On May 20th, 2026 the IETF’s RFC Editor published three documents that update the DMARC protocol, making the changes and enhancements previously referred to as “DMARCbis” official, and moving the updated DMARC protocol to the IETF’s Standards Track. This represents many years of work by the IETF’s DMARC Working Group, as development began in earnest shortly after the ARC protocol was finalized in 2019.
The new documents are:
- RFC 9989 describes the core protocol
- RFC 9990 covers aggregate reporting
- RFC 9991 details failure reporting
Highlights of the changes include:
- Public Suffix List replaced by DNS Tree Walk and Public Suffix Domains (PSD)
- Several tags deprecated: pct=, rf=, ri=
- np= tag added for non-existent subdomain policy
- psd= tag brought in from RFC 9091 (obsoleted)
- Report size limit notation removed from rua=
- DMARC SPF only uses the MAIL FROM: address, no fallback to the HELO identifier
- Much more guidance about PII/NPI risks in reporting