Loading post…
ResendExplainer
The New DMARC is Here
Summary
DMARCbis is finalized as three Standards Track RFCs: RFC 9989 for the core protocol, RFC 9990 for aggregate reporting, and RFC 9991 for failure reporting. Existing DMARC records continue working as before, so most senders do not need immediate changes. The largest behavioral update replaces Public Suffix List lookups with an algorithmic DNS Tree Walk, in which receivers query _dmarc records up the DNS hierarchy; the psd tag can declare hierarchy boundaries. The pct tag is replaced by boolean t, while np can specify a policy for non-existent subdomains, including np=reject. Reporting knobs rf and ri are removed, but rua and ruf remain available; senders using fractional pct should use a none-to-quarantine-to-reject rollout, keep reading reports, and avoid rushing to reject.
Context
The original DMARC specification was an Informational document, while DMARCbis is published as Standards Track RFCs. The update formalizes the protocol and changes domain discovery, enforcement tags, and reporting standards without requiring immediate changes to existing records.
Approach / What changed
Use the DNS Tree Walk to discover organizational domains, with psd available for declaring public-suffix or organizational-domain boundaries. Replace fractional pct rollout with p=none followed by quarantine or reject, consider np=reject for non-existent subdomains, and continue using rua and ruf reports while validating authenticated, aligned sources.
Takeaways
DMARC receivers now use an algorithmic DNS Tree Walk instead of relying on the Public Suffix List to determine organizational domains.
The pct tag is replaced by boolean t; senders that used fractional pct should review reports at p=none, then move to quarantine or reject after sources are aligned.
The np tag can apply none, quarantine, or reject specifically to non-existent subdomains, while rua and ruf reporting addresses continue to work.
FAQ
Do existing DMARC records need to be changed immediately?
No. Existing records continue working as before, so changes are optional unless a sender wants to use the new features or clean up obsolete tags.
What should replace a fractional pct rollout?
Use p=none while reviewing reports and aligning legitimate sending sources, then move to quarantine or reject. The source recommends avoiding a rushed move to reject.
What does np=reject protect against?
It tells receivers to reject mail from non-existent subdomains, such as plausible subdomains that were never provisioned. It does not change the policy for subdomains that do exist.
Source and freshness
- Source
- resend.com
- Published
- Added to Yomu
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.