Who maintains DMARC, and how does the standard get updated?

DMARC did not come from Google, or Microsoft, or any single company. So who decides what it does, and who is behind the DMARCbis update?

DMARC is an open internet standard. It is stewarded at the IETF, the Internet Engineering Task Force, the same volunteer-driven body that standardises most of the plumbing the internet runs on. The work happens in a working group. People from mailbox providers, big senders, deliverability vendors, and independent researchers hash it out in public.

The way a change happens is deliberately slow. Someone writes up a proposed revision. The working group argues over it, in the open, sometimes for years. It goes through rounds of review and real-world feedback. Eventually it is published as an updated specification. That revision picks up the nickname "bis" along the way (that is the DMARCbis you keep hearing about).

Why should you care that it works this way? A few reasons:

• It is vendor-neutral. No one company owns DMARC or can quietly change it to suit themselves. Changes happen by rough consensus across the whole community.
• It is stable. Because updates are careful and public, you are not going to wake up to a surprise breaking change pushed overnight.
• When it lands, everyone adopts it. A published standard is something every compliant mailbox provider moves toward, not a feature bolted onto one inbox.
• You can read it yourself. The specs are public. Nothing is hidden behind a vendor paywall.

One honest note. Because the revision is still being finalised, be careful with anyone who quotes you a hard "it was published on this date as document number X." The DMARCbis work is still settling. When it is truly done, that is when the exact citation is worth pinning down.

If you want to know what the update means for your specific setup rather than the standard in the abstract, that is exactly the kind of thing our SOS team is happy to walk through with you, free.