DMARC 2.0, officially known as DMARCbis (pronounced "dee-mark-biss"), is the next generation of the Domain-based Message Authentication, Reporting, and Conformance protocol.
This enhanced email authentication standard builds upon the foundation of DMARC 1.0 while addressing critical limitations discovered through a decade of real-world deployment. DMARCbis keeps v=DMARC1, replaces Public Suffix List lookups with a DNS Tree Walk algorithm, and updates tags (adds psd, np, t; retires pct, rf, ri).
The Internet Engineering Task Force (IETF) developed DMARC 2.0 to solve persistent challenges organizations face with domain spoofing, phishing attacks, and complex email authentication scenarios. While maintaining full backward compatibility with existing DMARC implementations, DMARCbis provides more granular control over email authentication policies and eliminates dependencies on external resources like the Public Suffix List. The specification is approved by the IESG and awaiting publication pending the failure-reporting companion draft.
DMARC 1.0, published as RFC 7489 in 2015, revolutionized email authentication by combining SPF and DKIM with policy enforcement and reporting mechanisms. However, after years of deployment across millions of domains, several limitations became apparent:
pct tag created ambiguity about which messages received policy enforcementDMARC 2.0 addresses these challenges through architectural improvements and clarified specifications, elevating the protocol from Informational to Proposed Standard status within the IETF framework. When published, it will obsolete RFC 7489 and RFC 9091.
DMARCbis operates through the same fundamental authentication process as DMARC 1.0 but with enhanced mechanisms for policy discovery and enforcement:
When an email arrives, the receiving server performs a hierarchical DNS query starting from the exact sending domain and walking up the tree:
DMARCbis evaluates messages using improved policy tags:
p (domain) and sp (subdomain) remain unchangednp tag: Defines specific policies for non-existent subdomainst tag: Binary testing signalpsd tag: Marks domain boundaries for the Tree Walk algorithmThe protocol maintains SPF and DKIM alignment requirements while adding:
DMARCbis streamlines reporting with:
ri and rf from policy recordsThe DNS Tree Walk represents DMARCbis's most transformative improvement, replacing the Public Suffix List with a dynamic, DNS-based discovery mechanism. This algorithm:
The new np (non-existent subdomain) tag specifically addresses CEO fraud and subdomain spoofing attacks. It applies only to non-existent subdomains:
np=reject: Blocks all emails from non-existent subdomainsnp=quarantine: Sends suspicious subdomain emails to spamnp=none: Monitors but doesn't block (useful during initial deployment)This feature prevents attackers from exploiting fake subdomains that return NXDOMAIN responses, a common vector for targeted spear-phishing campaigns.
The new t tag provides a binary testing signal, while pct is marked historic:
The psd tag lets Public Suffix Operators and domain owners mark boundaries:
psd=y: Marks Public Suffix Domains (like .com or .co.uk)psd=n: Indicates organizational boundariesThe DNS Tree Walk algorithm fundamentally changes how DMARC records are discovered, providing a more flexible and accurate method for determining organizational boundaries:
psd tagsFor an email from alert.security.mail.example.com:
1. _dmarc.alert.security.mail.example.com (not found) 2. _dmarc.security.mail.example.com (not found) 3. _dmarc.mail.example.com (not found) 4. _dmarc.example.com (DMARC record found with psd=n)
2020: IETF DMARC Working Group begins DMARCbis development
2022: Initial drafts circulated for community feedback
2024: Specification reaches "Last Call" status for final review
Early 2025: IESG approves main specification and aggregate reporting
Mid-2025: New working group chartered to resolve failure reporting issues
November 2025: Target deadline for failure reporting resolution
DMARCbis and the aggregate-reporting draft were approved by the IESG in 2025. Final RFC publication awaits resolution of the failure-reporting document. The specifications ready for publication are:
The reconvened DMARC Working Group must either complete the failure reporting specification or remove references to it by November 2025.
This extended timeline is typical for IETF standards:
DMARCbis ensures zero disruption to existing email authentication:
Organizations can approach DMARC 2.0 adoption through several paths:
pct, rf, ri)np, psd) for enhanced protectiont=y before full deploymentWhile DMARCbis simplifies some aspects, organizations must understand:
The dual-standard environment creates considerations:
Successful implementation demands:
Companies with complex domain structures face unique challenges:
Marketing and transactional email services require:
For forwarding/mailing lists, see ARC (RFC 8617), which preserves authentication assessments across intermediaries and complements DMARC/DMARCbis.
Q: What is DMARC 2.0 and how is it different from DMARCbis?
A: DMARC 2.0 and DMARCbis are the same thing. DMARCbis (pronounced "dee-mark-biss") is the official IETF designation, where "bis" is Latin for "twice" or "encore," indicating a second version. The industry often uses "DMARC 2.0" for clarity, though the protocol retains v=DMARC1 in DNS records for backward compatibility.
Q: When will DMARC 2.0 be officially released?
A: DMARCbis and the aggregate-reporting draft were approved by the IESG in 2025. Final RFC publication awaits resolution of the failure-reporting document, which is actively being revised.
Q: Will DMARC 2.0 replace DMARC 1.0?
A: DMARC 2.0 is expected to supersede DMARC 1.0 as the standard once published, but existing DMARC 1.0 implementations will continue functioning indefinitely. There's no forced migration or sunset date for DMARC 1.0 records. Organizations can adopt DMARC 2.0 features at their own pace.
Q: How does the DNS Tree Walk algorithm work?
A: The DNS Tree Walk queries DNS hierarchically, starting at the sending domain and moving up one label at a time. For example, with mail.example.com, it checks _dmarc.mail.example.com first, then _dmarc.example.com. It stops when finding a DMARC record or after 8 queries, preventing DNS amplification attacks.
Q: What happens to my existing v=DMARC1 records?
A: Nothing—they continue working exactly as before. DMARCbis maintains the v=DMARC1 identifier for backward compatibility. You don't need to change existing records unless you want to adopt new features like the np tag for subdomain protection or the t testing tag.
Q: What are the main new tags in DMARC 2.0?
A: Three primary new tags enhance policy control:
np: Sets policy for non-existent subdomains (syntax matches p)psd: Lets Public Suffix Operators and domain owners mark boundaries (psd=y or psd=n)t: Binary testing signal; complements removal of pctQ: Which tags are deprecated in DMARCbis?
A: Three tags are removed/marked historic based on operational experience:
pct: Percentage-based gradual rollout (marked historic)rf: Report format (removed)ri: Report interval (removed)Q: Do I need to migrate to DMARC 2.0 immediately?
A: No, there's no immediate migration requirement. Your existing DMARC policies will continue working indefinitely. Migration is voluntary and should be based on your organization's specific security needs and readiness to adopt enhanced features.
Q: How do I prepare for DMARC 2.0?
A: Start with these preparatory steps:
Q: Will email providers support both DMARC versions?
A: Yes, providers typically adopt new standards gradually while maintaining backward compatibility. The transition period is expected to last several years.
Q: What if my email service provider doesn't support DMARC 2.0?
A: Your emails will continue to authenticate using standard DMARC 1.0 policies. As DMARCbis maintains backward compatibility, there's no risk of authentication failure. However, you won't benefit from new security features until your provider adds support.
Q: How does DMARC 2.0 improve security?
A: Key security improvements include:
Q: Will DMARC 2.0 affect my email deliverability?
A: If you maintain existing v=DMARC1 records, there's no impact on deliverability. When implementing new features, use the t=y testing tag to verify proper configuration before enforcement. Gradual adoption ensures no disruption to legitimate email flows.
Q: How does DMARC 2.0 prevent CEO fraud?
A: The np (non-existent subdomain) tag specifically addresses CEO fraud by blocking emails from fake subdomains. For example, if ceo.example.com doesn't exist, np=reject prevents attackers from spoofing emails from this subdomain, a common tactic in targeted attacks.
Q: What's the business case for adopting DMARC 2.0?
A: DMARC 2.0 provides:
Q: How does IRONSCALES support DMARC 2.0?
A: IRONSCALES provides comprehensive DMARC 2.0 support with automated migration tools, expert guidance, and multi-domain management capabilities. Our platform is built on industry-leading technology that's specifically prepared for the DMARCbis transition.
Q: Can IRONSCALES automatically migrate my records to DMARC 2.0?
A: Yes, IRONSCALES offers migration assistance tools that can:
Q: What if I'm using IRONSCALES but haven't implemented DMARC yet?
A: IRONSCALES makes it easy to implement DMARC correctly from the start. You can begin with current best practices and naturally adopt DMARC 2.0 features as they become widely supported, all through a single platform.
Q: How does DMARC 2.0 work with IRONSCALES' email security?
A: DMARC 2.0 provides the foundation for domain authentication, preventing unauthorized use of your domain. IRONSCALES' DMARC management tools ensure proper implementation and monitoring while making the transition to enhanced DMARC 2.0 features seamless when you're ready.
Q: Are there compliance implications for DMARC 2.0?
A: While DMARC 2.0 isn't explicitly required by regulations, enhanced email authentication supports compliance with:
Q: Which industries should prioritize DMARC 2.0 adoption?
A: High-value targets should consider early adoption:
Q: What are other email authentication standards doing?
A: The email authentication ecosystem continues evolving:
All these standards complement DMARC 2.0 for comprehensive protection.
Ready to implement or upgrade your DMARC authentication? Learn more about DMARC fundamentals or explore how SPF and DKIM work together with DMARC to create a comprehensive email authentication strategy. For hands-on guidance with DMARC 2.0 preparation, contact our team to discuss your organization's specific requirements.