In May 2026 the IETF published RFC 9989, a Standards Track DMARC specification that obsoletes RFC 7489 and RFC 9091. Reporting moved into companion documents, RFC 9990 and 9991. The main changes: a DNS tree walk replaces the public suffix list, the pct tag is gone, and new t, np and psd tags exist.
The document set
RFC 7489 (2015) was an informational document. The update splits the material into three Standards Track RFCs, each stating that it obsoletes or replaces RFC 7489 in part:
- RFC 9989: the core protocol, policy records, alignment and domain owner guidance.
- RFC 9990: aggregate reports.
- RFC 9991: failure reports.
RFC 9991 notes that RFC 9989 and RFC 9990 together with it replace RFC 7489.
The changes that affect you
DNS tree walk instead of a public suffix list. To find the organizational domain and the policy record, receivers now walk up the DNS labels querying for DMARC records. The walk is capped so that a domain with more than eight labels never causes more than eight queries. This also folds in the policy discovery for public suffix domains that RFC 9091 had defined as an experiment.
pct removed, t added. The old tag for partial enforcement is gone. A new t tag takes y or n, where y asks receivers not to apply the policy and to treat failures one level lower. See the pct and t post.
np tag. A policy for non-existent subdomains, imported from RFC 9091. See the subdomain policies post.
psd tag. A flag that tells receivers whether a domain is a public suffix domain. Mainly relevant to registries and operators, not most domain owners.
ri and rf removed. The tags requesting a report interval and failure report format are gone. The cap on report size in the reporting URI is also removed.
More guidance for domain owners. The domain owner actions section is much longer. It states that domains for general purpose email should not publish p=reject, a point covered in the mailing lists post.
What you need to do
For most domains, the answer is little. A valid record such as v=DMARC1; p=none; rua=mailto:... remains valid. Practical steps:
- Review records for
pct. Check whether your tooling and the receivers you care about still handle it, and plan to usetgoing forward. - Publish explicit DMARC records for every domain and subdomain that sends mail. The RFC says explicit records plus strict alignment avoid interoperability differences with receivers still using the older public suffix method.
- Keep
ruain place and confirm your report tooling can read reports from both old and new implementations.
Expect a mixed environment for some time. Receivers will adopt the new rules on their own schedules, and I could not confirm which major providers have already done so.
Quick check
Does my existing DMARC record stop working?
Not on that basis alone. The version tag is still DMARC1, and p, sp, rua and ruf continue to exist. Removed tags such as pct may simply be ignored by receivers following the new rules.
Is DMARC now a full Internet Standard?
RFC 9989 is labelled Standards Track, which is the IETF's path toward standard status. It is not the same as the earlier informational RFC 7489.
Sources
Last reviewed: 19 October 2026.
