mailpassed research · 2026-10-25 · first published here

DMARC after RFC 9989: 1,515 top domains could jump to full enforcement

Short answer: 31.5% of top domains with DMARC still publish pct=, which RFC 9989 removed. Most use the harmless pct=100, but 1,515 enforce quarantine or reject with a partial value – at receivers that follow the new standard, all their failing mail is affected, not a share. Only a handful use the new t= tag.

Why it matters

RFC 9989 (DMARCbis, May 2026) dropped pct because receivers only ever applied 0 and 100 consistently. Its replacement is t=y (testing), which asks receivers to apply the policy one step softer. A domain that ramps up with p=quarantine; pct=25 believes three quarters of its failing mail still gets through; a receiver on the new standard applies quarantine to all of it.

Check your domain

1. Run our checker: it flags partial pct values and notes when pct=100 can simply go.

How to fix it

1. Still testing? Replace pct=… with t=y; pct=0 (new and old receivers both apply one step softer) – build it with the DMARC generator's testing mode.
2. Ready to enforce? Drop pct entirely.
3. Watch your aggregate reports while you change policy – free DMARC monitoring.

How we measured

We resolved the public DNS of the 99,704 live registrable domains in the Tranco top-100,000 list (scan of 2026-10-25): MX, SPF (with every include followed and counted the way receivers do), DMARC, MTA-STS and TLS-RPT, and fetched each MTA-STS policy over HTTPS with certificate checks. Unknown answers (DNS timeouts) are kept apart from missing records. We publish totals only and never name affected domains.

Related

• DMARCbis (RFC 9989): pct Is Gone, t=, np= and psd= Are New — Update Your DMARC Record
• DMARC generator
• Free DMARC monitoring

After the fix, send a test email to see SPF, DKIM and DMARC pass on a real message, then keep an eye on it: free DMARC monitoring shows every service that sends mail as your domain and which ones fail, in plain English.