DKIM2 and DMARCbis — What Email Operators Need to Know

Two email authentication standards are changing. DKIM2 upgrades the cryptographic backbone of email signing. DMARCbis revises how DMARC policies work. If you run either standard in production, here is what actually changed and what you should do next.

What DKIM2 changes

DKIM (RFC 6376) has been the workhorse of email authentication for years. It works by attaching a digital signature to outgoing messages. Receivers verify the signature using a public key published in DNS.

DKIM2 (RFC 8463) makes two significant changes.

First, it increases the minimum recommended key size. The original DKIM standard allowed 1024-bit RSA keys, which are now considered too weak for long-term security. DKIM2 bumps the minimum to 2048-bit RSA and also introduces ECDSA using the P-256 curve as a recommended alternative. ECDSA keys are smaller and computationally cheaper to verify, which matters at high email volumes.

Second, DKIM2 defines how to handle multiple keys and selectors. If you run multiple email systems signing mail on behalf of the same domain, DKIM2 gives you a cleaner framework for managing overlapping signatures.

The practical impact: if you are still running 1024-bit DKIM keys, DKIM2 means you need to upgrade. If you are already on 2048-bit RSA, you are in better shape, but ECDSA is worth evaluating for long-term efficiency.

What DMARCbis changes

DMARCbis is the IETF working group's ongoing revision of DMARC (RFC 7489). It is not a complete rewrite, but it makes several meaningful adjustments.

One of the most watched changes is the np tag, which stands for “natural policy.” The idea is to distinguish between domains that have a formal DMARC policy and domains that just happen to have a DMARC record because their email vendor set one up automatically. The np tag lets a domain say “this is the policy for subdomains that do not have their own explicit DMARC record.” This sounds minor but matters for multi-tenant and shared-infrastructure email environments.

Another notable DMARCbis change affects how the pct tag behaves. Under the original DMARC spec, pct controls what percentage of messages are subject to DMARC filtering. DMARCbis proposes to treat low-percentage settings as signals of uncertainty rather than literal directives, which may shift how receivers interpret your DMARC policy.

DMARCbis also tightens the rules around alignment. When a message fails DKIM and SPF alignment checks, DMARCbis proposes a more precise definition of what “aligned” means when you are using forwarded or mediated mail flows.

Why this matters for your email program

Most organizations have not yet acted on either DKIM2 or DMARCbis. The email infrastructure world moves slowly, and these are not emergency changes. But the direction is clear.

On DKIM2, the key upgrade path matters if you are still using 1024-bit RSA keys or if you have not audited your DKIM key rotation schedule recently. ECDSA is genuinely better for high-volume senders, but it requires support from your email signing infrastructure, which may lag behind the standard.

On DMARCbis, the np tag is the most operationally relevant change for organizations that run complex email environments. If you have multiple brands, subsidiaries, or third-party senders sharing your domain, the natural policy distinction affects how you structure your top-level DMARC record.

How to test safely without breaking production

This is where the “playground” concept comes in. The challenge with both DKIM2 and DMARCbis is that you cannot just flip a switch in production without risking email delivery disruption.

A safe testing approach looks like this:

• Set up a test domain or subdomain that is not used for production email
• Generate DKIM2 ECDSA keys and publish them in DNS alongside your existing RSA keys
• Configure your test email system to sign with the DKIM2 key
• Send test messages to inbox test accounts at major receivers (Gmail, Microsoft, Apple) and check authentication results
• For DMARCbis, publish a test DMARC record with the np tag on your test domain and monitor aggregate reports

This is where DMARCFlow helps. DMARCFlow monitors your DKIM key sizes automatically, flags any selectors still on 1024-bit RSA, and tracks your DMARC policy changes over time. Before you roll a DKIM2 upgrade to production, you can see your current baseline in DMARCFlow. After the change, you can confirm that all major receivers are reading your new keys correctly. It removes the need to manually check DNS, cross-reference multiple receiver portals, and guess whether a delivery problem is related to your authentication upgrade.

What to do right now

Three concrete steps:

First, check your current DKIM key sizes. If any selector is still using 1024-bit RSA, plan your upgrade to 2048-bit RSA or ECDSA P-256. Most major email providers support 2048-bit RSA today.

Second, review your DMARC policy structure. If you have subdomains with different email providers, look at how your top-level DMARC record handles them. DMARCbis np semantics may change how you want to structure that.

Third, set up a test environment for both standards. Do not change production until you have seen how receivers handle your signed test messages with the new key types and DMARC policies.

FAQ

Is DKIM2 a replacement for DKIM?
No. DKIM2 extends and updates DKIM. Existing DKIM signatures will continue to work. The change is additive, not a hard cutover.

Will Gmail or Microsoft reject my email if I do not implement DKIM2?
Not yet. Neither major receiver has announced a hard requirement for DKIM2. But both have been gradually tightening authentication requirements, and moving to stronger keys is good practice regardless.

Can I use ECDSA for DKIM now?
Yes, if your email signing software supports it. OpenDKIM and other common signing tools have added ECDSA support. Test carefully before deploying in production.

Does DMARCFlow monitor for DKIM key size compliance?
Yes. DMARCFlow checks DKIM selector key sizes and flags any that fall below current recommended minimums.

What is the timeline for DMARCbis becoming official?
DMARCbis is still in IETF working group draft stage. It is too early to predict an exact timeline. Treat it as something to prepare for, not something that requires immediate action.