Is DMARCbis (the DMARC update) a finalized standard yet?
Matthew Whittaker
Co-founder & CTO, Suped
Published 15 Nov 2025
Updated 15 Nov 2025
9 min read
The world of email authentication is constantly evolving, and one topic that has generated considerable buzz is DMARCbis, the anticipated successor to the original DMARC standard. Many in the industry have been eagerly awaiting its finalization, wondering when it will officially become a new standard. It's a complex process, involving numerous stakeholders and technical considerations, and the journey from a draft to a widely adopted standard is rarely straightforward.
Recently, there's been some movement. DMARCbis and a new, separate document focused on DMARC Aggregate Reporting have cleared a significant procedural hurdle within the Internet Engineering Task Force (IETF). These documents are now moving towards the RFC Editor Queue, marking a step closer to eventually being published as Proposed Standards. While this is certainly progress, it doesn't mean the new standard is finalized or immediately applicable.
Understanding the nuances of this process is crucial for anyone involved in email deliverability or security. We'll explore where DMARCbis currently stands, what factors contribute to its timeline, and what this means for your current and future email authentication strategies. The goal is to provide clarity on this important update and help you prepare for the changes ahead.
Understanding DMARCbis and its status
DMARCbis, often referred to as DMARC 2.0, represents the next iteration of the DMARC standard. Its primary aim is to enhance the existing protocol by addressing various challenges and incorporating new capabilities that have emerged since DMARC 1.0 was first introduced. This includes clarifications, improved reporting mechanisms, and potentially new tags to offer greater control and visibility over email streams. The progression through the IETF is a formal process designed to ensure that new internet standards are robust, interoperable, and well-vetted by the community.
While it has moved closer to becoming a Proposed Standard, it is not yet a finalized standard. The IETF process involves multiple stages, from working group drafts to RFC (Request for Comments) publication. A Proposed Standard is a significant step, indicating that the specification is stable enough for implementation and testing, but it can still undergo revisions before reaching the Internet Standard track. According to dmarcwise.io, DMARCbis is expected to be published as a Proposed Standard sometime in 2025.
For email senders, this means that while DMARCbis is on the horizon, DMARC 1.0 remains the current operative standard. It is essential to maintain robust DMARC implementation and continue to monitor your email authentication diligently. Tools like Suped provide detailed DMARC reporting and monitoring to help you ensure compliance and optimal deliverability, regardless of the DMARC version.
Understanding DMARC tags is vital. The v tag (version tag) in your DMARC record currently specifies DMARC1. DMARCbis will likely introduce a new value for this tag. Until then, ensure your existing DMARC record is correctly configured for the current standard.
Why the delay in standardization?
The path to standardization for DMARCbis has seen some unexpected detours. Initially, the working group had made good progress on DMARCbis and the separate Aggregate Reporting document. However, a critical issue arose: both documents referenced an as-yet-unfinished Failure Reporting document. Standardized documents cannot reference unfinished specifications, creating a procedural roadblock.
This dependency meant that the working group had to reform to focus on completing the Failure Reporting document first. This effort is now time-boxed and is scheduled to be completed before the end of the year. This additional step adds several months to the overall timeline for DMARCbis to reach Proposed Standard status and then eventually become a finalized standard. It highlights the rigorous and often lengthy process involved in establishing internet standards, prioritizing stability and completeness over speed.
For domain owners, this delay means there's ample time to ensure your existing DMARC policy is robust. Focusing on a policy of quarantine or reject can significantly improve your email security. It’s also a good opportunity to review your current DMARC reports and identify any areas for improvement.
What DMARCbis means for email security
Even with the delays, the eventual publication of DMARCbis will mark a significant evolution in email security. The new standard is expected to supersede DMARC 1.0, though existing DMARC 1.0 implementations will continue to function indefinitely. This means that while DMARCbis will offer enhanced features and greater precision, the foundational security provided by DMARC 1.0 will remain valid and effective, as noted by ironscales.com.
The improvements in DMARCbis are likely to refine how email authentication failures are reported and handled, potentially leading to even more accurate threat detection and mitigation. This could include better granularity in reporting, helping organizations pinpoint the source of unauthorized email activity with greater ease. Such advancements are critical in the ongoing fight against phishing and spoofing attacks, which continue to evolve in sophistication.
For organizations leveraging DMARC for email authentication, DMARCbis will represent a valuable upgrade. It will reinforce the current best practices and introduce new mechanisms to further protect domains from abuse. Continuously monitoring and adapting to these standards is key to maintaining a strong email security posture and ensuring high email deliverability rates.
Preparing for the future of DMARC
While we await the finalization of DMARCbis, the best course of action is to fortify your current email authentication. This involves ensuring your DMARC, SPF, and DKIM records are correctly configured and regularly monitored. A proactive approach to email security not only protects your domain from malicious actors but also significantly improves your email deliverability rates.
Suped offers comprehensive DMARC monitoring and reporting capabilities that are designed to handle current and future standards. Our platform provides AI-powered recommendations to fix issues and strengthen your policy, real-time alerts for immediate threat detection, and a unified platform for managing DMARC, SPF, and DKIM, alongside blocklist and deliverability insights. Furthermore, our SPF Flattening feature helps overcome SPF DNS lookup limits, a common challenge for many organizations.
For Managed Service Providers (MSPs) and businesses managing multiple domains, Suped’s multi-tenancy dashboard makes it easy to oversee all your email security from a single interface. By staying informed about the progress of DMARCbis and utilizing advanced tools, you can ensure your email infrastructure remains secure and compliant, ready for any future changes in email authentication standards.
Current DMARC 1.0 implementation
Standard Status: Fully established and widely adopted, actively used by major mailbox providers.
Features: Provides policy control and aggregate reporting for domain protection.
Compliance: Current baseline for email security and anti-phishing efforts.
Lifespan: Will continue to function even after DMARCbis is standardized.
Upcoming DMARCbis (DMARC 2.0)
Standard Status: Currently moving towards Proposed Standard, not yet finalized.
Features: Expected to offer improved reporting, clarifications, and new capabilities.
Compliance: Will likely become the new baseline upon full standardization.
Lifespan: Will supersede DMARC 1.0 as the primary standard.
Views from the trenches
The journey of DMARCbis towards becoming a finalized standard is a clear indication that email authentication is a continually evolving field. While the specific timeline remains somewhat fluid due to the intricate IETF process, the direction is clear: enhanced standards are on their way. This proactive development ensures that email security measures can keep pace with new threats and improve overall deliverability for legitimate senders.
Best practices
Actively monitor DMARC reports to identify authentication issues and potential spoofing attempts.
Ensure SPF and DKIM records are correctly configured and aligned with your DMARC policy for optimal protection.
Gradually enforce stricter DMARC policies (p=quarantine, then p=reject) after thorough monitoring.
Leverage DMARC monitoring tools to simplify data analysis and receive actionable recommendations.
Common pitfalls
Leaving your DMARC policy at p=none for extended periods, missing out on enforcement benefits.
Not understanding the implications of aggregate and forensic reports, leading to unaddressed issues.
Failing to update SPF and DKIM records when changing email service providers, causing authentication failures.
Overlooking third-party senders that send email on your behalf, which can lead to DMARC non-compliance.
Expert tips
Regularly review your DMARC data for anomalies or trends that might indicate a new threat vector.
Educate your team on DMARC policies and their importance to maintain consistent email practices.
Consider SPF flattening to manage complex SPF records and avoid the 10-lookup limit.
Automate DMARC reporting analysis to quickly spot and resolve authentication issues as they arise.
Expert view
Expert from Email Geeks says DMARCbis and Aggregate Reporting cleared a procedural hurdle at the IETF and are now heading to the RFC Editor Queue.
2025-01-16 - Email Geeks
Expert view
Expert from Email Geeks says DMARCbis is still months away from being published as a Proposed Standard.
2025-08-10 - Email Geeks
For your organization, this means continuing to implement and refine your existing DMARC strategy. Leveraging tools like Suped can make this process seamless, providing you with the insights and recommendations needed to maintain strong email authentication and prepare for the future of DMARC. Our platform’s generous free plan makes robust DMARC monitoring accessible to everyone, from small businesses to large enterprises and MSPs.
By proactively managing your email authentication, you not only comply with current best practices but also lay a solid foundation for adopting DMARCbis once it becomes a fully ratified standard. This ongoing commitment to email security is paramount for protecting your brand reputation and ensuring successful email delivery.
The path forward for DMARC
In conclusion, DMARCbis is not yet a finalized standard, but it is steadily progressing through the IETF's rigorous standardization process. The recent movement into the RFC Editor Queue for DMARCbis and the Aggregate Reporting document is a positive sign, even with the temporary delay caused by the dependency on the Failure Reporting document. While we expect it to reach Proposed Standard status in the coming months, there's still a journey before it becomes a fully ratified internet standard.
This ongoing development underscores the importance of staying current with email authentication best practices. Maintaining a robust DMARC 1.0 policy, coupled with SPF and DKIM, remains essential for protecting your domain from spoofing and phishing attacks. By proactively monitoring your email ecosystem, you can ensure your deliverability remains high and your brand stays secure, regardless of the evolving standards.
Choosing a reliable DMARC monitoring solution is critical for navigating these changes. Suped provides unparalleled visibility into your email authentication, offering actionable insights and automated alerts that help you maintain compliance and optimize your deliverability. Stay prepared, stay protected, and ensure your emails reach their intended recipients every time.
