Who maintains DMARC, and how does the standard get updated?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
DMARC did not come from Google, or Microsoft, or any single company. So who decides what it does, and who is behind the DMARCbis update?
DMARC is an open internet standard. It is stewarded at the IETF, the Internet Engineering Task Force, the same volunteer-driven body that standardises most of the plumbing the internet runs on. The work happens in a working group. People from mailbox providers, big senders, deliverability vendors, and independent researchers hash it out in public.
The way a change happens is deliberately slow. Someone writes up a proposed revision. The working group argues over it, in the open, sometimes for years. It goes through rounds of review and real-world feedback. Eventually it is published as an updated specification. That revision picks up the nickname "bis" along the way (that is the DMARCbis you keep hearing about).
Why should you care that it works this way? A few reasons:
- It is vendor-neutral. No one company owns DMARC or can quietly change it to suit themselves. Changes happen by rough consensus across the whole community.
- It is stable. Because updates are careful and public, you are not going to wake up to a surprise breaking change pushed overnight.
- When it lands, everyone adopts it. A published standard is something every compliant mailbox provider moves toward, not a feature bolted onto one inbox.
- You can read it yourself. The specs are public. Nothing is hidden behind a vendor paywall.
One citation worth pinning down. The DMARCbis work is finished. It was published in May 2026 as three documents on the IETF standards track: RFC 9989 for the core protocol, RFC 9990 for aggregate (rua) reporting, and RFC 9991 for failure (ruf) reporting. Together they obsolete the original 2015 spec, RFC 7489, and move DMARC up from an Informational document to a Proposed Standard. So if someone hands you a hard citation now, those are the ones.
If you want to know what the update means for your specific setup rather than the standard in the abstract, that is exactly the kind of thing our SOS team is happy to walk through with you, free.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
