DMARC Update 2026: Key Changes You Need to Know

Introduction

DMARC recently got its first major update since it’s introduction way back in 2015. The new specifications, formerly known as DMARCbis, took aim at some long-standing limitations present in the original protocol. The result? Better accuracy, stronger security, and simpler maintenance.

In this post, I’ll explain what changed. Most importantly, I’ll show you how to update your DMARC record to align with the new standard.

Key Changes in DMARC

In May of 2026, the IETF published RFCs 9989 (Core Protocol) , 9990 (Aggregate Reporting) , and 9991 (Forensic Reporting), effectively replacing the original specification, RFC 7489.

While more evolutionary than revolutionary, the specs contain several important changes to modernize the protocol. Some of the key changes involve deprecating obsolete tags, formalizing a dedicated testing flag and introducing a non-existent subdomain policy. In short, the updates allow domain owners to neutralize spoofing across unused domain spaces, streamline reporting and remove its reliance on a manually maintained list for defining organizational boundaries.

First, let’s look at the the changes to the tags. A few tags are now deprecated with a few new tags added into the mix.

DMARC Tags

The role of tags in your DMARC record is to give instructions to receivers on how you would like your email authenticated, handled and reported on. In short, they define policy enforcement, alignment and reporting destinations for your domain.

With the 2026 update, the aim is to simplify the tags. The outcome resulted in a few tags becoming deprecated along with the addition of a few new tags.

Deprecated Tags

• pct: Percentage for partial enforcement. enforcement. For example, pct=50 would ask receivers to apply your policy to 50% of the volume of email coming from your domain. In this example, roughly half of your emails get protected with your policy. The tag was great for testing changes without impacting all of the emails sent from your domain. However, the tag led to confusion and inconsistent behavior. As a result, the pct tag is now deprecated.
• rf: the report format tag offered receivers an option in reporting formats. There were two options, afrf and iodef. In reality, almost no MBPs implemented iodef. With new standards, afrf is the de facto standard, making the tag no longer necessary.
• ri: This tag defined the desired reporting interval as to how frequently aggregate reports would be sent. Most MBPs ignored the ri tag and instead send the reports daily. As such, the tag has been deprecated.

New Tags

• psd: Public Suffix Domain flag is not relevant for 99% of domain owners. Registries and large organizations use this tag to avoid forcing the same policy across the entire organization. This is useful to maintain the independence of third-party subdomains. Accepted values are y, n and u. Most domain owners can omit this and let it default to “u.”
• np: Policy for non-existent subdomains. This tag closes a loophole that scammers and spammers used to exploit subdomains that were not in use. Valid values are the same as the p and sp tag; none, quarantine and reject.
• t: Test mode flag. If the t tag is set to y to indicate the record is in testing, then receivers will enforce the next-lower policy than what is published. For example, if you have set the p tag to “quarantine” and have the t tag set to “y“, then the p policy is lowered to “none.” This tag replaces the gradual rollout function of the removed pct tag.

DMARC’s Update Impact

After more than a decade of use, DMARC gets a much-needed facelift. The changes modernize the protocol while addressing some of the weaknesses in the original spec. Key changes include the following:

• Public Suffix List Removal
• Streamlined Reporting
• Improved Subdomain Handling

Public Suffix List Removal

Removing the Public Suffix List is perhaps the most significant change in DMARC. That’s because it removes reliance on the volunteer-maintained list and puts organizational boundaries in the hands of DNS. The new psd and np tags help achieve this.

Under the legacy RFC (7489), a receiving mail server from a subdomain could not rely on DNS to determine organizational boundaries. For example, if an email was originating from user.blog.example.co, DNS could not provide the answer as to whether example.co’s DMARC policy should be used or not.

To handle this, a list of public suffixes was maintained by Mozilla. A receiver downloaded the and checked for a match. As you might imagine, the list led to sync and caching issues, impacting both deliverability and security.

To remove PSL, the email receiver had to do a DNS Tree Walk, looking for the _dmarc record for the organizational domain. This led to an inheritance risk for public registries or SaaS platforms like github.io. If the tree walk grabbed the DMARC record for the root domain, that policy would be forced onto all of the subdomains. As you can imagine, this became an issue for third-parties or organizations needing separate policies by division.

This limitation impacted modern multi-tenant SaaS platforms, like *.myshopify.com. They couldn’t update or declare boundaries for internal or private DNS setups easily. The introduction of the psd tag helps to solve these type of issues.

In the myshopify.com example, the DNS Tree Walk climbs to _dmarc.myshopify.com and finds the following:

Host: _dmarc.myshopify.com

Value: v=DMARC1; p=reject; sp=reject; np=reject; psd=y; fo=1; pct=100; rua=mailto:[email protected]; ruf=mailto:[email protected]

The psd=y tag tells the receiver that this is a public suffix domain and ends its walk. This prevents policy leakage. user1.myshopify.com does not inherit myshopify’s reject policy, but rather can provide it’s own DMARC policy.

The psd tag is an important addition for registers and multi-tenant platforms to declare their status in DNS as it eliminates the need to use the PSL to understand organizational boundaries.

Streamlined Reporting

The older standard contained tags like rf (report format) and ri (report interval), which are now deprecated. With their removal, reporting has been streamlined to send the aggregate and forensic reports daily and in an XML format.

If you need help decoding DMARC aggregate reports, check out our post DMARC Reports 101: How to Decipher the Results for additional information on how to interpret the reports.

Improved Subdomain Handling

The change to use the automated DNS Tree Walk surfaced another issue. Non-existent subdomains opened a major security loophole. Non-existent subdomains are simply subdomains that the organization has not declared in DNS.

Organizations use the sp tag to supply a policy for their subdomains, but attackers got wise to this and pivoted to using non-existent subdomains. This loophole allowed attackers to spoof a brand’s identity by making it look like the communication was coming from the brand.

For example, an attacker could forge an email coming from fake-subdomain.myshopify.com. This allowed the attacker to get past stricter domain and subdomain rules, like p=reject for instance.

For example, an attacker could send an email from phishing.example.com. The receiver performs a DNS Tree Walk and finds the main domain policy of p=reject and and sp=none. This would result in the more lenient policy being applied and the receiver accepting the email.

Because the phishing sudomain does not exist in DNS and it is a common practice for some organizations to apply more lenient policies to subdomains during roll outs, the attacker’s use of a fake subdomain allowed their phishing emails to bypass the strict reject policy of the root domain.

With the addition of the np tag, domain owners have more control over the policy used for non-existent subdomains. The recommendation is to use np=reject for all non-existent domains. This allows organizations to use a more lenient sp tag and drop any mail originating from any subdomain that does not exist for the domain in DNS.

Updating your DMARC Record

As mentioned earlier, the DMARC update doesn’t introduce any breaking changes. Having deprecated tags in your record is not going to impact your email alignment negatively. Most MBPs will just ignore the deprecated tags.

But it is good hygiene to keep your record current. You’ll want to add the np tag to receive the benefit of non-existing subdomains, so you might as well clean up any deprecated tags while doing that maintenance.

Before making any updates, save a copy of your existing DMARC TXT record. This is important in case you need to fall back or document it for a historical archive.

Next, search your current record looking for any of the deprecated tags. For this example, we’ll use the following DMARC record as our starting point.

v=DMARC1; p=quarantine; sp=none; rua=mailto:[email protected]; rf=afrf; pct=100;

In our example, we have two deprecated tags (rf and pct). Remove both to align your record with the new standard.

Next add “np=reject;” after your domain (p) and subdomain (sp) tags.

The updated DMARC record reflecting the changes listed above follows:

v=DMARC1; p=quarantine; sp=none; np=reject; rua=mailto:[email protected]; ruf=mailto:[email protected]

Note the changed record shows the removal of the two deprecated tags, rf and pct and the addition of the np tag. As discussed earlier, the np tag plays an important role to close the security loophole, because if omitted, receivers use the sp or p policy as a fallback.

If only a p tag is defined in your DMARC record, that policy gets applied to the subdomains. An existing subdomain that resolves in DNS without an sp tag inherits the policy defined in the p tag. The same thing applies to non-existent subdomains. Depending on the policy you are using for your root domain, it may not offer enough protection for non-existing subdomains.

Returning to the state of DMARC record at the beginning of this example, the sp tag had a value of “none” without the np tag defined. When an email is received from a non-existent subdomain, receivers look for the np policy. If one isn’t published, then it looks for one defined by the sp tag. If no sp policy is defined, the policy defined by the p tag is used.

In the example above, sp=none, which leaves you without protection for non-existent subdomains making your domain vulnerable to the spoofing and phishing loophole discussed earlier.

Even if you have a stricter sp policy like sp=reject, It’s best practice to not leave this to chance with fallback mechanisms. I reccommend defining your desired np policy so it is explicitly stated.

Our recommendation is to go with “np=reject” since emails should not be originating from a subdomain not defined in your DNS records in the first place. Some might prefer to go with the more cautious “np=quarantine” and there are some valid use cases for this.

However, I would argue that this offers very little in return considering the risk. If your emails end up in spam instead of being rejected due to the more lenient policy, what are the chances of them being seen in s timely manner the first place? If you have some unique edge case or doing some major DNS updates then maybe it makes sense, but I would suggest there is a better way to address those cases now.

With the introduction of the new test mode tag, you could simply add t=y to your record during rollouts or when actively making changes. With np set to reject and the test mode tag on, failing messages will be evaluated with the next lower policy. This means that messages from non-existent subdomains will use “np=quarantine” policy while test mode is active. The test mode eliminates the need to go back and forth tweaking domain policies every time you make a change to your DNS.

If you monitor your DMARC reports on a regular basis, you will be able to catch any discrepancies and address them promptly. In my humble opinion, np=reject is the best solution as it closes the non-existent subdomain security gap and would choose to leverage the test mode flag as needed, rather than require constant tweaking of my domain policies.

Conclusion

In this article, we covered the new RFCs that were introduced in May of 2026, AKA as DMARCbis. We covered the deprecated tags, new tags and the impact the updates might have on your business. A review of the key takeaways follow:

1. Stronger Spoofing/Phishing Protection: The new rules make it much harder for hackers to impersonate your brand. By closing a security gap with the np tag and using a more precise DNS Tree Walk, fewer fake emails reach recipients claiming to be from your business.
2. Consistent Enforcement: In the past, different email providers interpreted rules differently. The new standards ensure that RFC 9989 is applied uniformly. Whether your email goes to Gmail, Yahoo or Outlook, the security check is the same.
3. Better Reporting: With RFC 9990 and RFC 9991, reports are more reliable. They use a strict XML format and are delivered daily, making it easier for your team to spot attacks and address issues quickly.

If you use anything other than “reject” for your p or sp tags, then adding np=reject to your DMARC record is a big win for protecting your brand against spoofing and phishing. When adding the np tag to your DMARC record, it’s also a great time to check for any deprecated tags and removing them while you are in there to keep your record up to the latest standards.

While removing deprecated tags is a best practice, it’s not critical. Most receivers will just ignore them. However, it is good hygiene and keeps your DMARC record aligned with the current standard.