One specification became three
RFC 9989 defines DMARC policy discovery, authentication alignment and handling. RFC 9990 defines aggregate reporting, while RFC 9991 defines optional failure reporting. Together they obsolete the original RFC 7489 DMARC document.
DNS Tree Walk replaces Public Suffix List discovery
The current standard determines applicable policy and organisational-domain boundaries with a bounded DNS Tree Walk rather than relying on a Public Suffix List. A receiver performs no more than eight policy lookups. Older and current implementations can therefore reach different conclusions in unusual DNS hierarchies.
Publishing explicit DMARC records for every Author Domain in use, or using strict alignment where appropriate, reduces this interoperability risk.
New policy tags
- np= specifies policy for non-existent subdomains.
- t=y requests policy test mode; for an enforcing policy the expected effective action is one level below the published action. It does not alter reporting and has no effect on p=none.
- psd= supports Public Suffix Operators and DNS Tree Walk discovery. Ordinary domain owners should not publish psd=y.
Removed and obsolete syntax
- pct= was removed. Use evidence and deliberate DNS changes rather than percentage-based rollout.
- rf= and ri= were removed. The similarly named ruf= failure-report destination remains valid but optional.
- The !size suffix on reporting URIs is obsolete and current reporters are instructed to ignore it.
Policy-record handling is clearer
- The v=DMARC1 tag must be first and DMARC1 is case-sensitive.
- An otherwise usable policy record without p= is treated as p=none when it contains a valid rua destination; publishing an explicit p remains recommended.
- If multiple DMARC policy records are returned for one lookup name, all are discarded.
- One rua tag can contain multiple comma-separated reporting destinations.
Aggregate reporting has its own current schema
RFC 9990 defines reports in the dmarc-2.0 XML namespace; its optional version element, when present, has the value 1.0. It adds current fields including the report generator, non-existent-domain policy, test-mode state and discovery method. Reports are XML and should be GZIP-compressed; ZIP attachments remain a legacy format that consumers may accept for interoperability.
Practical compatibility
A service operating during the transition should generate current records and guidance while continuing to parse safe legacy reports. DMARC Analyst follows that approach: obsolete record syntax is identified for removal, while bounded legacy ZIP and unnamespaced XML reports can still be ingested.