Summary
Email authentication has become a basic requirement for any business that relies on email to reach customers, activate users and generate revenue. But as email ecosystems grow more complex, traditional authentication mechanisms show their limits when it comes to establishing trust across the entire delivery chain.
DKIM2 is an emerging proposal designed to close some of these gaps. Building on the principles of traditional DKIM, it aims to make every step of an email’s journey verifiable, from the original sender to the recipient’s mailbox.
For deliverability teams, infrastructure providers and high-volume senders, understanding DKIM2 today is a way to prepare for what could become a major evolution in email security. In this article, we explain how DKIM2 works, what it aims to improve, and what senders should do right now.
1. What is DKIM2, and why does it matter?
To understand DKIM2, we first need to look at the technology it builds on: DKIM (DomainKeys Identified Mail).
DKIM lets a sender attach a cryptographic signature to a message. Receiving mail servers verify this signature against a public key published in the sender’s DNS. This proves that the message was signed by a given domain and that the signed parts have not been altered in a way that breaks verification.
DKIM is one of the three pillars of email authentication, alongside SPF (Sender Policy Framework) and DMARC (Domain-based Message Authentication, Reporting and Conformance).
However, traditional DKIM has limits. A message can pass DKIM without proving that it was intended for its current recipient, that its bounce path can be trusted, or that every intermediary handled it appropriately.
DKIM2 aims to extend verification beyond the original signature to cover the message’s whole journey. It is being developed within the IETF DKIM working group, with authors from Yahoo, Google and Fastmail, and remains an active Internet-Draft, not a finalized standard. Its specifications may still change.
New to some of these terms? Find DKIM2 and 80+ other definitions in our email deliverability glossary.
2. What are the limitations of traditional DKIM?
DKIM remains essential. Its limitations don’t make it ineffective: they simply highlight questions a conventional DKIM signature was never designed to answer. Three areas are particularly relevant.
A valid signature doesn’t prove the message was meant for its recipient
A DKIM signature links a domain to a signed message. On its own, it doesn’t establish that the message was intended for the person who ultimately receives it.
This creates a weakness: a legitimately signed email can be captured and replayed to thousands of other recipients, while its original authentication still passes. This is known as a replay attack.
For businesses, the lesson is clear: authenticating a sender is not the same as verifying the full context in which a message is delivered.
A valid signature doesn’t guarantee a trustworthy bounce path
When an email can’t be delivered, the sending infrastructure receives a delivery status notification (DSN), commonly called a bounce. Mail servers also have to handle abuse reports.
Traditional DKIM doesn’t guarantee that the return-path domain belongs to an entity that actually handled the message. This makes it harder to attribute delivery failures and abuse reports correctly, even though reliable feedback is key to diagnosing delivery problems, removing invalid addresses and keeping sending practices healthy.
Forwarding and message modifications can break authentication
Emails often pass through several systems before reaching the inbox: forwarding services, mailing lists, security gateways and other intermediaries.
Some of these systems legitimately modify messages by adding footers, rewriting headers or changing content. These changes can invalidate a traditional DKIM signature, even when nothing malicious has happened.
DKIM2 is designed to record the changes made along the delivery path, so that each subsequent system can verify the message’s history instead of relying only on a signature that may no longer validate.
3. How does DKIM2 work?
DKIM2 introduces a model in which each participating system contributes to a verifiable chain of message handling. It works in three steps.
The message is signed
The sending system creates a cryptographic signature tied to a snapshot of the message and to relevant transmission details, such as the sender and recipient of that delivery.
Each participating system documents its handling
As the message moves from one system to the next, each participating hop adds its own signature and records any changes it makes.
The recipient verifies the message history
The receiving system validates the chain of signatures and the recorded changes. This helps it distinguish legitimate processing from unexpected modifications.
The proposed design relies on two key mechanisms:
- Message-Instance headers: a cryptographic snapshot of the message at a given stage of its journey.
- Chained DKIM2 signatures: signatures that link each participating system to these snapshots, creating a tamper-evident record of the message’s journey.
DKIM2 also aims to bind messages to their intended destination and to make delivery notifications more accountable. These mechanisms are still part of an evolving specification: their real-world effectiveness will depend on implementation and adoption.
4. What could DKIM2 mean for email deliverability?
For deliverability professionals, DKIM2 is interesting not just because it is a new authentication mechanism, but because it addresses trust gaps between the systems that handle email.
Better visibility into the delivery chain
Today, deliverability investigations mean digging through authentication results, message headers, sending infrastructure and changes introduced by forwarding or intermediary systems. A verifiable record of message handling could make it much easier to understand which systems processed a message and what happened along the way. For organizations sending through multiple providers or complex infrastructures, this could be particularly useful.
Stronger protection against replay attacks
By binding a message to its intended destination and documenting its transmission, DKIM2 aims to make replay attacks easier to detect. This could help protect sender reputation from a form of abuse that today can damage a legitimate domain.
More reliable attribution of delivery failures
Bounces and abuse reports are valuable signals for email operations teams. A verifiable chain of responsibility could help participating systems determine where a message was handled and where notifications should go. This would improve accountability, though it won’t eliminate every bounce-processing or abuse-reporting problem.
More context when messages are modified
For legitimate senders, a DKIM signature broken by forwarding or message modification complicates troubleshooting. By preserving a verifiable history of those changes, DKIM2 could help receiving systems tell documented transformations apart from unexplained ones.
The key distinction: DKIM2 is designed to improve message integrity, accountability and authentication context. It is not a guarantee of inbox placement. Mailbox providers still filter based on many factors, including sender reputation, recipient engagement, complaint rates, message content and compliance with their requirements.
5. Should businesses prepare for DKIM2 now?
Yes, but by understanding the proposal and strengthening their current authentication setup, not by rushing to implement an unfinished standard.
As of October 2026, DKIM2 is still an active IETF Internet-Draft. The specification keeps evolving, and DKIM2 is expected to coexist with traditional DKIM for some time rather than replace it overnight. We saw a similar path with DMARCbis, the next version of DMARC.
For senders, the most useful actions today are practical ones:
Map your email infrastructure
List every service that sends on your behalf: CRM, marketing automation platform, transactional email provider, customer support tools.
Monitor your sender reputation and inbox placement
Track inbox placement, spam complaints, bounces, blacklist status and engagement trends. Authentication alone never guarantees inbox placement.
Understand your forwarding and mailing-list workflows
If your messages pass through systems that modify headers or content, check how those changes affect your DKIM and DMARC results.
Follow the standard’s progress
Keep an eye on the DKIM2 specification on the IETF Datatracker and test implementations in controlled environments as they mature.
For organizations with complex infrastructures or unexplained deliverability issues, an email deliverability audit establishes a clear baseline before new authentication mechanisms come into play.
6. DKIM vs. DKIM2: what’s the difference?
| Capability | Traditional DKIM | Proposed DKIM2 |
|---|---|---|
| Cryptographic message signature | Yes | Yes |
| Verifies signed message content | Yes, within signature coverage | Uses message snapshots and chained signatures |
| Records handling across multiple systems | Not as a complete chain | Designed to build a verifiable chain |
| Detects message replay | Not inherently | Designed to bind messages to their destination |
| Records changes made by intermediaries | No complete change history | Designed to record transformations |
| Current status | Established standard (RFC 6376) | Work in progress (IETF Internet-Draft) |
7. The MailSoar perspective: authentication is only one part of deliverability
Email authentication is essential, but it is only one component of a successful email program. A business can have perfectly configured SPF, DKIM and DMARC records and still land in spam because of a damaged sender reputation, low engagement, too many complaints or inconsistent sending practices.
That’s why deliverability has to be approached as both a technical and a strategic discipline. At MailSoar, every engagement starts by identifying the root causes: we examine authentication, sending infrastructure, domain and IP reputation, engagement signals and inbox placement to understand what is keeping your emails out of the inbox. Then we help your team implement the right fixes and monitor the results.
DKIM2 is worth following because it addresses real limitations in email authentication. But you don’t need to wait for a new standard to improve your email security and deliverability. The priority today is a reliable authentication foundation, a clear view of how your messages move through your infrastructure, and close monitoring of the signals that drive inbox placement.
Want to know what’s really affecting your deliverability? Talk to a MailSoar expert to assess your current setup and identify the actions that will make a measurable difference.
