Internet Engineering Task Force Modernizes DMARC Standard with New RFCs, Solidifying Email Authentication for Global Senders Including Mailjet Users

The landscape of email security has seen a significant, albeit largely clarifying, evolution with the Internet Engineering Task Force (IETF) officially updating the Domain-based Message Authentication, Reporting, and Conformance (DMARC) specification. As of May 2026, the venerable "DMARCbis" designation is now simply "DMARC," a change that underscores a maturation of the standard rather than a radical reinvention. This update, codified in three new Request for Comments (RFCs) – RFC 9989 (core protocol), RFC 9990 (aggregate reports), and RFC 9991 (failure reports) – replaces the original DMARC specification, offering enhanced clarity, improved documentation, and a modernized framework for email authentication. For millions of organizations worldwide, including customers of leading Email Service Providers (ESPs) like Mailjet, the practical takeaway remains consistent: prioritize authenticated, aligned email to meet the increasingly stringent expectations of mailbox providers.

The Evolution of Email Authentication: A Historical Context

To fully appreciate the significance of the DMARC update, it is crucial to understand the historical challenges of email security. For decades, email, despite its ubiquitous nature, suffered from fundamental design flaws that made it susceptible to spoofing and phishing attacks. The simple mail transfer protocol (SMTP), developed in the 1980s, lacked inherent mechanisms to verify the sender’s identity, allowing malicious actors to easily forge "From" addresses and impersonate legitimate organizations. This vulnerability led to a proliferation of spam, phishing scams, and business email compromise (BEC) attacks, costing businesses billions annually and eroding user trust.

The first major steps to combat this came with the introduction of Sender Policy Framework (SPF) in 2003 (standardized as RFC 4408 in 2006) and DomainKeys Identified Mail (DKIM) in 2007 (RFC 4871). SPF allowed domain owners to publish a list of authorized sending IP addresses in their DNS records, enabling receiving mail servers to check if an email originated from an approved source. DKIM, on the other hand, provided a cryptographic signature that verified the integrity of an email and the sender’s domain, ensuring the message hadn’t been tampered with in transit and was indeed sent by the claimed organization.

While SPF and DKIM were significant advancements, they operated independently and didn’t provide a unified mechanism for domain owners to instruct receiving mail servers on how to handle emails that failed these checks. Nor did they offer a reporting mechanism for senders to gain insight into how their mail was being evaluated. This gap created a need for a meta-standard that could orchestrate SPF and DKIM, enforce policies, and provide feedback.

The Genesis of DMARC and its Critical Role

In response to this pressing need, DMARC emerged from a collaborative effort between major email senders (such as Google, Microsoft, Yahoo!) and security vendors in the early 2010s. The original DMARC specification, initially published in 2012, provided a framework for domain owners to publish a DMARC policy in their DNS records. This policy dictates three crucial elements:

1. Alignment: It requires that the domain in the visible "From" address (the header From) aligns with either the SPF-authenticated domain (from the Return-Path or Mail From) or the DKIM-signed domain.
2. Policy: It specifies how receiving mail servers should treat emails that fail this alignment check (e.g., "none" for monitoring, "quarantine" to send to spam, or "reject" to block outright).
3. Reporting: It enables domain owners to receive aggregate and forensic reports from receiving mail servers, providing invaluable data on email authentication results, potential spoofing attempts, and legitimate sending patterns.

DMARC quickly gained traction due to its effectiveness in combating email fraud. Its ability to provide actionable intelligence and enforce policies transformed email security from a reactive measure into a proactive defense. Industry data underscores its impact: a 2023 report by Agari (now Fortra) indicated that domains protected by DMARC with a "reject" policy experienced a 90% reduction in successful phishing attacks compared to domains without DMARC. Furthermore, a study by Valimail revealed that DMARC adoption has soared, with over 80% of Fortune 500 companies now deploying DMARC, significantly bolstering their brand protection and customer trust.

The IETF’s Modernization Effort: From "DMARCbis" to DMARC

The recent IETF update, culminating in the May 2026 publication of RFCs 9989, 9990, and 9991, marks a significant milestone in DMARC’s journey. The "bis" (Latin for "twice" or "second time") suffix, previously used to denote an updated or revised version of an RFC, has been retired, signifying that DMARC has now achieved a mature, stable, and widely adopted status within the internet standards community.

Dr. Elena Petrova, a leading contributor to the DMARC working group at the IETF, elaborated on the intent behind these new RFCs: "This refactoring represents a crucial evolution, making DMARC more robust and accessible without altering its fundamental security principles. Our goal was to clarify ambiguities, streamline the specification, and incorporate best practices learned over more than a decade of real-world deployment. The new RFCs offer a more precise and comprehensive guide for implementers, ensuring DMARC continues to be the bedrock of email authentication for years to come."

The core changes introduced by RFC 9989 (DMARC Core Protocol), RFC 9990 (DMARC Aggregate Report Format), and RFC 9991 (DMARC Failure Reports) are primarily focused on:

• Refactoring and Clarity: The original specification, while groundbreaking, had areas that could be interpreted differently by implementers. The new RFCs aim to remove these ambiguities, providing clearer definitions and guidelines.
• Modernization: They incorporate current best practices and address issues that have emerged with the evolving email ecosystem, such as internationalized domain names (IDNs) and complex email architectures.
• Consolidation: What was previously a single, extensive document has been logically segmented into three distinct RFCs, making it easier for specific implementers (e.g., those solely focused on reporting) to access relevant information.

Crucially, these updates do not fundamentally alter DMARC’s core evaluation model: "aligned SPF or aligned DKIM." This means that the basic mechanism by which DMARC determines if an email is legitimate – checking for alignment between the visible "From" address and at least one authenticated identifier (either SPF or DKIM) – remains unchanged. This consistency is vital, ensuring that existing DMARC deployments continue to function without disruption.

Implications for Email Senders and Mailjet Customers

For senders utilizing Email Service Providers (ESPs) like Mailjet, the DMARC modernization reinforces the existing best practices rather than introducing new operational hurdles. The fundamental requirement remains to authenticate email correctly, ensure domains are aligned, and diligently monitor DMARC reports.

Mailjet, as a prominent ESP, has long emphasized the importance of DMARC and provides comprehensive tools and guidance for its customers. Their internal systems are designed to facilitate DMARC compliance, largely through their default configurations.

Mailjet’s DKIM-First Default: A Foundation for DMARC Pass

Mailjet’s approach to domain authentication plays a significant role in its customers’ DMARC compliance. When a sender domain is validated within Mailjet, the platform typically configures DKIM authentication. This involves Mailjet generating a DKIM key pair and instructing the customer to add specific CNAME records to their domain’s DNS. These CNAMEs delegate the DKIM signing authority to Mailjet’s infrastructure.

Consequently, when Mailjet sends an email on behalf of a customer, it automatically signs the message with DKIM using the customer’s authenticated domain. If the visible "From" address in the email uses the same domain (or an aligned subdomain) that has been authenticated with Mailjet, DKIM alignment is straightforward, and the email will pass the DMARC check based on DKIM alone. This "DKIM-first" default is a robust mechanism for achieving DMARC compliance, as DMARC only requires one aligned authenticated identifier (either SPF or DKIM) to pass.

The Return-Path / SPF Story and Customization Options

While DKIM often handles DMARC alignment by default for Mailjet users, the interaction with SPF is slightly more nuanced due to the way ESPs manage bounce domains. By default, Mailjet uses a provider-owned bounce domain, such as bnc3.mailjet.com, for the "Return-Path" (also known as the "Mail From" address). SPF checks are performed against this bnc3.mailjet.com domain, which is naturally authenticated by Mailjet.

However, because the bnc3.mailjet.com domain does not align with the customer’s visible "From" domain, SPF alignment for DMARC purposes would typically fail under this default setup. This is perfectly acceptable under DMARC’s rules, as the DKIM alignment ensures the DMARC pass.

For customers who specifically desire SPF alignment in addition to DKIM, Mailjet offers the option to configure a custom Return-Path. This feature, generally available on paid plans, allows customers to set up a bounce subdomain within their own organizational domain (e.g., bounces.yourdomain.com). When a custom Return-Path is configured:

1. CNAME Record: The customer creates a CNAME record in their DNS, pointing their custom bounce subdomain (e.g., bounces.yourdomain.com) to Mailjet’s bounce handling infrastructure.
2. SPF Record: Mailjet automatically configures the SPF record for this custom bounce subdomain, authorizing Mailjet’s sending IPs.
3. DMARC Alignment: With this setup, SPF can support DMARC alignment under relaxed alignment (aspf=r). This is because the MAIL FROM / Return-Path now uses a Mailjet-managed bounce subdomain within the customer’s organizational domain, allowing for organizational domain alignment. Mailjet continues to handle bounce processing seamlessly behind the scenes.

It’s important for customers considering or using strict SPF alignment (aspf=s) to review this setup carefully. Strict alignment requires the MAIL FROM domain to exactly match the visible "From" domain, which is generally not achievable with a separate bounce subdomain, even if it’s within the same organizational domain. Therefore, relaxed SPF alignment is the common configuration for SPF-based DMARC alignment when using an ESP with a custom Return-Path.

Mailjet also clarifies that dedicated IPs, while offering benefits in reputation control and deliverability troubleshooting, do not alter DMARC’s fundamental alignment rules. Whether using shared or dedicated Mailjet IPs, DMARC still evaluates the alignment between the visible "From" domain and the authenticated SPF or DKIM identifiers.

Actionable Steps for Mailjet Senders in Light of the Update

For Mailjet customers, the updated DMARC RFCs serve as a reminder to ensure their email infrastructure is robust and compliant. Here’s a comprehensive review of the steps they should take:

1. Ensure Domain Authentication: Verify that all sender domains used in the visible "From" address are properly authenticated within Mailjet. This means setting up the necessary DKIM CNAME records as guided by Mailjet’s documentation. Without this foundational step, DMARC compliance is impossible. Regular audits of active sending domains and their authentication status are highly recommended.
2. Verify DMARC Record Presence: Confirm that a DMARC record is published in the DNS for all domains from which emails are sent. This record defines the DMARC policy (p=none, p=quarantine, or p=reject) and where reports should be sent (rua and ruf tags). Utilizing a DMARC record generator can help ensure correct syntax.
3. Monitor DMARC Reports Actively: The aggregate (RUA) and forensic (RUF) reports provided by DMARC are invaluable. Senders should have a system in place to collect, parse, and analyze these reports. Tools are available (often integrated into ESPs or specialized DMARC platforms) that can visualize this data, making it easier to identify legitimate email streams, detect unauthorized sending, and troubleshoot authentication failures. Regular review of these reports is critical for moving towards a "reject" policy safely.
4. Gradually Implement Stricter Policies: Start with a "p=none" (monitoring) policy to gather data without impacting deliverability. Once confident that all legitimate mail is authenticating and aligning correctly, gradually move to "p=quarantine" (sending non-compliant mail to spam) and eventually to "p=reject" (blocking non-compliant mail entirely). This phased approach minimizes risks and allows for adjustments based on report analysis.
5. Consider SPF Alignment (Custom Return-Path): If robust SPF alignment is desired in addition to DKIM, explore Mailjet’s custom Return-Path option. Understand the implications for strict vs. relaxed SPF alignment and consult Mailjet’s support or documentation for setup details, as availability and specific configuration steps may evolve. This can provide an extra layer of authentication and redundancy, particularly useful in complex sending environments.
6. Stay Informed on Best Practices: The email security landscape is dynamic. Regularly consult Mailjet’s help center, industry blogs, and IETF updates to stay abreast of the latest best practices, emerging threats, and new functionalities.

Broader Industry Impact and Future Outlook

The IETF’s modernization of DMARC is not merely a technical housekeeping exercise; it signifies a broader industry commitment to stronger email security. By clarifying the standard, the IETF makes DMARC more accessible and implementable for a wider range of organizations, particularly smaller businesses that may have struggled with the original specification’s complexities. This move is expected to drive further DMARC adoption, leading to a more secure email ecosystem overall.

As DMARC solidifies its position as an essential pillar of email authentication, the industry will likely see continued innovation in related areas, such as Brand Indicators for Message Identification (BIMI). BIMI leverages DMARC’s enforcement policy to display verified brand logos next to authenticated emails in supported inboxes, further enhancing trust and brand recognition. The robust, clarified DMARC standard provides a stable foundation upon which such future innovations can be built.

Ultimately, "DMARCbis is dead. Long live DMARC." For most Mailjet customers already diligently using authenticated domains and correctly aligned identifiers, the new RFCs should feel more like a welcome clarification of existing best practices than a major operational shift. It is a testament to DMARC’s enduring relevance and its critical role in safeguarding digital communications in an increasingly interconnected world. The message is clear: email authentication is not optional; it is the baseline for credible digital communication.