DKIM2 draft -09 switches to pure ML-DSA-44 and adds a Domain Policy Record

Richard Clayton posted revision -09 of the DKIM2 core specification, "DKIM2 Signatures", to the IETF DKIM working group on November 1, 2026. It follows revision -08 on October 27 and -07 on October 18, which we covered in our report on draft -07. DKIM2 is the planned successor to DKIM. The document is still an Internet-Draft and can change again before it becomes an RFC.

What changed in -08 and -09

The draft's own change log lists these items:

• -08: switched to "pure" ML-DSA-44, made both signatures and hashes follow AND/OR rules, renamed a "Validly Signed DKIM2 Message" to a "Fully Verified DKIM2 Message", added an IANA section, changed the list of ignored header fields and clarified rules for validating delivery status notifications.
• -09: added a Domain Policy Record and an "up/down" matching algorithm for an authentic From, removed the key-length MUST from verifiers, allowed verifiers to treat algorithms and key lengths as insecure, limited each selector to one key record, and changed the result for a message with no DKIM2 header fields to NONE instead of PERMERROR.

Pure ML-DSA-44 replaces the hybrid algorithm

Draft -07 introduced a composite post-quantum algorithm, mldsa44-ed25519-sha512, which combined ML-DSA-44 with Ed25519. From -08 on, the post-quantum option is plain ML-DSA-44 from FIPS 204, with the tag mldsa44. The field values go straight into the signing function without pre-hashing, and the five octets "DKIM2" serve as the context string. The draft warns that an encoded signature is 3,228 characters long, so signers must fold the header. A valid public key is exactly 1,312 octets, or 1,752 base64 characters. The other two defined algorithms remain RSA-SHA256 and Ed25519-SHA256.

The Domain Policy Record

Many senders let an ESP sign on a delegated subdomain such as mail.example.com. Receivers already treat those DKIM signatures as covering the parent domain, and DKIM2 keeps that behaviour by matching the signing domain and the From domain in both directions. The new Domain Policy Record lets a parent domain opt out. It is a TXT record at _domainkey.example.com that starts with v=DKIM1. If its f= tag contains the flag strict, subdomain signatures can no longer make a From address at the parent domain authentic. With no record, subdomains stay authorized. A temporary DNS failure returns TEMPERROR, and more than one record returns PERMERROR. The policy is not inherited up or down the DNS tree.

What senders should do

This section is our analysis. Nothing has to change in DNS today, because receivers do not verify DKIM2 yet. One thing to plan for: if your ESP signs on a subdomain of your brand domain, publishing strict later would break that path. Start by listing your DKIM selectors and the domain each one signs for, and keep your current signatures in alignment with the From domain. Our DKIM checker shows what each selector publishes now.