DKIM2 Sender Policy draft proposes how DMARC should handle modified, forwarded mail

Wei Chuang of Google submitted a new Internet-Draft, DKIM2 Sender Policy (draft-chuang-dkim2-sender-policy), on September 10, 2026, and published revision -01 two days later, on September 12. It is an individual submission, not a working-group document. It tackles a question DKIM2 has to answer before anyone deploys it: how DMARC should behave once mail can be legitimately modified on its way through several relays.

The draft arrives during a busy stretch for the DKIM working group. The core DKIM2 specification reached revision -06 on August 28, and the DKIM2 Best Practices draft by Todd Herr of GreenArrow Email was substantially restructured in revision -01 on September 9. That document covers interoperability with SPF, DKIM, DMARC and ARC. We covered the specification's earlier progress in our DKIM2 spec -04 report.

What the draft proposes

Per its abstract, the document updates DMARC (RFC 9989) for DKIM2, which supports forwarding with message modifications across multiple mail transfer agents. It proposes policy at two levels.

At the domain level, an optional auth= tag in the DMARC DNS record would list the authentication methods a domain supports: dkim, dkim2 and spf. The draft presents this as a defense against downgrade attacks, in which a malicious relay modifies a message and strips its DKIM2 or DKIM signatures. Once a domain declares it signs with DKIM2, a message arriving without that signature stands out.

At the message level, signers set flags inside the DKIM2 signature. donotmodify asks that the message not be altered. donotexplode asks that it not be sent on to more than one recipient. unaligned reports that the From header is not aligned. feedback and feedhere request reporting on how the message was handled. Receivers can then check whether intermediaries respected those requests.

Why it matters

Forwarding and mailing lists breaking DMARC is one of email authentication's longest-running problems, and ARC was built as a patch for it. DKIM2 replaces the patch with a signed chain of custody, and this draft sketches the policy layer that tells receivers what to enforce. A flag like donotmodify would give transactional senders a standard way to say a message should arrive exactly as sent.

Nothing here is ready to deploy. An individual -01 draft may change substantially or be folded into working-group documents. The groundwork still pays off regardless: senders whose DMARC is at enforcement, with aggregate reports flowing, will adapt fastest. Our DMARC checker shows where your policy stands today.