# DMARC in 2026: what RFC 9989 changes for email senders

> Understand the 2026 DMARC specifications, DNS discovery changes and reporting split, with practical steps for checking your sending services.

By [CheckDMARC](https://checkdmarc.mx/). Published: 2026-11-06. Reviewed: 2026-11-06.

## One protocol, three specifications

DMARC connects SPF or DKIM authentication to the visible From domain and lets a domain owner publish a requested policy for failing messages. The 2026 update separates that protocol from its reporting formats.

All three have Proposed Standard status on the IETF Standards Track. RFC 7489 was Informational. These are specification changes, not evidence that every mail service has switched implementations.

The specifications published in May 2026
| Specification | Scope |
| --- | --- |
| RFC 9989 | Core DMARC protocol; obsoletes RFC 7489 and RFC 9091. |
| RFC 9990 | Aggregate reporting: summaries of message authentication activity. |
| RFC 9991 | Failure reporting: information about individual failing messages. |

- [Review DMARC alignment and policy](https://checkdmarc.mx/learn/dmarc)

## The important changes are in discovery and policy tags

RFC 9989 replaces reliance on a Public Suffix List with a bounded DNS Tree Walk for policy discovery and organizational-domain determination. This matters when a message uses subdomains and when a parent domain publishes policy.

Use this table to ask informed questions, rather than adding or deleting tags mechanically. Check the source record and your provider’s supported behavior before making a change.

Record details to discuss with your mail provider
| Tag | What changed |
| --- | --- |
| np | Policy for non-existent domains, incorporated from the earlier PSD extension. |
| psd | A flag used when discovering public-suffix and organizational-domain boundaries. |
| t | Policy test mode, replacing some functionality of pct. |
| pct | Removed from the RFC 9989 core record definition. |

- [RFC 9989 Appendix C — changes from RFC 7489](https://www.rfc-editor.org/rfc/rfc9989.html#appendix-C)

## A passing result still needs an aligned identity

A message needs at least one passing SPF or DKIM identity aligned with its From domain to pass DMARC. A passing signature belonging only to an unrelated provider does not establish that connection.

For a practical investigation, record the visible From domain, the SPF identity, each relevant DKIM signing domain and the receiving system’s DMARC result. If two reports differ, compare their original headers and sending routes before treating one as wrong.

- [Work through SPF and DKIM passing while DMARC fails](https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail)
- [Find the original receiving headers](https://checkdmarc.mx/learn/email-authentication-headers)

## Stricter policy is a decision about your mail flows

Do not treat p=reject as an automatic end point for every domain. RFC 9989 advises general-purpose email domains against it because ordinary mail can travel through mailing lists and forwarding services that create interoperability problems.

Start by identifying who sends for your domain and how legitimate messages reach recipients. Review aggregate reports alongside individual message tests before deciding whether enforcement is appropriate. A passing test from one mailbox does not cover every newsletter, invoice system or forwarded message.

- [RFC 9989 §7.4 — interoperability considerations](https://www.rfc-editor.org/rfc/rfc9989.html#section-7.4)
- [Inventory your sending services](https://checkdmarc.mx/blog/email-authentication-checklist)

## What should you do with your current setup?

Keep a baseline before changing provider settings or DNS. The useful comparison is the same sending service before and after an explainable change.

1. **Capture a real message from each service.** Record its From domain, authentication identities, receiving provider and test date. Include the actual route you are troubleshooting.

2. **Ask your provider about its implementation.** Use the RFC numbers and the discovery or tag behavior you need to understand. Do not infer a receiver’s supported version from the publication date alone.

3. **Separate message tests from reporting.** A temporary CheckDMARC address tests a message. It is not an aggregate-report collection mailbox and should not be used as your rua destination.

4. **Test again after an agreed change.** Allow for DNS caching and repeat the same sending route. If the issue involves a forwarded or list-delivered message, keep the original headers from that destination as well.

- [Follow the testing walkthrough](https://checkdmarc.mx/how-it-works)
- [Create a test address](https://checkdmarc.mx/#email-check)

## What CheckDMARC can tell you today

CheckDMARC interprets receiver authentication results and adds current DNS evidence and limited alignment diagnostics. Its computed fallback and alignment display are not a complete RFC 9989 implementation. Pasted headers also do not independently verify a DKIM signature or an ARC chain.

Use the report to investigate one message, keeping the receiver’s recorded result distinct from current DNS and locally computed checks. CheckDMARC does not collect aggregate or failure reports; the reporting RFCs explain a separate part of operating a domain’s email.

- [Read the test’s limits](https://checkdmarc.mx/how-it-works#limits)
- [Explore a fictional sample report](https://checkdmarc.mx/sample-result)

## Sources

- [RFC 9989 — core DMARC, including policy discovery, interoperability and Appendix C](https://www.rfc-editor.org/rfc/rfc9989.html)

- [RFC 9990 — DMARC Aggregate Reporting](https://www.rfc-editor.org/rfc/rfc9990.html)

- [RFC 9991 — DMARC Failure Reporting](https://www.rfc-editor.org/rfc/rfc9991.html)

## Related reading

- [DMARC: connect authentication to your From domain](https://checkdmarc.mx/learn/dmarc/index.md)

- [An email authentication checklist for every sending service](https://checkdmarc.mx/blog/email-authentication-checklist/index.md)

- [SPF and DKIM pass, but DMARC fails. What now?](https://checkdmarc.mx/blog/spf-dkim-pass-dmarc-fail/index.md)

[Check your email](https://checkdmarc.mx/#email-check)

Web page: https://checkdmarc.mx/blog/dmarc-2026-rfc-9989