DMARC finally grew up. After more than a decade on a spec that was not truly a real standard, the IETF has published RFC 9989, 9990 and 9991. This is the work everyone’s been calling “DMARCbis,” and it replaces the original 2015 spec (RFC 7489) while moving DMARC onto the formal Standards Track.
Here’s the part that matters: this is not a “DMARC 2.0” migration. Your records still start with v=DMARC1. p=none, quarantine and reject all work exactly as before. If you’re an ordinary domain owner, you do not need to touch your DNS this week.
What changed
The PSL is dead, long live the DNS Tree Walk.
The clunky reliance on the Public Suffix List for organisational domain discovery is gone, replaced by a DNS Tree Walk that determines the organisational domain through live DNS lookups instead of a static external list. The RFC frames this as offering more flexibility to large, complex organisations that want decentralised control over their DNS and DMARC records, so it’s the change most likely to matter for anyone managing delegated customer domains or sprawling subdomain trees. Expect mixed behaviour while the ecosystem transitions, since some receivers will still be on the old PSL method as others move to the Tree Walk. Practical advice hasn’t changed: publish explicit records for the domains you actually send from and don’t assume obscure subdomain trees resolve identically everywhere.
Reporting got its own documents.
Aggregate reporting now lives in RFC 9990, failure reporting in RFC 9991.
Tag spring cleaning.
In: np (policy for non-existent subdomains), psd (public suffix flag), and t (a testing tag). Out: pct, rf and ri. The death of pct will sting the people still treating percentage-based enforcement as a rollout strategy which in all honesty, was always a crutch at best. Proper staged rollout has always been about source discovery, alignment fixes and monitoring.
Who actually has homework: monitoring vendors, mailbox providers, tooling makers, and consultants maintaining rollout playbooks. Most of us mostly need to update our mental model and our slides and not much else.
And the obligatory reality check, straight from RFC 9989 itself: a DMARC pass is not a statement that mail is safe or wanted. It validates that the author domain was used legitimately. Nothing more. DMARC still won’t fix forwarding, still won’t fix mailing lists, still won’t guarantee the inbox.
But after eleven years, DMARCbis isn’t coming anymore. It’s here, and it’s just DMARC. Thanks to all of those folks who invested a huge amount of time and effort in getting this published and over the line.
