DKIM2 Explained: What It Changes and Where the Standard Stands
by
Last Updated: 6 min read
Key Takeaways
- DKIM2 is a proposed successor standard designed to fix structural flaws in how email authentication handles forwarded messages and replay abuse.
- It introduces a chained, per-hop signature model to track exactly who handled an email and what they changed.
- The protocol is currently an active draft within the IETF DKIM working group.
- Domain owners should focus on optimizing their current SPF, DKIM, DMARC, and ARC deployments, as DKIM2 is not yet supported by major mailbox providers.
DKIM2 is an active IETF working group draft, not a deployed standard. As of August 2026, there are three working group documents and no RFC. Nothing is required of senders today.
What Is DKIM2?
DKIM2 is the proposed successor to DKIM (DKIM1) currently being developed in the IETF DKIM working group. It is designed to survive email forwarding, prevent replay abuse, and standardize feedback mechanisms across the email ecosystem.
Unlike the original DKIM specification (RFC 6376), which signs a message only once at the origin, DKIM2 is built around a per-hop chained-signature model. Every server that handles the message adds its own cryptographic signature, creating a verifiable record of the path the email took and any modifications made along the way. This chain of custody makes it structurally harder for bad actors to exploit authentication loopholes.
DKIM2 Standardization Status: The IETF Drafts
DKIM2 is not an RFC, nor is it currently deployed by mailbox providers. It is progressing through the Internet Engineering Task Force (IETF) as a series of working group documents. This means the core architecture is taking shape, but the drafts can still change materially, be replaced, or expire.
As of August 2026, the active IETF working group drafts are:
| Draft | What it covers | Version | Latest revision |
|---|---|---|---|
| draft-ietf-dkim-dkim2-spec | Core specification | 04 | 5 July 2026 |
| draft-ietf-dkim-dkim2-bcp | Best practices for senders, intermediaries, receivers | 00 | 18 June 2026 |
| draft-ietf-dkim-dkim2-dns | DNS record format and lookup | 00 | 20 July 2026 |
These documents are authored by engineers from Yahoo, Google, Fastmail, and GreenArrow Email. This level of involvement from major inbox providers and infrastructure vendors is the strongest indicator that the protocol is being built to solve real operational problems at scale.
Why DKIM Needs Replacing
Intermediary Modification Issue
When an email passes through an intermediary, such as a mailing list or a forwarding service, the message content or headers are often altered. Even a legitimate change like appending a footer or modifying the subject line breaks the cryptographic hash created by the original sender. The receiving server sees a modified message, fails the DKIM check, and the email risks being marked as spam.
Reputation Damage via Replay Attacks
A DKIM replay attack occurs when a bad actor captures an email legitimately signed by a reputable domain and resends it to millions of new recipients. Because the original sender’s DKIM signature is valid and the content hasn’t changed, the receiving server authenticates the message. The spammer essentially hijacks the sender’s good reputation to bypass spam filters, causing severe reputation damage to the original domain owner.
DKIM Replay Attacks – How They Work
To execute a replay attack, a spammer first signs up for an account with a service that sends transactional email on behalf of a reputable domain (for example, a welcome email or a password reset link). When the spammer triggers that legitimate email to their own inbox, they receive a message perfectly signed by the service’s DKIM key.
The spammer then extracts the raw email, including its valid DKIM-Signature header, and uses their own infrastructure to blast that exact message to a massive list of purchased email addresses. The receiving mail servers check the signature, confirm it matches the reputable domain’s public key, and deliver the spam to the inbox. The original sender takes the blame and the reputation hit for the spam blast.
Lack of Standardized Feedback
DKIM1 provides a mechanism for verifying a signature, but it lacks a standardized way for receiving servers to communicate authentication failures or forensic details back to the sender. This makes it difficult for administrators to troubleshoot broken signatures or identify the source of modification.
Backscatter Problem
Backscatter occurs when a receiving server rejects a spoofed email and sends a bounce notification (Non-Delivery Report) to the forged return address. Since the forged address belongs to an innocent domain owner, their inbox is flooded with bounce messages for emails they never sent.
What DKIM2 Changes
Standardized Header Signing
DKIM2 introduces a more rigorous and standardized approach to header signing. By mandating which headers must be included in the signature and how they are structured, it reduces the ambiguity that often causes validation failures.
Backscatter Prevention
By structurally binding the envelope sender and recipient information into the signature chain, DKIM2 provides receiving servers with cryptographic proof of the intended delivery path. This allows receivers to confidently drop spoofed messages without generating illegitimate bounce reports to innocent domains.
Simplified Error Handling
DKIM2 includes defined mechanisms for reporting errors and modifications. When a signature breaks, the chained structure allows the receiver to pinpoint exactly which hop in the delivery path altered the message, simplifying troubleshooting for administrators.
Addressing DKIM Replay Attacks
To combat replay attacks, DKIM2 requires every hop on the delivery path to add its own signature, and those signatures bind the message to its specific envelope recipients (mf= and rt= tags). If a spammer captures a signed message and attempts to replay it to new addresses, the recipient information will no longer match the cryptographic binding, and the receiving server will reject the replay attempt.
Algorithmic Dexterity
The standard updates the cryptographic foundations of email authentication. The current best practices draft (draft-ietf-dkim-dkim2-bcp) defines support for robust algorithms including SHA256, RSA-SHA256, and Ed25519-SHA256, ensuring the protocol remains secure against modern computational threats.
Minimizing Crypto-Calculations
While DKIM2 requires more signatures per message, the specification is designed to streamline the validation process. The chained structure allows verifiers to process signatures efficiently without overwhelming server resources.
DKIM2 vs DKIM vs ARC
Because DKIM2 addresses the problems caused by email forwarding, it directly overlaps with Authenticated Received Chain (ARC). ARC is the current industry patch for the forwarding problem, designed to preserve authentication results as a message moves through intermediaries.
| Protocol | What is solves | Surviving forwarding | Status |
|---|---|---|---|
| DKIM (DKIM1) | Proves a domain took responsibility for a message. | No (breaks if content changes). | Current standard. |
| ARC | Chains previous authentication results together so receivers can trust an intermediary. | Yes (by trusting the forwarder). | Current standard (though deprecation has been proposed). |
| DKIM2 | Creates a cryptographically verifiable chain of custody for every hop and modification. | Yes (by proving the path). | Active IETF Draft. |
The most common question regarding the new drafts is: Does DKIM2 replace ARC? The answer is yes. ARC relies on subjective trust between forwarding nodes; receiving servers must maintain lists of trusted forwarders for ARC to work. DKIM2 solves the problem cryptographically, eliminating the need to rely on subjective trust, which ultimately renders ARC obsolete once DKIM2 is widely adopted.
What Should Senders Do About DKIM2 Today?
You should not re-architect your production email infrastructure based on these drafts. DKIM2 is still in the active drafting phase; there is no published adoption timeline, and major mailbox providers are not yet enforcing it.
Instead, you should focus on perfecting your current email authentication posture. The organizations that build solid foundations now will enter the next era without disruption. Use a DKIM record checker to validate your current setup, and ensure your SPF, what is DKIM, what is DMARC, and ARC configurations are strict and accurate.
Track the progress of the working group, but plan to pilot DKIM2 only after real mailbox provider support exists. If you need to generate new keys for your current setup, use a DKIM record generator.
Get Your DKIM Right Before DKIM2 Arrives
Preparing for the future of email security starts with mastering the standards of today. By achieving full DMARC enforcement and ensuring your current DKIM signatures survive transit, you protect your domain’s reputation and guarantee high deliverability.
Frequently Asked Questions
What is DKIM2?
DKIM2 is the proposed successor to DKIM being developed in the IETF. It is designed to survive email forwarding, prevent replay abuse, and create a verifiable chain of custody by requiring every server handling an email to sign it.
Is DKIM2 available yet?
No. DKIM2 is currently an active working group draft within the IETF, not a deployed standard. It is not currently supported or enforced by major mailbox providers.
When will DKIM2 be released?
There is no published timeline for a final release. The specification must progress through the IETF drafting process to become an RFC before providers begin adopting it.
Will DKIM2 replace DKIM?
Yes, DKIM2 is intended to be a complete replacement for the current DKIM standard, structurally addressing its known vulnerabilities regarding forwarding and replay attacks.
Does DKIM2 replace ARC?
Yes. While ARC provides a way to trust intermediaries that forward mail, DKIM2 solves the forwarding problem cryptographically, eliminating the need for ARC once widely adopted.
Do I need to do anything about DKIM2 now?
No, senders do not need to change their infrastructure today. The best preparation is to ensure your current SPF, DKIM, and DMARC configurations are fully optimized and enforced.
Summary
DKIM2 represents a significant structural shift in email authentication, moving from a single origin signature to a verifiable, per-hop chain of custody. By addressing the fundamental weaknesses in how DKIM1 handles forwarding and replay attacks, it promises a much more resilient ecosystem. However, it remains an active IETF draft. For now, the most effective strategy for domain owners is to monitor its progress while rigorously enforcing current DMARC standards.
Domain & Email Security Expert at PowerDMARC
Yunes is an Operations Team Lead at PowerDMARC with expert knowledge in email authentication and security. Yunes is a Microsoft-certified Azure Administrator Associate with certifications in CompTIA A+ and many more.
Latest posts by Yunes Tarada (see all)
- PandaDoc DKIM, DMARC, and SPF Setup Guide - August 19, 2026
- Moloni DKIM, DMARC, and SPF Setup Guide - August 18, 2026
- FACTS DKIM, DMARC, and SPF Setup Guide - August 17, 2026
