Introduction

For more than a decade, RFC 7489 has served as the foundation of Domain-based Message Authentication, Reporting, and Conformance (DMARC), helping organizations combat email spoofing, phishing, and business email compromise (BEC).

In May 2026, the Internet Engineering Task Force (IETF) officially published RFC 9989, replacing RFC 7489 as the new DMARC standard. Alongside RFC 9990 (Aggregate Reporting) and RFC 9991 (Failure Reporting), DMARC has finally become an official Internet Standards Track protocol.

The good news?

If your organization already has a properly configured DMARC record, nothing immediately breaks.

The better news?

There are several important enhancements that organizations should begin understanding today because mailbox providers will gradually adopt these behaviors over time.

What Changed?

One of the biggest misconceptions is that organizations must deploy a “DMARC2” record.

That isn’t true.

Your record still begins with:

v=DMARC1

There is no new protocol version.

Instead, RFC 9989 updates how DMARC policies are interpreted and introduces several new capabilities while retiring others.

RFC 7489 vs RFC 9989

The fundamental concepts of SPF alignment, DKIM alignment, and DMARC policy enforcement remain unchanged.

The Three New DMARC Tags

1. np (Nonexistent Domain Policy)

This may become the most valuable enhancement for defensive domain owners.

Previously, if an attacker spoofed:

fake.department.example.com

and that hostname did not actually exist, handling could become inconsistent depending on receiver implementations.

The new np tag allows organizations to explicitly define the policy for nonexistent subdomains.

Example:

v=DMARC1;
p=reject;
sp=quarantine;
np=reject;

Now receivers that support RFC 9989 know exactly how mail claiming to originate from nonexistent subdomains should be handled.

2. psd (Public Suffix Domain)

The psd tag is primarily intended for Public Suffix Domain operators.

Examples include:

• • .bank

• • .gov

• • .edu

Most organizations will never need to publish this tag.

It exists so registry operators can participate directly in DMARC enforcement and reporting.

3. t (Test Mode)

RFC 7489 included:

pct=25

meaning:

“Apply policy to only 25% of failing messages.”

Unfortunately, receiver support for pct was inconsistent.

RFC 9989 replaces this concept with the t tag.

Example:

t=y

This signals:

“Evaluate my policy but do not fully enforce it yet.”

Unlike pct, this communicates testing intent rather than partial enforcement percentages. The t tag has no effect when the policy is p=none.

Tags Removed

RFC 9989 officially removes several legacy tags.

• • pct

• • rf

• • ri

Most organizations can safely remove these over time as receiver support transitions to the new specification.

What Happens to Existing DMARC Records?

If your organization already publishes something like:

v=DMARC1;
p=reject;
rua=mailto:dmarc@example.com;

It remains valid.

No emergency migration is required.

Mailbox providers are expected to continue supporting existing records while gradually adding support for RFC 9989 features.

Receiver Behavior During the Transition

One important point often overlooked is that receivers upgrade independently.

Google, Microsoft, Yahoo, Proofpoint, Mimecast, Cisco, and hundreds of other MTAs will not all adopt RFC 9989 at the same time.

For several years the Internet will likely contain a mix of:

• • RFC 7489 behavior

• • RFC 9989 behavior

• • Vendor-specific enhancements

That means two recipients could evaluate the same email slightly differently depending on the software version and feature support at the receiving mail system.

This gradual adoption model is common with Internet standards and underscores the importance of monitoring authentication results rather than assuming every receiver behaves identically.

DNS Tree Walk Changes

Perhaps the largest technical change is invisible to most organizations.

RFC 7489 relied heavily on the Public Suffix List to determine the Organizational Domain.

RFC 9989 replaces this with a DNS Tree Walk algorithm.

This improves flexibility and better supports complex DNS hierarchies, delegated namespaces, and Public Suffix Domains.

The practical impact is more predictable inheritance across DNS trees and better support for future namespace structures.

Understanding Policy Inheritance

Policy inheritance becomes even more important under RFC 9989.

Consider:

example.com

publishing:

p=reject
sp=quarantine
np=reject

Now consider these domains:

sales.example.com
marketing.example.com
abc.example.com

Each may inherit policy differently depending on:

• • whether the subdomain exists

• • whether it publishes its own DMARC record

• • whether it is an Organizational Domain

• • whether it falls under the new DNS Tree Walk discovery process

Organizations with hundreds or thousands of subdomains should review their DNS architecture before introducing the new tags.

Should Organizations Publish Cross Version Records?

Yes.

One of the strengths of RFC 9989 is backward compatibility.

Organizations can publish records that continue functioning for RFC 7489 implementations while enabling new functionality for RFC 9989 aware receivers.

For example:

v=DMARC1;
p=reject;
sp=reject;
np=reject;
rua=mailto:dmarc@example.com

Older receivers simply ignore unknown tags.

New receivers gain the additional policy information.

This provides a smooth migration path with minimal operational risk.

Could There Be Delivery Issues?

Most organizations should not experience immediate delivery problems simply because RFC 9989 has been published.

However, administrators should pay attention to several considerations:

• • Legacy DMARC parsing software may ignore new tags until updated.

• • Mixed receiver support means policy enforcement may vary during the transition period.

• • Organizations using large numbers of delegated or defensive subdomains should carefully validate inheritance behavior before deploying new tags.

• • Early adopters of the np tag should also monitor implementation maturity because receiver support is still evolving, and community testing has already identified interoperability edge cases in some environments.

How Poole Technology Solutions Can Help

Transitioning to the new DMARC standard is about more than adding a few DNS tags.

Organizations should take the opportunity to review their entire email authentication posture.

Poole Technology Solutions helps organizations:

• • Assess existing DMARC deployments

• • Review SPF and DKIM alignment

• • Identify vulnerable or forgotten subdomains

• • Develop migration strategies for RFC 9989

• • Optimize DMARC reporting and monitoring

• • Strengthen protection against phishing, spoofing, and Business Email Compromise (BEC)

Whether your organization manages one domain or thousands, proper planning today can prevent authentication issues tomorrow.

Final Thoughts

RFC 9989 represents the most significant update to DMARC since the protocol was introduced in 2015. While the core principles remain familiar, the new standard introduces meaningful improvements for policy inheritance, nonexistent subdomains, Public Suffix Domains, and future interoperability.

Organizations do not need to rush into rewriting every DMARC record, but they should begin evaluating how these changes fit into their long term email authentication strategy. By understanding the new tags, monitoring receiver adoption, and validating DNS configurations, businesses can position themselves to take advantage of the next generation of DMARC while maintaining compatibility with today’s email ecosystem.

If you’re unsure whether your organization’s DMARC implementation is ready for RFC 9989, Poole Technology Solutions can help you assess your current configuration, identify gaps, and develop a practical migration strategy that protects your brand while minimizing disruption.

Take our free Cybersecurity Readiness Assessment at: https://assessments.pooletechsol.com and learn how stronger email authentication can improve your organization’s overall cybersecurity posture.