DMARC has a new RFC

DMARC has a new RFC. RFC 9989, published in May 2026, replaces RFC 7489, and the pct tag is gone. If you enforce DMARC, it's worth ten minutes. This is the longer version of Sheet 17.

How the three pieces fit

• SPF checks whether the sending IP may send for the envelope sender domain, the MAIL FROM. It's capped at 10 DNS-querying mechanisms, and going over returns permerror.
• DKIM checks a signature. The d= tag is the signing domain, s= is the selector, and the public key sits in DNS under a name built from the two.
• DMARC ties both to the domain the recipient actually sees in the From header. A message passes when SPF or DKIM passes and that authenticated domain aligns with the From domain. Relaxed alignment means the same organizational domain. Strict means identical.

What RFC 9989 changes

• pct is removed, so no more partial-enforcement percentages.
• A new t tag signals testing mode.
• A new np tag sets policy for non-existent subdomains.
• Organizational domains are found with a DNS tree walk instead of the Public Suffix List, with a new psd tag.
• Aggregate and failure reporting moved to their own RFCs, 9990 and 9991.

I enforced SPF, DKIM, and DMARC tenant-wide for a 4,300-user organization. If your rollout plan still ramps enforcement with pct, read appendix A.6 of RFC 9989 before your next step.

Where is your domain on the path from p=none to p=reject?