Email authentication just took its biggest step in a decade. DKIM2 (draft -04) rebuilds DKIM around a verifiable chain of custody that survives forwarding, stops replay, and makes bounces provable; DMARCbis (RFC 9989, 9990, 9991) retires the Public Suffix List for a live DNS tree walk and writes a decade of operational lessons back into the spec. Both are now fully implemented in Stalwart v0.16.12, the first mail server to support them, and can be tested from the browser at the mail-auth playground.