What is DMARCbis and what does it change?

You set up DMARC, it works, and then you hear "DMARCbis is here" and wonder if you have to tear it all down and start over. You don't.

DMARC (updated as DMARCbis) is not a new protocol and not a replacement. DMARCbis is simply the updated version of the original DMARC spec, which was about a decade old. It was published in May 2026 as three IETF documents, RFC 9989 for the core protocol plus RFC 9990 and RFC 9991 for reporting, and it obsoletes the original 2015 spec, RFC 7489. Same DMARC. The update cleans up a few things that tripped people up once the standard met the real world.

Three practical things change, and that is genuinely the whole list:

• pct= goes away. The old percentage dial (apply my policy to only 25% of failing mail) created confusing, half-enforced results, and most serious senders stopped using it. It is now removed from the spec. (More in "What replaced pct in DMARC?")
• np= arrives. A new tag that sets a policy for subdomains that do not exist at all. Spoofers love inventing random subdomains like login.yourbrand.com that were never real. np= lets you slam that door.
• Finding your "organizational domain" changes under the hood. DMARC has to work out where your registrable domain ends (is it brand.co.uk or co.uk?). It used to rely on a hand-maintained file called the Public Suffix List. DMARCbis replaces that with a live DNS lookup called the "tree walk." You do not configure anything. It just gets more accurate.

Here is what does not change: your DMARC record, the three policies (p=none, p=quarantine, p=reject), SPF, DKIM, alignment, and your aggregate (rua) reports. If it works today, it keeps working.

For reference, here is what a complete DMARC record looks like. It is a full policy, and it is unchanged under DMARCbis:

v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com

One thing to keep in mind. DMARCbis is published, but mailbox providers roll out support on their own timelines, so this is still not a "rewrite your DNS tonight" situation. Read up, get comfortable, and make the small changes as the receivers pick them up.

Want to see what your current record actually says? Run it through our free DMARC checker, or if you would rather someone sanity-check it with you, the SOS hotline is free.