What is the IETF?
Still have a question, spotted an error, or have a better explanation or a source we should cite?
The Internet Engineering Task Force (IETF) is the organization that writes and publishes the technical standards that make email work. SPF, DKIM, DMARC, SMTP, MIME. They all exist because IETF working groups drafted and agreed on the rules. Those published standards are called RFCs (Requests for Comments).
But here's the part that actually matters for senders: publishing an RFC and getting mailbox providers to implement it are two completely different things. The IETF has no enforcement power. It can write the best standard in the world, and Gmail, Outlook, and Yahoo Mail still decide when, or whether, to support it.
DMARC is a good example. The IETF published it as a proposed standard in 2015. By 2023, the major mailbox providers had made it a hard requirement for bulk senders. That's nearly a decade from publication to enforcement. BIMI has been in draft form for years and adoption is still uneven. Some standards move fast. Others sit in limbo for a long time.
RFCs also go through maturity levels before reaching full internet standard status. The stages run from experimental through proposed standard and up to internet standard. Most email senders only ever need to care about proposed standards and above. Experimental RFCs are research territory. Don't base your authentication setup on one.
So which IETF standards actually matter for your sending reputation right now? SPF, DKIM, and DMARC are non-negotiable. BIMI is worth setting up if you want brand logos in the inbox, but it requires DMARC enforcement first. The rest are either infrastructure-level (things your ESP handles) or emerging work you don't need to act on yet.
The practical takeaway is this: watch what the major mailbox providers announce, not just what the IETF publishes. When Google, Microsoft, and Yahoo all move in the same direction, that's when a standard becomes a real-world requirement. The IETF sets the blueprint. The providers pour the concrete.
If you're not sure whether your current authentication setup meets the actual requirements, you can check your SPF and DMARC records with our free tools. Or reach out via our SOS hotline if something feels off.
Contributors
Who worked on this answer
Every name links to their profile. Every company links to their site. Real people, real accountability.
