DMARCbis Is Published: RFC 9989, 9990, 9991 Replace 7489 | DMARCguardSkip to main content<br>20 min readShare

DMARCbis Is Published: RFC 9989, 9990, and 9991 Replace RFC 7489<br>DMARC is now a Standards-Track Internet protocol.<br>DMARCbis is the IETF revision of DMARC, published in May 2026 as three separate documents: RFC 9989 (the new core protocol), RFC 9990 (aggregate reporting), and RFC 9991 (failure reporting). Together they obsolete RFC 7489 and promote DMARC from Informational to Proposed Standard (Standards Track) for the first time. This is the new DMARC RFC set for 2026 — the canonical DMARC specification going forward.<br>RFC 7489 was originally published in 2015 as an Informational document. After eleven years of operational deployment and one revision attempt (RFC 9091, which added the psd= tag), the IETF DMARC Working Group split the protocol into three Standards-Track documents. The core authentication-and-policy work is now in RFC 9989; aggregate reporting moved to RFC 9990; failure reporting moved to RFC 9991.<br>This post is the day-one breakdown of what changed, why it matters, and what to do this week.<br>New to DMARC?<br>Read our DMARC fundamentals guide first, then come back here.

What Changed — at a Glance<br>One sentence — this is the DMARC RFC 2026 update at a glance: RFC 7489 (Informational, 2015) is replaced by three Standards-Track RFCs published — RFC 9989 (core protocol), RFC 9990 (aggregate reporting), and RFC 9991 (failure reporting). DMARCbis is also marketed by some vendors as DMARC 2.0 , but the RFC numbers are the canonical reference going forward.<br>The mapping:<br>RFC 7489 (Informational, 2015)Replacement (Standards Track, 2026)RFC 7489 §1–§6 (core protocol)RFC 9989 Domain-based Message Authentication, Reporting, and Conformance<br>RFC 7489 §7 (aggregate reports)RFC 9990 DMARC Aggregate Reporting<br>RFC 7489 §8 (failure reports)RFC 9991 DMARC Failure Reporting<br>RFC 9091 (psd= tag and tree walk)<br>Merged into RFC 9989Public Suffix List (PSL) lookupDNS Tree Walk (8-level limit)<br>pct=, rf=, ri= tags<br>Removed (no equivalent)New tags : np=, psd=, t=<br>forwarded, sampled_out override reasons<br>Removed ; policy_test_mode added

RFC 7489 is replaced by three new Standards-Track RFCs. RFC 9091 (PSD tag) is folded into RFC 9989.If you operate a DMARC record : most of your record stays valid. The v=, p=, sp=, rua=, ruf=, adkim=, aspf=, and fo= tags all keep their RFC 7489 meaning. pct=, rf=, and ri= are deprecated — remove them at your next DNS edit. Optionally adopt the three new tags described below.<br>If you process DMARC reports : the XML schema for aggregate reports (RFC 9990) gains optional fields including discovery_method, policy_test_mode, generator, and an optional envelope_from. Existing parsers keep working — unknown fields are ignored per XML rules — but updated parsers can use the new data to reduce source-identification ambiguity.<br>If you build DMARC tooling : Standards-Track status changes the IETF errata process and the cadence for future revisions. Any future change goes through formal IETF review, not the Informational-RFC working-group consensus that governed RFC 7489.<br>Why This Matters: DMARC Is Now Standards Track<br>RFC 7489 was published in 2015 as an Informational RFC. The Informational status meant DMARC was a public reference document but not a formally standardized protocol — implementations couldn’t claim “Standards Track” compliance, and the IETF errata process treated it as a community spec rather than a real standard.<br>RFC 9989 promotes DMARC to Proposed Standard (Standards Track) for the first time. The promotion is the work of the IETF DMARC Working Group, with document editors Todd Herr (Valimail) and John Levine (Standcore LLC) shepherding the draft through more than five years of revisions; further contributors are listed in RFC 9989 Appendix D.<br>It took eleven years because Standards-Track promotion requires operational deployment data and demonstrated interoperability across independent implementations. DMARC had to be deployed at scale before the IETF would ratify the spec as a real Internet Standard.<br>What changes for vendors and auditors : implementations can now declare compliance with a Standards-Track RFC rather than an Informational one. PCI DSS, NIS2, BOD 18-01, and other compliance frameworks can reference RFC 9989 directly as the canonical DMARC specification. The DMARC specification is now a standard, not a community document.<br>That distinction is operational, not aesthetic. It changes how disputes get resolved, how revisions get cut, and how tooling claims correctness.<br>RFC 9989 — The New Core DMARC Protocol<br>RFC 9989 is the new core DMARC document. It carries the same scope as RFC 7489 §1–§6 (authentication, alignment, policy, record format, organizational domain discovery) and absorbs RFC 9091 (the psd= tag draft). Read the full spec at rfc-editor.org/rfc/rfc9989.html.<br>The four substantive changes — terminology, tree walk, removed tags, and new tags — are as follows.<br>New...