What is DKIM?
DKIM is an email authentication standard that uses a cryptographic signature to verify that a message hasn’t been altered in transit.
When an email is sent, the sending server attaches a digital signature to the message header. The receiving server retrieves the sender’s public key from the DNS and uses it to verify the signature. If the signature is valid, the message is confirmed as unmodified.
DKIM works alongside SPF and DMARC to form a complete email authentication framework.
What is DKIM2?
DKIM2 is a proposed successor to the original DKIM standard (RFC 6376), currently being developed by the Internet Engineering Task Force (IETF). The original specification was published in 2011 and has been widely deployed ever since – but it has structural weaknesses that weren’t fully understood at the time of publication.
DKIM2 tackles those weaknesses directly. It addresses replay attacks and backscatter, while making email signing more flexible, consistent, and efficient.
Most of the implementation effort falls on the services that send email, such as Sendgrid, Amazon SES, Mailchimp, and Microsoft.
For domain owners, existing DKIM keys will continue to work. Backward compatibility is a deliberate design choice, and one that makes adoption achievable from day one.
For DMARC services like Sendmarc, stronger and more reliable DKIM signing means better signals – improving the accuracy of reporting and enforcement.
What is Changing in DKIM2?
DKIM2 introduces several structural and cryptographic improvements. Below are the most significant changes security professionals and domain owners should understand.
Standardized Header Signing
DKIM2 standardizes which headers must be signed, ensuring all critical headers are consistently covered. This reduces confusion and closes gaps that partial signing leaves open.
Replay Attack Mitigation
DKIM2 aims to address replay attacks by binding messages to their intended recipients and recording when each message was sent. Together, these additions allow receiving systems to detect and reject signed messages being replayed to recipients.
Backscatter Prevention
DKIM2 addresses backscatter by sending the DSN back to the server that last handled the message. This will help ensure that messages are sent to the correct address. This also makes delayed rejection safer, giving receiving systems more time to analyze messages before accepting or rejecting them.
Improved Error Handling
DKIM2 improves how bounces and errors are handled by enabling mailing lists and security gateways to record the changes they make – and reverse them. This simplifies verification at the receiving end and makes it easier to spot tampering attempts.
Cryptographic Flexibility
DKIM2 supports multiple cryptographic algorithms – including RSA, elliptic curve, and potentially post-quantum – making it easier to move away from outdated algorithms without disrupting email delivery. It also allows more than one signature to be included in a single DKIM2 header, so if one algorithm fails, the other can still pass verification.
Reduced Verification Overhead
DKIM2 is expected to reduce the number of cryptographic computations. When a message hasn’t been altered by any intermediary, only the first DKIM2 signature would need to be verified, making the process faster.
DKIM2 Status and IETF Timeline
Standards like DKIM2 typically begin as discussions at MAAWG (Messaging, Malware and Mobile Anti-Abuse Working Group), where email operators collaborate on emerging challenges before proposals move to the IETF and ultimately become published RFCs.
The working group is made up of engineers and operators from large email providers and intermediaries – organizations vested in resolving the weaknesses that DKIM2 addresses, which gives the proposal strong practical momentum.
DKIM2 has been adopted by the IETF’s DKIM working group and is under development. It still needs to be submitted, edited, and reviewed before it can be published as a standard.
The industry has a DKIM2 timeline. From Q4 2026, providers, including Google and Yahoo, will begin experimental verification. The findings will likely be visible through DMARC aggregate reports and Authentication-Results headers. Production rollouts are set for Q1 2027. Domain owners don’t need to take any action today – existing DKIM implementations remain valid.
Sendmarc is monitoring the DKIM2 proposal as it progresses. When the protocol is finalized, we plan to align our platform with the updated specification so domain owners can adopt the new standard without complexity.
What DKIM2 Means for Your Business
DKIM2 addresses longstanding weaknesses in how emails are signed and delivered. The changes address real operational and security challenges.
DKIM2 offers:
- Stronger protection against domain impersonation: Binding messages to their intended recipients reduces the risk of attackers replaying valid signatures to bypass authentication controls.
- Backward compatibility: DKIM2 is designed for backward compatibility – existing DKIM keys continue to work alongside the updated standard.
- Accurate bounce routing: Bounce notifications travel back through the server that last handled the message, so delivery failures never land in the wrong inbox.
- Consistent header coverage: Standardized header signing closes the gaps that partial signing leaves open, reducing the risk of message manipulation.
- Future-proof signing infrastructure: Support for multiple algorithms means that if one becomes outdated, the other continues to pass verification.
Managing DKIM configuration across multiple domains and sending platforms is operationally complex. A purpose-built platform ensures your signing infrastructure stays accurate and current as standards evolve – without increasing the burden on stretched security and IT teams.
Prepare your email environment for what’s next
DKIM2 is still in development, but the security gaps it addresses are real and present today. Sendmarc provides unified visibility into your DKIM, SPF, and DMARC configurations – so you’re protected now and ready for what’s next.