DMARCbis

DMARCbis is the updated version of DMARC, the email authentication standard used to help receivers decide whether a message is legitimate, spoofed, or unaligned with the claimed domain. It combines SPF and DKIM alignment checks with policy reporting, giving organizations clearer control over inbound mail handling and domain impersonation risk.

What DMARCbis changes in email authentication

DMARCbis keeps the core DMARC idea intact, but the updated standard matters because receivers still need a reliable way to compare what a message claims to be with what SPF and DKIM can actually prove. That alignment decision is what lets mail systems separate legitimate domain traffic from spoofing attempts and policy drift.

For organisations, the practical change is less about replacing DMARC and more about clarifying how a receiver should interpret authentication outcomes, reporting, and policy enforcement. The standard is part of a broader domain-based trust chain, so misalignment or ambiguous policy handling can still affect deliverability and anti-impersonation controls.

How DMARCbis works with SPF and DKIM

DMARCbis does not stand alone. It depends on SPF to assess whether the sending path is authorised for the domain in the envelope, and on DKIM to verify that the message content and selected headers were signed by a key associated with the domain. DMARC then evaluates whether those results align with the visible From domain.

That alignment rule is important because a message can pass SPF or DKIM in isolation and still be misleading if the authenticated domain is not the same domain the recipient sees. DMARCbis keeps the receiver focused on the domain relationship that users and brand owners actually care about.

For a practical reference on the underlying alignment model, policy rollout, reporting, SPF lookup limits, and DKIM key rotation, see DMARC, SPF and DKIM Guide.

Why DMARCbis matters for domain impersonation risk

DMARCbis is primarily a trust-control standard for inbound email. It helps reduce the chance that a receiver will treat spoofed mail as if it came from a legitimate domain, which is why it is closely associated with anti-phishing, brand impersonation, and business email compromise defence.

Its value depends on consistent policy interpretation across receivers. If domains are not aligned correctly, or if organisations do not monitor authentication results and policy reports, attackers can still exploit lookalike domains, forwarding paths, or weakly protected sending infrastructure to bypass user trust.

External guidance on foundational control alignment can be useful here, especially when mail authentication is part of a broader security baseline. NIST’s security and privacy controls catalog includes controls that support access governance, auditability, and integrity monitoring, which are all relevant to reliable mail-authentication operations.

What organisations need to validate when adopting DMARCbis

The first check is inventory: organisations need to know which legitimate systems send mail on their behalf, including marketing platforms, ticketing systems, and other third-party services. If those senders are missed, enforcement can break legitimate mail or leave shadow senders ungoverned.

The second check is exposure: recipients outside the organisation will judge messages using published DNS records, so misconfiguration can create inconsistent delivery behaviour across different mail ecosystems. DMARCbis therefore rewards disciplined DNS ownership, change control, and reporting review rather than one-time configuration.

The third check is operational follow-through. Authentication failure data is only useful if someone reviews it, distinguishes legitimate exceptions from abuse, and updates the policy as the sending estate changes.

For broader control mapping and operational hardening, NIST Cybersecurity Framework 2.0 is a useful companion for governance and monitoring, while NIST SP 800-53 Rev 5 Security and Privacy Controls provides control language that supports audit, integrity, and configuration discipline.

How receivers should use DMARCbis reports and enforcement

DMARCbis is most effective when organisations treat reports as a feedback loop, not just a compliance artifact. Aggregate reports show how mail flows are being authenticated in practice, which senders are failing alignment, and where policy changes may still be needed before moving to stronger enforcement.

Enforcement should be progressive and evidence-led. A cautious rollout reduces the chance of disrupting legitimate mail while still moving toward stronger protection against spoofing. Once policy is stable, receivers can make more consistent accept, quarantine, or reject decisions based on aligned authentication results.

Where organisations operate at scale, mail-authentication posture should also sit inside a broader detection and response program. If authenticated mail patterns change unexpectedly after policy tightening, that may indicate a misconfigured sender, a compromised sending service, or an attempt to exploit a weaker exception path.