outlook, Yahoo) will further solidify their expectation that incoming mail is properly authenticated and aligned. This trend has been visible for years, with major providers increasingly filtering or rejecting unauthenticated mail. The new RFCs provide a clearer, more authoritative framework for these enforcement actions.
• Reinforcement of Sender Best Practices: For email senders, the message is unequivocal: DMARC is not optional. It is a fundamental requirement for deliverability, brand reputation, and combating phishing. Organizations that have yet to implement DMARC, or are still operating under a "p=none" (monitoring) policy, are strongly encouraged to move towards enforcement (p=quarantine or p=reject). Data from industry sources consistently shows that domains with DMARC policies at quarantine or reject levels experience significantly lower rates of email spoofing and improved deliverability. For example, reports often indicate that Fortune 500 companies have achieved high DMARC adoption rates, and those with enforcement policies are less likely to be targeted by phishing attacks impersonating their brand.
• Enhanced Email Security and Trust: By providing a clearer, more robust standard, the updated DMARC specification contributes directly to a more secure email environment. As more senders adopt and enforce DMARC, the overall volume of unauthenticated and malicious email should decrease, leading to greater trust in the inbox. This is a critical component in the ongoing battle against cybercrime, which heavily relies on email as an attack vector.
• Facilitating Future Innovations: A modernized and well-defined core protocol provides a stable foundation for future email security innovations. For instance, standards like Brand Indicators for Message Identification (BIMI), which allows companies to display their brand logo next to authenticated emails, rely heavily on DMARC enforcement. The clarity in the new DMARC RFCs will streamline the integration of such complementary technologies.

Mailjet’s Perspective and Guidance for Users

For Mailjet customers, the DMARC update reinforces existing best practices rather than introducing a radical new paradigm. Mailjet, as a leading transactional and marketing email service provider, has long advocated for robust authentication. The practical takeaway remains simple: authenticate your email, align your authenticated domains, and monitor your DMARC reporting.

Quick DMARC Refresher for Mailjet Users:
DMARC’s core function is to check if the domain in the visible From address aligns with authenticated SPF or DKIM results. If at least one of these identifiers aligns, DMARC passes. It’s crucial to understand that DMARC does not require both SPF and DKIM to align; one valid alignment is sufficient.

Mailjet’s DKIM-First Default:
Mailjet’s default configuration significantly streamlines DKIM alignment for its users. When a sender domain is validated within Mailjet:

1. Mailjet provides a CNAME record that must be added to the customer’s DNS.
2. This CNAME record delegates DKIM signing authority for a specific subdomain (e.g., mail._domainkey.yourdomain.com) to Mailjet’s infrastructure.
3. Mailjet then signs all emails sent from that validated domain using its own DKIM private key, with the d= tag set to the customer’s validated domain or an aligned subdomain.

This setup means that DKIM alignment is straightforward: if your visible From address uses the same domain (or an aligned subdomain) that you’ve authenticated in Mailjet, DKIM will pass, and consequently, DMARC will typically pass through DKIM alignment by default.

The Return-Path / SPF Story:
While DKIM alignment is often the primary mechanism for DMARC pass in Mailjet’s default setup, SPF also plays a role, though it requires specific configuration for alignment. By default, Mailjet uses a provider-owned bounce domain, such as bnc3.mailjet.com, as the "Return-Path" (or "MAIL FROM") address.

1. When Mailjet sends an email on your behalf, the SPF check is performed against bnc3.mailjet.com.
2. Mailjet publishes an SPF record for bnc3.mailjet.com that authorizes its sending IPs.
3. Therefore, SPF passes for the bnc3.mailjet.com domain.

However, in this default configuration, the bnc3.mailjet.com domain does not align with your visible From domain (e.g., yourdomain.com). Consequently, SPF alignment for DMARC purposes will fail under Mailjet’s default setup. As noted earlier, this is acceptable because DMARC only requires one aligned identifier, and DKIM alignment is typically achieved.

Custom Return-Path with Mailjet for SPF Alignment:
For Mailjet customers who desire SPF alignment as well, perhaps for added redundancy or to meet specific internal compliance requirements, Mailjet supports a custom Return-Path feature on paid plans. This feature allows customers to configure a subdomain of their own domain (e.g., bounces.yourdomain.com) to be used as the Return-Path address.

1. To enable this, customers typically need to add a CNAME record to their DNS, delegating bounces.yourdomain.com to a Mailjet-managed bounce subdomain.
2. Mailjet then uses this custom Return-Path for outgoing mail.
3. When SPF is checked, it validates against bounces.yourdomain.com. Since this is a subdomain of yourdomain.com, SPF alignment can be achieved under "relaxed" DMARC alignment (aspf=r). Under relaxed alignment, the Return-Path domain simply needs to share the organizational domain with the visible From address. Mailjet continues to handle bounce processing transparently behind the scenes.

It’s important to note that custom Return-Path configurations usually have limitations, such as one active custom Return-Path per API key, and the feature’s availability and setup process may depend on the customer’s plan and require engagement with Mailjet support. Customers considering "strict" SPF alignment (aspf=s), which requires an exact match between the Return-Path domain and the visible From domain, should review this setup carefully, as Mailjet’s custom Return-Path typically facilitates relaxed alignment.

Dedicated IPs and DMARC:
Mailjet clarifies that the use of shared versus dedicated IPs does not alter DMARC’s fundamental alignment rules. While dedicated IPs can offer more control over reputation and simplify deliverability troubleshooting, DMARC still evaluates the alignment between your visible From domain and your authenticated SPF or DKIM identifiers, irrespective of the specific IP address used for sending. The focus remains on domain-level authentication and alignment.

What Mailjet Senders Should Review:
In response to the DMARC update, Mailjet provides a clear checklist for its users:

1. Verify Domain Authentication: Ensure all sending domains and subdomains are properly authenticated within Mailjet, particularly for DKIM. This is the cornerstone of DMARC compliance.
2. Confirm DMARC Record Publication: Check that a DMARC record (TXT record starting with v=DMARC1) is published in your domain’s DNS. If not, create one. Start with a p=none policy to monitor traffic before moving to enforcement.
3. Monitor DMARC Reports: Actively review aggregate (RUA) reports to understand your email ecosystem. Identify legitimate sending sources that may not yet be authenticated and detect any unauthorized sending.
4. Evaluate Alignment: Use DMARC reports to confirm that your emails are consistently achieving DKIM alignment (and SPF alignment if a custom Return-Path is configured) when sent via Mailjet.
5. Progress to Enforcement: Once you have a clear picture of your email traffic and have authenticated all legitimate sources, consider moving your DMARC policy from p=none to p=quarantine and eventually to p=reject to fully protect your brand from spoofing.

The Enduring Principles of Email Authentication

The journey from the original DMARC specification to the new RFCs published in May 2026 underscores the dynamic nature of internet standards and the continuous effort required to secure digital communication. While the "DMARCbis" moniker has faded, the core principles it represents – domain-based message authentication, alignment, and reporting – remain more vital than ever.

The transition from DMARCbis to DMARC is not a seismic shift but a mature refinement. It solidifies DMARC’s status as a foundational standard for email security and deliverability. For most Mailjet customers who have already diligently implemented authenticated domains and correctly aligned identifiers, these new RFCs will feel less like a major operational upheaval and more like a welcome clarification and reaffirmation of established best practices. In an era where email remains a primary vector for cyber threats, the modernization of DMARC is a crucial step forward in building a more trustworthy and secure digital environment for everyone.