DMARC moves onto the IETF Standards Track
Three new RFCs replace the original DMARC specification, separating the core protocol from reporting.
What happened
On 20 May 2026, the RFC Editor published three documents that put DMARC on the IETF Standards Track. They replace the original RFC 7489 specification:
- RFC 9989: the core DMARC protocol.
- RFC 9990: aggregate reporting.
- RFC 9991: failure reporting.
The core document also obsoletes RFC 9091. Together, the new documents separate policy and authentication behaviour from the two reporting mechanisms.
Why it matters
Older tutorials and software documentation may still describe RFC 7489 as the current specification. The new protocol includes changes to domain discovery and removes the legacy pct tag.
Publication does not mean every receiver or reporting tool changes at the same time. Check the behaviour of the systems you use before depending on a newer feature.
A useful next step
Review your deployment notes and ask your reporting provider which report formats it supports. Link internal documentation to the new RFCs, while keeping track of compatibility with older implementations.
For the fundamentals, read DMARC, without the jargon.
Sources
- DMARC.org — publication announcement
- RFC 9989 — core protocol
- RFC 9990 — aggregate reporting
- RFC 9991 — failure reporting
Sources reviewed .