DKIM2 and DMARCbis - Next Gen Email Auth Explained

Two Decades of Email Authentication, Due for an Upgrade

Email authentication has been holding the internet's mail system together for almost twenty years. The two standards doing most of the work - DKIM1 (RFC 6376) and DMARC (RFC 7489) - were designed in a different era of mail routing. They have aged reasonably well, but practitioners who manage email infrastructure daily know their failure modes intimately.

Forwarding breaks DKIM signatures silently. Valid DKIM signatures can be captured and replayed to new recipients, and every copy will verify. Bounces cannot prove they came from a real sender. DMARC's reliance on the static Public Suffix List creates edge cases that regularly trip up multi-domain hosting setups. Several DMARC tags have never worked reliably in practice.

Two new standards have arrived to address these problems directly. DKIM2 (currently draft-04 at the IETF, not yet a final RFC) reworks the signature model so forwarding no longer breaks verification, replayed messages fail validation, and bounces can carry cryptographic proof of origin. DMARCbis was published in May 2026 as three companion RFCs - RFC 9989, RFC 9990, and RFC 9991 - and replaces the static Public Suffix List with a live DNS tree walk while removing the tags that never worked.

Both matter because email authentication is what keeps a phisher from putting your domain in the From: line. Until now the machinery doing that job has been showing its age.

What DKIM2 Changes About Email Signatures

DKIM1 does one thing: it lets a domain take responsibility for a message by hashing selected header fields and the body, signing the result with a private key, and attaching the signature to the message. The matching public key lives in DNS at selector._domainkey.domain. Any receiving server can fetch it, recompute the hash, and confirm the content was authorised by that domain.

That model has three known problems DKIM2 targets directly.

**Forwarding breaks signatures silently.** The moment a mailing list modifies a subject line, a gateway rewrites a link, or a forwarder appends a footer, the DKIM signature fails. The sender has no way to know this happened until recipients start asking why their newsletters stopped arriving. DKIM2 addresses this with a chained signature model. Each entity in the delivery path - the author, any forwarders, the final receiver - adds its own signature. Verification can follow the chain, and modifications that are normal in forwarding do not break the author's signature.

**Valid signatures can be replayed.** Capture one legitimately signed DKIM1 message and you can replay it unchanged to any other recipient, and every copy will verify. The signature proves the domain authorised some message with that content - not that this specific message was intended for this specific recipient. DKIM2 binds signatures to the destination as well as the content. A signature issued for recipient A cannot be replayed to recipient B.

**Bounces are unverifiable.** A domain with p=reject will discard bounced messages that fail authentication. But a bounced message that passes authentication proves nothing about whether it was genuinely sent by that domain or whether it was forged and then bounced back. DKIM2 allows a bounce to carry verifiable proof of origin.

**What stays the same:** DKIM2 still uses DNS-based public key retrieval through selectors. The fundamental cryptographic primitives are proven. DKIM2 is being developed as a parallel standard, not a replacement - DKIM1 signatures will continue working for the foreseeable future.

What DMARCbis Changes About Domain Policy Enforcement

DMARC ties DKIM and SPF authentication results to the domain a human actually sees in the From: header through identifier alignment. That rule is what turns authentication into a decision. DMARCbis keeps the core alignment model but makes several significant changes.

**The static Public Suffix List is replaced by a live DNS tree walk.** The PSL is a manually maintained list of public suffixes. If your domain is registered under a suffix the PSL does not know about, DMARC alignment can fail in ways that are hard to predict or debug. DMARCbis instead walks up the DNS delegation chain at lookup time, determining domain ownership in real time rather than consulting a static list that may be out of date.

**The np tag has a known DNSSEC compatibility problem.** DMARCbis introduced the np (non-existent subdomain policy) tag to tell receivers how to handle subdomains that do not exist. The problem is that DMARC expects an NXDOMAIN DNS response for non-existent domains, while many major DNS providers - including Cloudflare, AWS Route 53, Azure DNS, and Oracle Cloud Infrastructure DNS - use compact denial-of-existence (RFC 9824). Compact denial returns NOERROR with NODATA rather than NXDOMAIN, which means the np tag may not behave as specified on DNSSEC-enabled domains using those providers. This is a known issue being tracked in the IETF working group.

**Several DMARC tags that never worked in practice have been removed or formalised.** The p tag, rua, and ruf remain. The adkim and aspf alignment modes are preserved. Specific changes are documented in RFC 9989.

**Status:** DMARCbis is a published RFC (May 2026). It is a successor to DMARC, not an overnight replacement. Mail servers will adopt it gradually.

How to Test DKIM2 and DMARCbis Today

Stalwart Labs shipped the first production-ready implementation of both standards in mail-auth, an open source Rust crate for email authentication. Anyone can experiment without installing software by using the browser-based playground at mail-auth.stalw.art.

The playground lets you sign a test message with DKIM2, verify a DKIM2-signed message, and run DMARCbis policy checks from the browser. No account, no install, no configuration.

To use it: open mail-auth.stalw.art, paste a test message, choose a selector and domain, and generate a DKIM2 key pair. The playground will show you the signed message and the verification result. You can then check how a DMARCbis policy would evaluate that message under different alignment and policy settings.

The honest caveat: no major mailbox provider is yet verifying DKIM2 signatures on incoming mail. Google, Microsoft, and Apple have not announced DKIM2 verification support. Deploying DKIM2 signing today is a forward-looking measure that will only show value as receiving infrastructure adds support. Keep your DKIM1 signing active while adding DKIM2.

On the DMARCbis side, very few receiving mail servers are actively processing DMARCbis policies as of mid-2026. Sending domains should monitor their existing DMARC aggregate reports while tracking DMARCbis adoption in receiving infrastructure.

What Email Operators Need to Know About Adoption Timeline

DKIM2 is still a draft standard. The IETF DKIM working group has draft-04 outstanding, which means the specification is still subject to change. No major inbox providers have announced DKIM2 verification capability. Expect a slow rollout - DKIM1 took roughly a decade to reach meaningful adoption rates.

DMARCbis is further along in that it is already a published RFC. However, published RFC does not mean immediate adoption. Mail server software needs to be updated to process DMARCbis policies, and receiving infrastructure needs to be updated before a sending domain's DMARCbis policy has any effect. The receiving-side adoption timeline is probably three to five years before DMARCbis is widely processed by major mailbox providers.

What to do now: test in non-production environments, monitor what major mail server software (Postfix, Exim, OpenDMARC, Stalwart) ships for DMARCbis support, and do not rush to change production sending policies. The risk of moving to strict DMARCbis policies before receiving infrastructure understands them is the same risk as moving to p=reject before you have full SPF and DKIM coverage - messages disappear silently.

DMARCFlow monitors aggregate reports for current DKIM1-based authentication. As DMARCbis enters receiving infrastructure, aggregate reporting tools will need to handle the new tags and reporting formats. Use DMARCFlow to maintain clean DKIM1 and DMARC alignment while you watch DKIM2 and DMARCbis develop. DMARCFlow will update as the standards mature.

Frequently Asked Questions

**Does DKIM2 replace DKIM1?**

No. DKIM2 is being developed as a parallel standard, not a replacement. DKIM1 signatures will continue working for the foreseeable future. DKIM2 adoption on the receiving side will take years as major mailbox providers update their verification infrastructure.

**Can I deploy DKIM2 signing on my mail server today?**

Yes, using open source implementations like Stalwart mail-auth. However, receiving mail servers will not verify DKIM2 signatures until they add support. Deploy DKIM2 signing as a forward-looking step while keeping DKIM1 signing active.

**What is the DNS tree walk in DMARCbis?**

Instead of consulting the static Public Suffix List to determine domain ownership, DMARCbis uses a live DNS lookup to follow the delegation chain from a domain upward. This resolves edge cases where the PSL is out of date, incomplete, or does not reflect a specific hosting configuration.

**Does DMARCFlow support DMARCbis today?**

DMARCFlow monitors DMARC aggregate reports for DKIM1-based authentication results. As DMARCbis is very newly published (RFC 9989-9991, May 2026), monitoring tools are still adding support. DMARCFlow will update as the standard enters receiving infrastructure.