The New DMARC Standard: RFC 9989/9990/9991 Are Here

In May 2026, the IETF published a new DMARC RFC set that replaces RFC 7489: RFC 9989 (core DMARC), RFC 9990 (aggregate reporting), and RFC 9991 (failure reporting). DMARCbis, the long-running "next version of DMARC" draft, is now the published DMARC standard.

Why it matters

Mailbox providers increasingly expect authenticated, aligned mail as baseline sender behavior. The updated RFCs do not radically change those expectations, but they clarify and formalize practices that many senders and email service providers are already operating under today.

For senders already using authenticated domains and aligned identifiers correctly, this refresh feels more evolutionary than disruptive. The fundamentals stay the same: authenticate your mail, keep identifiers aligned, monitor your reports, and fix streams that don't line up.

What changed in the spec

  • One RFC became three: RFC 9989 covers policy and alignment, RFC 9990 covers aggregate reports, and RFC 9991 covers failure reports.
  • DNS Tree Walk for policy discovery: Receivers can walk up the DNS hierarchy instead of relying on a static public-suffix list. This mostly affects very large or complex domain structures (such as some .edu and .gov environments) and requires implementation changes on the receiver side. Most senders should still publish explicit DMARC records on the domains they actively use for mail.
  • Tag changes: New tags like np (non-existent subdomain policy) and psd (public suffix domain) are added; obsolete tags such as pct, rf, and ri are removed; a new t tag better describes testing behavior. Receivers are expected to ignore unknown or obsolete tags, but senders may remove the retired tags for cleanliness.

The difference between old and new records is clearest with an example. Suppose example.com used to publish:

v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]; rf=afrf; ri=86400

Cleaned up against the new spec:

v=DMARC1; p=quarantine; sp=reject; np=quarantine; rua=mailto:[email protected]; ruf=mailto:[email protected]; t=r

pct, rf, and ri are gone (receivers ignored them anyway; leaving them in is just clutter). sp=reject makes the subdomain policy explicit, np=quarantine now covers subdomains that don't exist, and t=r says the domain is in test mode, reporting results. You can inspect the current record anytime with nslookup -type=TXT _dmarc.example.com.

The full comparison between old and new:

Dimension RFC 7489 (old) RFC 9989/9990/9991 (new)
Document structure Single RFC Core + aggregate reports + failure reports
Policy discovery Static public-suffix list DNS Tree Walk up the hierarchy
Testing behavior pct percentage sampling t tag describing test state
Subdomain policy sp New np covers non-existent subdomains
Public suffix domain No explicit flag New psd tag

Where it actually bites

DNS Tree Walk sounds like pure implementation detail, but it matters for large organizations. Say an institution runs a multi-level domain structure under .edu. Receivers previously relied on a public-suffix list to figure out "which level is the organizational domain", and a stale list caused misjudgments; the new mechanism lets receivers walk up the DNS hierarchy and treat the first level that publishes a DMARC record as the organizational domain. That is why the change mostly lands on receiver implementations — senders should still publish explicit records on the domains they actively use, rather than counting on Tree Walk as a safety net.

What did not change

DMARC still passes when the visible From domain aligns with either SPF or DKIM — not only when both align. Alignment remains strict (exact match) or relaxed (same organizational domain, such as mg.example.com and example.com). In other words, the evaluation model is still "SPF or DKIM with alignment," not "SPF and DKIM and DMARC all passing independently."

It's also worth separating domain alignment from IP reputation. Shared versus dedicated IPs affect reputation management and troubleshooting visibility, but they do not fundamentally change how DMARC alignment works. Passing DMARC proves authorized use of the domain; reputation, engagement, and content still decide where the message lands.

What senders should do now

  1. Inventory domains and sending streams: List all verified sending domains and which streams (transactional, marketing, app notifications) use each. Retire or tighten DMARC on domains no longer actively used.
  2. Verify aligned SPF and DKIM, not just "pass": Use a header analyzer to confirm the DKIM d= matches your sending domain, and that SPF is published on a subdomain sharing the organizational domain with the visible From.
  3. Clean up DMARC records: Remove pct, rf, and ri; evaluate whether np and psd apply to your domain structure; confirm your sp= behavior for subdomains is intentional.
  4. Treat aggregate reports as an early-warning system: At p=none, treat that as active monitoring rather than "we'll look someday," and watch for new sending domains, forgotten legacy streams, or misaligned third-party senders.

Separately, don't confuse this update with DKIM2. DKIM2 is a separate protocol effort around signing models and replay protection; it is not a requirement today, and current DMARC evaluations still rely on SPF and DKIM exactly as before.

Reference: RFC 9989 https://datatracker.ietf.org/doc/rfc9989/, RFC 9990 https://datatracker.ietf.org/doc/rfc9990/, RFC 9991 https://datatracker.ietf.org/doc/rfc9991/

16IDC Take

For sites using deliverability optimization or an email service provider, this standard update is a good moment for a health check: before policies tighten, align your authentication with the new spec. Work through the SPF/DKIM/DMARC setup guide item by item, then keep watching with deliverability monitoring tools. See more in the Email Service category.

Source: https://www.mailgun.com/blog/deliverability/mailgun-dmarcbis-is-dead/