What is RFC 9989 (DMARC)?

You set up DMARC, then you hear the standard got replaced. You don't have to tear it all down.

RFC 9989 is the document that defines DMARC today. It's the core of the update you may know as DMARCbis, and it sits on the IETF standards track. The one before it, RFC 7489, did not. It obsoletes RFC 7489 and RFC 9091, an experiment on policies for public suffix domains. The job is the same: SPF or DKIM has to pass, and the domain that passed has to align with the domain in the visible From address.

Here's what changed in the record:

• pct= is gone. The percentage was rarely applied accurately unless it was 0 or 100. If your record still has it, drop it next time you edit.
• t= is added. t=y says you're testing. It asks receivers to apply one level below your policy, so p=reject gets treated as quarantine and p=quarantine as none. It does nothing at p=none and doesn't change your reports.
• np= is added. It sets the policy for subdomains that don't exist. It came over from RFC 9091. Without it, those subdomains fall back to sp=, then p=.
• sp= stays, for subdomains that do exist. It's ignored in a record published on a subdomain.
• psd= is added. It marks whether a domain is a public suffix. A large organization can also use psd=n to make part of its DNS tree its own organizational domain. Leave it out and the default applies.
• rf= and ri= are gone, along with the option to set a maximum report size.

One change sits under the hood. To find your organizational domain and your policy, receivers now do a tree walk, a series of DNS lookups up your domain, in place of the Public Suffix List. A receiver still on the old method might reach a different answer. Strict alignment and an explicit record on every domain you send from avoid that. Mailbox providers roll out support on their own timelines.

One rule worth knowing: if a domain returns two DMARC records, both are discarded.

RFC 9989 is also more explicit about p=reject. Domains whose users might post to mailing lists should not publish it. If you still want to, it asks you to sit at p=none for at least a month, then p=quarantine for just as long, and compare the results. And never rely on SPF alone at p=reject, because you need valid DKIM signatures too. Receivers are told not to reject on your policy alone, though the RFC itself admits list mail is often rejected anyway.

Reporting moved out. The rua= and ruf= tags are still listed here, but the reports themselves now live in RFC 9990 and RFC 9991.

Still want to see what your DMARC record says today? Check it with our free DMARC Parser, or build a clean one with the DMARC Generator. Not sure what any of this means for your setup? Our SOS hotline is a free place to get a second opinion.