DKIM2 is the proposed successor to DKIM, and it is far enough along to plan for: the IETF working group draft draft-ietf-dkim-dkim2-spec reached its fourth revision in July 2026 and is on the Standards Track. Its central change is that every hop adds its own signature, so a forwarded message carries a chain of custody rather than a single signature that breaks the moment something touches the message.
That matters because the two hardest problems in email authentication today, forwarding and replay, are both artefacts of DKIM signing once and hoping the signature survives. Alongside it, DMARCbis is working through the same process. This article sets out where both stand and what a sender should do in the meantime.
It draws on The Actual State of Email Deliverability, a webinar hosted by Email Industries with Unspam, featuring Matthew Vernhout, Head of Services at Email Industries, and Lawrence Heslin, who leads accounts and sales operations there.
Press play to load this video from YouTube (Google). See our cookie policy.
What DKIM2 changes, and where it stands
DKIM2 replaces a single end-to-end signature with one signature per hop. Each system that handles the message adds its own DKIM2 signature, and the resulting chain lets a receiver see the route a message actually took. That is what makes it a successor to both RFC 6376, the current DKIM specification, and RFC 8617, the ARC standard built to patch forwarding after the fact.
The practical payoff is replay resistance. A message lifted from one mailbox and re-injected somewhere else carries a chain that does not match where it claims to have come from, which is a problem the current DKIM cannot express at all.
On timing, treat it as a planning horizon rather than a deadline. The specification was still an Internet-Draft as of August 2026, with the working group expecting roughly twelve to eighteen months to advance it toward approval. Nothing you deploy today is wasted: DKIM2 is designed to run alongside existing DKIM, not to switch it off.
DMARCbis and the drafts moving with it
DMARCbis is the revision of DMARC itself, and it travels with three related drafts that together decide what reporting looks like next: aggregate reporting, failure reporting, and a proposal to move ARC to historic status once DKIM2 supersedes it. Mechanisms that proved impractical in the field, forensic reporting chief among them, are the ones under review.
Providers are also testing subscription dashboards that let someone see everything they are signed up to and cancel it without opening a message. Vernhout's read on that during the webinar: an unsubscribe is a much better outcome than a complaint, so anything that makes leaving easier is worth doing.
The rules senders already have to meet
Deliverability used to be something you looked at once messages started bouncing. That stopped working in February 2024, when Gmail and Yahoo began enforcing a shared set of rules.
All messages must now be properly authenticated through SPF, DKIM, and DMARC. Bulk senders, defined loosely as those sending more than 5,000 messages per day but often evaluated case by case, must support one-click unsubscribe. Compliance here remains thin: in our benchmark testing, only 14 percent of senders pass the one-click List-Unsubscribe requirement, leaving the vast majority exposed if providers begin enforcing it strictly. Google also introduced the Feedback-ID header, which allows senders to trace complaints back to specific campaigns without violating user privacy. Yahoo relaunched its feedback loop program, requiring DKIM authentication as the basis for participation.
In April 2025, Google went further, clarifying that accounts failing to meet these standards may lose the ability to display their brand name in the “From” field. Instead, users would see only the raw email address, a change intended to help consumers identify suspicious or untrustworthy senders. The most visible expression of that trust, BIMI, remains almost entirely unclaimed: 8 percent of the domains we check publish a BIMI record, and only about 1 percent actually get a logo displayed. Authentication stopped being a back-office detail at that point and became something a recipient can see.
Adoption still lags the requirement. Across the domains we test in our benchmark data, 93 percent publish a valid SPF record and 90 percent sign mail with a working DKIM key, but only 49 percent publish a DMARC policy, which leaves 51 percent with none at all.
Every provider moved the same way
The influence of Gmail and Yahoo spread quickly. Apple set similar expectations around authentication and complaint thresholds. Microsoft tightened Outlook's filters, which caused visible delivery trouble for a lot of senders during the rollout. Orange cut its acceptable complaint rate from one percent to 0.3 percent.
AT&T, long an outlier in North America, moved its mail under Yahoo's filtering. Comcast started testing a DKIM-based feedback loop that returns structured header data rather than full complaint copies, so anything you built to parse FBL mail has to be rebuilt for it.
The useful part for senders is that the requirements stopped contradicting each other. One authentication setup now satisfies most of the list.
Why it stays hard
A message runs through authentication checks, reputation lookups, content filters and a foldering decision, and providers weigh thousands of signals on the way: sending IP, domain age, the links in the body, the pages behind those links. Any one of them can move the message to spam by itself.
Which is why a change that looks small on your side lands large on theirs. A new ESP. A volume spike. An SPF record that quietly went past ten lookups.
Seven things to get right
Each of these needs setting up once and watching afterwards:
- SPF: maintain a single record per domain, retire old vendor includes, and keep within the 10-lookup limit.
- DKIM: use stable selectors, rotate keys carefully, and monitor DNS for timeouts or caching errors.
- DMARC: enforce alignment with a clear policy, review aggregate reports regularly, and align From domain, DKIM d=, and SPF Mail-From.
- TLS: confirm that your ESP or MTA enforces encrypted delivery between networks.
- BIMI: publish a record once authentication is solid. Begin with a free self-asserted record, then plan for a VMC or CMC certificate if budget allows.
- Feedback-ID: ensure headers are present so Postmaster tools can group complaints by campaign or list.
- Postmaster dashboards: configure Gmail, Yahoo, and Microsoft portals and check them consistently.
How reputation gets judged
Providers score behaviour, not intent. Complaints, unsubscribes and spam-trap hits are the obvious inputs. Engagement is the quieter one: whether the same people keep opening and clicking, or whether most of the list ignores everything you send. Display names get weighed too, and an emoji or a generic sender name reads as evasion.
Watching all that means feedback loops, postmaster dashboards and your own numbers. Segment by engagement, roughly new, active, cooling and inactive, then set cadence per segment. Sunset the people who have not responded in months, after one last re-activation attempt. Mail to a dead segment costs you reputation on the live one.
List quality and consent
Bot signups and fake addresses put spam traps on your list, and a trap hit is expensive. Protect the form, validate addresses as they arrive, and record which kind of consent you hold and where the subscriber lives. Canada separates implied from express consent for commercial mail, and the rules vary enough by country that "we have an opt-in" is not a complete answer.
An unsubscribe rate sitting above one percent usually means the signup form promised something other than what you send, or that you send it more often than people expected.
What the message itself has to do
Mobile first, a clear hierarchy, one obvious action. Vernhout's rule of thumb is roughly 70 percent live text to 30 percent images, which keeps the message readable with images switched off and stops it looking like an image-only send.
Accessibility is a legal requirement now in both the US and the EU, so alt text and real contrast are not optional extras. Keep the message under 102 KB or Gmail clips it.
For the From name, use the brand. Most recipients do not know who your CEO is. They do recognise the company.
Opens stopped being a metric
Apple's Mail Privacy Protection, image caching at Gmail and Yahoo, and security scanners that fetch every link have all made opens and clicks unreliable as counts. They still work as a signal: a stable open rate that drops sharply is usually filtering rather than disinterest.
Measure what a bot cannot do. Purchases, downloads, bookings, registrations.
Why the filters got aggressive
Phishing, account takeover and deepfake fraud have cost businesses billions, so every message is scanned before a person sees it. Some of those scans imitate a reader closely enough to show up in your engagement numbers, which is part of why those numbers stopped meaning what they used to.
Catching it early
The signs that show up before a real problem does:
- Rising bounce rates, especially soft bounces
- Increasing complaints or unsubscribes
- Sharp declines in opens compared to a stable baseline
- Direct customer feedback that emails are not being received
When something does break, look at what changed. A new partner data source. A redesigned signup form with no bot protection. A migration to a new IP with no warmup. The change that lines up with the start of the trend is almost always the cause.
ESPs, IPs and warmup services
Your ESP matters less than most people assume. Domain reputation now outweighs IP reputation, though the network still counts for something. A dedicated IP earns its keep above roughly 20,000 messages a day because it isolates you; below that, a reputable shared pool usually beats a cold dedicated address.
On the warmup services that simulate engagement, Vernhout and Heslin were blunt: they achieve little and they breach most ESP terms of service. A real warmup means ramping volume to people who actually want the mail.
What to do now
None of this is new advice. Authenticate, align, keep the list clean, send mail people asked for. What changed is that the providers enforce it now, and they enforce it consistently enough that one setup satisfies most of them.
