Guide

DMARCbis: what changed in DMARC in 2026 (RFC 9989)

DMARC was revised in May 2026 as RFC 9989, 9990 and 9991. What is new, what was removed — pct, rf and ri — and what to change in your record.

In May 2026 the IETF published the revised DMARC standard, long known as DMARCbis. It moves DMARC from an informational RFC to the Standards Track and splits it into three documents:

  • RFC 9989 — the policy record and how receivers find and apply it. Obsoletes RFC 7489 and RFC 9091.
  • RFC 9990 — aggregate (rua) reporting.
  • RFC 9991 — failure (ruf) reporting.

Most existing records keep working. A few things in them now mean something different, or nothing at all.

Removed: pct, rf and ri

pct let a domain apply its policy to a percentage of failing mail. It is gone. A record with p=quarantine; pct=10 is now read by updated receivers as plain p=quarantine: the whole of your failing mail is quarantined, not a tenth of it. rf (report format) and ri (report interval) were removed too; reports have one format and are daily.

New: t, np and psd

  • t=y is the replacement for staged rollouts. It asks receivers to apply the policy one level lower — reject as quarantine, quarantine as none — while reports are generated as normal. It corresponds to the old pct=0; t=n, the default, to pct=100.
  • np= sets the policy for subdomains that do not exist. Spoofers like invented subdomains because nothing legitimate ever sends from them, so np=reject is close to free protection.
  • psd= marks a record as belonging to a public suffix (y), an organisational domain (n), or unspecified (u, the default). Most domain owners never need it.

Changed: how the policy is found

RFC 7489 used the Public Suffix List to work out a domain's organisational domain. RFC 9989 replaces that with a DNS tree walk: query _dmarc. the domain, then its parent, and so on towards the top-level domain, at most eight queries. The first valid record found is the one that applies. For a subdomain, the parent's sp= applies if the subdomain exists, and np= if it does not.

Clarified: what policies mean

  • A record with no valid p= is treated as p=none if it has a valid rua=, and ignored otherwise.
  • If more than one DMARC record is published at the same name, receivers discard all of them.
  • Domains that publish p=reject must sign with DKIM rather than rely on SPF alone, and domains whose users post to mailing lists should not publish p=reject.
  • The !10m size suffix on report addresses is obsolete and ignored.

What to change

  1. Remove pct, rf and ri. If pct was below 100, decide whether you really want the full policy, or t=y while you finish testing.
  2. Add np=reject if your main policy is enforcing and you do not already set sp=reject.
  3. Check there is exactly one record at _dmarc. your domain.
  4. If you are at p=reject, confirm every sender signs with DKIM.

The DMARC checker validates against RFC 9989 and flags each of these.

Check your record against RFC 9989

More guides

  • SPF, DKIM and DMARC explained How the three email authentication standards fit together, what each one proves, and which you need to stop people sending email as your domain.
  • How to create an SPF record Build a correct SPF record step by step: find every service that sends as you, add the right includes, pick between -all and ~all, and avoid the common mistakes.
  • Fixing "SPF PermError: too many DNS lookups" Why SPF stops at 10 DNS lookups, how the count is worked out across nested includes, and four ways to bring a record back under the limit.
  • Moving DMARC from p=none to p=reject A safe rollout plan for DMARC: start monitoring, read the aggregate reports, fix legitimate senders, and step up to quarantine and reject without losing mail.
  • What DKIM is and how to set it up How DKIM signatures work, where the public key lives in DNS, what a selector is, and how to turn DKIM on for the services that send your mail.
  • How to secure a domain that sends no email Parked and website-only domains are easy targets for spoofing. Three DNS records — null MX, a deny-all SPF record and DMARC reject — lock them down.
  • DKIM2: the next version of DKIM, explained DKIM2 is an IETF draft that chains signatures across every hop, records how intermediaries change a message, and stops DKIM replay. What it does and where it stands.
  • How to set up MTA-STS and TLS-RPT Stop attackers stripping TLS from email sent to your domain. Publish an MTA-STS policy in testing mode, collect TLS-RPT reports, then enforce.