Week ending October 23, 2026 — Sector Watch

The IETF DMARC working group revised its document retiring ARC on October 21, and the document’s stated core lesson is that signatures are not trust. ARC let each mail intermediary sign a record of what it saw, but a receiver could only act on that record by running a reputation system for every signer, and in ten years nobody built one that works across the Internet. Deployers used allow lists instead. The draft tells operators to stop Internet-wide ARC deployments and names DKIM2 as the successor. The DKIM2 mechanism draft is written by engineers at Yahoo, Google and Fastmail, and the DKIM working group now targets March 2027 for sending its documents to the IESG.

Standards in motion

Email authentication & anti-abuse

The DMARC working group’s case for retiring ARC is an adoption post-mortem. Reclassifying ARC as Historic, by authors at Proofpoint and Taughannock Networks, was revised October 21. It is the working group’s only remaining deliverable, with a milestone of November 30 to request approval of the status change. The draft declares the experiment over, tells operators to stop Internet-wide deployments and confine existing ones to controlled, intra-domain use, and asks that RFC 8617 be moved to Historic.

Its account of operational experience: ARC worked inside single administrative domains, where operators already trusted their own hops. Across the open Internet it required each receiver to decide whether to trust each signer in the chain, and early deployers built allow lists of intermediaries rather than dynamic reputation. Microsoft 365’s trusted ARC sealers setting is that model: an administrator names the intermediaries whose seals it will honor. The draft also notes that ARC shows which intermediary modified a message but not what it changed, and that no Internet-scale reputation system for ARC was built during the experiment or is planned.

ARC is an open standard with real deployments, withdrawn by the body that published it, for a stated reason: it depended on a trust layer outside its own scope that nobody supplied. Adoption read: deployed by large receivers in bilateral allow-list form; the draft asks those deployers to plan decommissioning.

DKIM2 has a date for leaving the working group. The DKIM working group set March 2027 as its milestone for submitting all documents to the IESG. The mechanism draft was revised October 18; its three authors work at Yahoo, Google and Fastmail. The DNS record specification, from the Google author, was revised twice this week. The charter commits DKIM2 to protecting against unauthorized use of the envelope sender, identifying changes any handler makes to a message, and recording the intended chain of handling. The ARC draft cites DKIM2’s replay protection, and ARC’s lack of any record of what was modified, as reasons to favor DKIM2. It says ARC’s handling assertions will inform DKIM2 without a separate trust fabric for intermediaries. Adoption read: spec-stage, multi-vendor, in a neutral body; none of the three authors’ employers has announced deployment.

Enterprise & web identity

FIDO will publish a wallet reference architecture and a framework for wallets to identify verifiers. Announced at Authenticate on October 20, the Credential Manager Reference Architecture sets functional, security and interoperability requirements for digital wallets. Profiles for national ID, payments, workforce and travel credentials are to be built on it, and it is the basis of FIDO’s Credential Manager Certification Program. The Verifier ID framework describes how a wallet receives structured, verified information about the service requesting a person’s data, so it can show the user who is asking before they approve. FIDO says both documents become public in the coming weeks. It also opened an External Advisory Forum for issuers, governments and regulators; participation is free and does not require membership.

Verifier identification protects the person presenting the credential: the wallet authenticates the requester before anything is disclosed. Other mechanisms already address it. OpenID4VP carries signed verifier attestations, and the EU wallet framework uses relying-party registration, which Germany’s wallet law, covered last week, provides for. FIDO’s announcement does not say whether the framework profiles those or defines its own. Adoption read: none yet; the documents are unpublished, and certification is the mechanism FIDO will use to get wallets to implement them.

Implementations & adoption

The European payments industry is writing the rules for accepting EU wallets at payment authentication. The European Payments Council announced SCARLET this week, a rulebook and liability framework for payment service providers that accept EU Digital Identity Wallets for strong customer authentication. The EPC Board approved it September 24. The EPC counts more than 3,000 payment service providers and over 27 expected wallet providers in the EU and EEA, and the rulebook covers technical interoperability, eligibility and the allocation of liability among them. It builds on the Commission’s Architecture and Reference Framework and is being developed with the Commission and the European Banking Authority. Version 1.0 targets PSD2; a later 1.1 targets the forthcoming Payment Services Regulation. Public consultation is scheduled for summer 2027 and publication for December 2027, followed by an implementation period before it takes effect.

mDL4EU starts October 31 with 24 member states. The consortium, funded under the Digital Europe Programme with a budget of nearly €10 million over two years, will deploy mobile driving licence issuance and verification built to ISO/IEC 18013-5 and -7, the EUDI Wallet implementing acts and the ARF, ahead of the EU’s 2028 date for driving licences in national wallets. It has nearly 60 participants and associated partners, including Procivis, Sopra Steria, Scytales, Namirial, youniqx and Bolt, with CLR Labs testing and Fime as an associated partner. Conformance and cross-border validation will run on a shared testbed connecting national environments and wallet implementations. It builds on the POTENTIAL and APTITUDE large-scale pilots. Adoption read: an ISO standard with an EU mandate behind it, now with funded issuance pilots across 24 states.

India switches on network caller-name display November 1. A Department of Telecommunications order dated October 13 directs all access providers to turn on Calling Name Presentation (CNAP) in every service area from November 1, on by default, for 4G and later wireless networks; 2G, 3G and landlines are excluded for now. The terminating operator queries the originating operator for the name in its subscriber records. A business or bulk connection may request a preferred name, which must be a registered trademark or GST-registered trade name verified against original documents. A licence amendment issued the same day adds the subscriber’s registered name to the definition of calling line identification.

The privacy terms are specific: subscribers using calling line identification restriction are not shown, the name may not be retained after the call ends, and operators must run a time-bound grievance process. The order describes an operator-to-operator lookup and names no protocol or signing requirement, so how the name is protected in transit between operators is not specified. Adoption read: mandated for every operator on one date.

iProov launched a service implementing HAPS, the human-approval specification it published in September and covered September 25. The service integrates with solo.io’s agentgateway and with Cerbos, whose authorization platform calls it when a policy requires cryptographically verifiable proof that a person approved a specific action; iProov’s liveness detection supplies the proof of presence. Adoption read: the first implementation is the spec author’s own, with two third-party products integrating as callers.

Amazon says more than 500 million customers have enabled passkeys, in an October 20 update to its 2023 passkey announcement. Amazon has not published what share of sign-ins use them, and passwords remain available.