DKIM2 advances at the IETF: spec draft -04 published, best-practices draft adopted

The IETF's DKIM working group published revision -04 of the DKIM2 specification (draft-ietf-dkim-dkim2-spec) on July 5, 2026. The draft is authored by Richard Clayton (Yahoo), Wei Chuang (Google) and Bron Gondwana (Fastmail) — a notable cross-section of the mailbox-provider and mail-hosting world. It follows the working group's adoption in June of a companion document, DKIM2 Best Practices (draft-ietf-dkim-dkim2-bcp-00, dated June 18, 2026, authored by Todd Herr of GreenArrow Email), which describes recommended usage for senders, forwarders and receivers.

What DKIM2 changes

DKIM2 is the working group's effort to succeed DKIM with a design that addresses the weaknesses two decades of deployment have exposed. Per the specification's abstract, DKIM2 lets each system that handles a message cryptographically document what it did: intermediaries that modify a message — mailing lists, forwarders, security gateways — record their changes in a signed, auditable chain rather than silently breaking the original signature. That design targets two long-standing pain points: replay attacks, where a single signed spam message is re-broadcast at scale on the strength of the original signature, and forwarding breakage, the same class of problem ARC was created to patch.

Why senders should care now

Nothing changes for production mail yet — these are Internet-Drafts, not standards, and the specification explicitly remains a work in progress. But the direction matters. DKIM signatures are one of the pillars of DMARC, and DMARC alignment is now a hard requirement at Gmail, Yahoo and Microsoft for bulk senders. A successor protocol co-authored by engineers at two of those three providers is worth tracking, because it signals where authentication requirements go after the current baseline becomes universal. The best-practices draft is also an early indication that the working group wants deployment guidance ready alongside the protocol, rather than years after it.

For the current state of your own signing setup, our DKIM checker validates published keys, and the DMARC checker shows whether your policy actually aligns.