DMARCbis (RFC 9989): pct Is Gone, t=, np= and psd= Are New — Update Your DMARC Record

Short answer: RFC 9989 (May 2026) replaces the old DMARC spec and drops pct: receivers that follow it apply your policy to all failing mail. New tags: t=y (test mode), np= and psd=. If your record has pct below 100, plan for full enforcement now.

WhoIETF, then each mailbox provider
Statusexpected, no date
Dates
  • 2026-05: RFC 9989 (DMARC), RFC 9990 (aggregate reports) and RFC 9991 (failure reports) published; RFC 7489 and RFC 9091 are obsolete. Mailbox providers have not announced switch dates

Who is affected

Domains that ramp up DMARC with pct below 100 (for example p=quarantine; pct=10), and domains that rely on pct=0. Also anyone who wants to block mail from made-up subdomains with np=. In our 23 Oct 2026 scan of the world's top 3,000 domains, 741 of the 2,022 with DMARC (36.6%) still publish pct, and 45 of them use a partial value such as 10, 25 or 50. Check your record.

What you will see

Check your setup today

  1. Run our checker and read the DMARC line. Look for pct= with any value below 100, and for rf= or ri=. RFC 9989 lists all three as historic and no longer defines them.
  2. If you have pct below 100, open your DMARC aggregate reports (our free monitoring reads them) and find the mail that fails DMARC today. That mail gets your full policy at RFC 9989 receivers.
  3. If you have pct=0, note why: RFC 9989 says t=y now carries that meaning.
  4. In new aggregate reports, look at discovery_method: treewalk means that receiver already uses RFC 9989.

How to fix it

  1. Replace percentage ramps with time-based steps: p=none, then p=quarantine, then p=reject, moving up only when reports show every sender passes. Build each record with the DMARC generator.
  2. Need a soft step that works everywhere? Publish pct=0 and t=y together, for example v=DMARC1; p=reject; pct=0; t=y; rua=mailto:dmarc@yourdomain.com. Old (RFC 7489) receivers treat failing mail one level lower because of pct=0; RFC 9989 receivers do the same because of t=y.
  3. Remove pct values between 1 and 99, and remove rf= and ri=.
  4. Add np=reject if no subdomain that doesn't exist in DNS should ever send mail. Don't add psd=y: it is for public suffix operators such as registries.
  5. Keep v=DMARC1 as the first tag. The version doesn't change.

Check your domain now

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.

Rather not touch DNS? I set up SPF, DKIM and DMARC without breaking your other senders, with a before/after report.

Get it fixed on Fiverr

Prefer to do it yourself? Get the step-by-step Fix Kit ($15) – 28-page guide, checklist, 20+ providers.

Related pages

Sources

Other upcoming changes