[{"data":1,"prerenderedAt":189},["ShallowReactive",2],{"seo-verification":3,"blog-dmarcbis-rfc-9989-email-changes-2026-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-dmarcbis-rfc-9989-email-changes-2026-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":27,"featuredImage":29,"bgImage":30,"posterImage":31,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":122,"ctaBody":123,"ctaButton":124,"ctaUrl":125,"relatedPosts":126},463,"dmarcbis-rfc-9989-email-changes-2026",{"fr":12,"en":10,"ar":13,"es":14},"dmarcbis-rfc-9989-ce-qui-change-email-2026","dmarcbis-rfc-9989-تغييرات-البريد-الإلكتروني-2026","dmarcbis-rfc-9989-cambios-correo-electronico-2026","DMARCbis RFC 9989: what changes for your mail server","RFC 9989, 9990 and 9991 replaced RFC 7489 in May 2026. Learn the three concrete changes — np tag, removal of pct, Tree Walk DNS — and how to update your DNS records and",8,0,false,"2026-10-17T00:00:00+00:00","2026-10-18T21:57:56+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},11,"Business Email","emails","bg-cyan-500\u002F10 text-cyan-400",[28],{"id":23,"name":24,"slug":25,"color":26,"icon":25},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdmarcbis-rfc-9989-ce-qui-change-email-2026-poster.svg","In May 2026, the IETF published RFC 9989, 9990 and 9991 — collectively known as DMARCbis — replacing RFC 7489 after eleven years. These RFCs are on the Standards Track, meaning they now carry full IETF authority. If you manage a VPS running Postfix or Exim, three concrete changes affect your DNS records and configuration before major MTA operators begin enforcing the new rules.",[34,38,46,49,76,79,82,89,92,119],{"type":35,"title":36,"body":37},"h2","Why DMARCbis and why now","RFC 7489, published in 2015 as an Informational document, left three gaps: the `pct` tag allowed policies to apply to only X% of messages, diluting protection and making receiver behavior unpredictable; the absence of a dedicated policy for non-existent subdomains left a gap exploitable for phishing; and reliance on the Public Suffix List (PSL) to identify the organizational domain created inconsistencies between MTA implementations, since the PSL is maintained outside the IETF. RFC 9989 (core DMARC), RFC 9990 (aggregate reporting) and RFC 9991 (failure reporting) address each of these gaps, elevating DMARC to Proposed Standard status.",{"type":39,"items":40},"ul",[41,42,43,44,45],"**RFC 9989 (core DMARCbis)** — obsoletes RFC 7489 and RFC 9091; introduces the `np` tag, removes `pct`, replaces it with the `t` tag (test mode), and defines Tree Walk DNS to identify the parent domain without relying on the PSL","**RFC 9990 (aggregate reporting)** — extracts and modernises the aggregate reporting section of RFC 7489; XML reports compressed as GZIP remain the format but external destination verification is strengthened","**RFC 9991 (failure reporting)** — extracts failure reporting; emphasises privacy risks and mandates rate limiting at generators to prevent DoS abuse","**Removal of `pct`** — any existing DMARC record carrying `pct=50` (or any other value) must be reviewed; RFC 9989-compliant receivers may ignore this tag or apply the policy to 100% of messages","**Tree Walk DNS** — the receiver climbs the DNS tree via successive queries (capped at 8) to find the applicable policy, removing the PSL dependency and improving cross-implementation consistency",{"type":35,"title":47,"body":48},"Prerequisites before making changes","Before any modification, confirm your infrastructure meets the basics: SPF and DKIM must be correctly configured on your sending domain — DMARCbis adds nothing to these mechanisms but depends entirely on them. Also ensure your audit tools (dig, nslookup, SSH access to your VPS) are available and that you have access to your DNS zone. Finally, gather your current DMARC aggregate reports (via `rua`) to establish a baseline of legitimate traffic before tightening policy.",{"type":50,"steps":51},"steps",[52,55,58,61,64,67,70,73],{"title":53,"body":54},"Audit your current DMARC record","Run `dig TXT _dmarc.example.com` from your VPS or terminal. Note the exact value of each tag: `v`, `p`, `sp`, `pct`, `rua`, `ruf`, `adkim`, `aspf`. If `pct` is present with a value below 100, plan its removal.",{"title":56,"body":57},"Remove or replace the `pct` tag","In RFC 9989, `pct` is deprecated. Its progressive deployment role moves to the `t` tag: `t=y` instructs the receiver to treat the message as if the policy were `p=none`, without applying quarantine or rejection. To migrate smoothly from `pct=50`, replace with `t=y`, validate over a few weeks via your aggregate reports, then drop `t=y`. Migration example: `v=DMARC1; p=quarantine; t=y; rua=mailto:dmarc@example.com`",{"title":59,"body":60},"Add the `np` tag for non-existent subdomains","The `np` tag defines the policy to apply to messages claiming to come from a subdomain that does not exist in your DNS. Without `np`, RFC 9989 falls back to `sp` or `p`. To block phishing via non-existent subdomains, add `np=reject`. Full example: `v=DMARC1; p=quarantine; sp=quarantine; np=reject; rua=mailto:dmarc@example.com`",{"title":62,"body":63},"Understand Tree Walk DNS and publish at the right levels","With Tree Walk, a receiver processing a message from `mail.app.example.com` queries `_dmarc.mail.app.example.com`, then `_dmarc.app.example.com`, then `_dmarc.example.com`, stopping at the first valid response (maximum 8 DNS queries). Audit your DNS zones to detect unintentional `_dmarc.*` records that could override your root policy.",{"title":65,"body":66},"Update your final DNS record","Once tags are reviewed, publish the updated record. Full example for a domain in hardening phase: `v=DMARC1; p=quarantine; sp=quarantine; np=reject; adkim=s; aspf=s; rua=mailto:dmarc-agg@example.com; ruf=mailto:dmarc-fail@example.com; fo=1`",{"title":68,"body":69},"Check DKIM alignment in Postfix","Ensure `adkim=s` (strict) does not conflict with subdomains signing under a different key. In strict mode, the `From:` header domain must exactly match the DKIM `d=` domain. If in doubt, temporarily use `adkim=r` (relaxed) and analyse aggregate reports.",{"title":71,"body":72},"Check DKIM alignment in Exim","Verify in your Exim configuration that `dkim_domain` exactly matches the domain published in your DMARC record. Any mismatch under `adkim=s` causes a DKIM failure and may trigger quarantine or reject policy.",{"title":74,"body":75},"Test and validate reports","Wait 24 to 48 hours and parse the aggregate XML reports received at your `rua` address. The `\u003Cpolicy_evaluated>\u003Cdkim>` and `\u003Cpolicy_evaluated>\u003Cspf>` fields show whether your messages pass alignment. Tools like MXToolbox DMARCAnalyzer or mail-tester.com can parse these reports without requiring you to write code.",{"type":77,"body":78},"tip","To quickly validate your DMARC record from your VPS, run `dig TXT _dmarc.example.com +short` then paste the value into MXToolbox's DMARC checker (mxtoolbox.com\u002Fdmarc.aspx). It detects unknown tags, `pct`\u002F`t` conflicts, and reports whether the record is syntactically valid under RFC 9989. To simulate a Tree Walk, run `dig TXT _dmarc.subdomain.example.com` and `dig TXT _dmarc.example.com` in sequence and compare the policies returned at each level.",{"type":35,"title":80,"body":81},"Troubleshooting common scenarios","Most issues have a deterministic root cause — here are the most common ones and how to fix them.",{"type":39,"items":83},[84,85,86,87,88],"**`pct` ignored by a receiver** — If RFC 9989-compliant MTAs ignore your `pct=50` and apply the policy to 100% of messages, your aggregate reports will show a sudden increase in rejections or quarantines. Add `t=y` immediately to switch to test mode while you adapt your infrastructure.","**`np` policy too strict** — If a legitimate service sends from a subdomain not published in DNS, `np=reject` will block those messages. Start with `np=quarantine` and analyse reports before moving to `reject`.","**Tree Walk produces an unexpected policy** — If you find an orphaned `_dmarc.app.example.com` record left over from a former service, Tree Walk receivers will apply it first. Delete unused `_dmarc.*` records after a full DNS zone inventory.","**Aggregate reports empty or missing** — Verify that the `rua` address is reachable and your MX accepts XML reports compressed as GZIP. Some spam filters block `.gz` attachments. Also check the maximum message size accepted by your report reception server.","**`adkim=s` mismatch with multi-domain Postfix** — If you use one Postfix instance for several domains and the DKIM key signs under `example.com` while `From:` contains `newsletter.example.com`, strict alignment will fail. Either add a dedicated DKIM key per subdomain or switch to `adkim=r` for those domains.",{"type":35,"title":90,"body":91},"RFC 7489 vs RFC 9989: the differences that matter","The table below summarises the structural differences between the two specifications.",{"type":93,"headers":94,"rows":98},"comparison",[95,96,97],"Point","RFC 7489 (2015)","RFC 9989 (2026)",[99,103,107,111,115],[100,101,102],"`pct` tag","Present — applies policy to X% of messages for progressive rollout","Removed — replaced by `t=y` (test mode); every compliant receiver applies policy to 100% of messages",[104,105,106],"Non-existent subdomains","No dedicated tag — `sp` or `p` applies by default","`np` tag introduced — distinct policy for subdomains absent from DNS",[108,109,110],"Parent domain discovery","Based on the Public Suffix List (PSL), maintained outside IETF, varies by implementer","Tree Walk DNS — climbs the DNS tree via successive queries, capped at 8, defined in the standard",[112,113,114],"Reporting","Aggregate and failure reporting in a single RFC 7489","Three separate RFCs: 9989 (core), 9990 (aggregate), 9991 (failure) — better extensibility",[116,117,118],"Status","Informational — reference value but not on Standards Track","Proposed Standard (Standards Track) — full IETF authority, basis for future MTA implementations",{"type":35,"title":120,"body":121},"Adapt now or deal with it later","DMARCbis is not yet uniformly enforced by all MTAs — Google, Microsoft and Yahoo have announced Tree Walk testing phases but no hard cutoff date has been communicated. This is not a reason to wait: RFC 9989, 9990 and 9991 are on the Standards Track, progressive implementation is underway, and the first `pct` interpretation divergences between receivers are already appearing. Removing `pct`, adding `np` and auditing your DNS zones for Tree Walk are defensive steps that break nothing on receivers still on RFC 7489 — `np` is ignored by older MTAs, and removing `pct` only has an effect if the receiver already enforces RFC 9989. The cost of adapting is low; the cost of a policy partially applied by a mixed receiver population is not.","A VPS to host your mail server","Postfix, Exim, Dovecot or a full stack like Stalwart or Mailcow — deploy your mail infrastructure on a Linux VPS with full root access, port 25 available on request and configurable reverse DNS.","See Linux VPS plans","\u002Fvps-linux",[127,143,160,175],{"id":128,"slug":129,"slugs":130,"title":134,"excerpt":135,"readTime":136,"views":18,"isPinned":19,"publishedAt":137,"updatedAt":138,"category":139,"categories":140,"featuredImage":29,"bgImage":30,"posterImage":142,"relatedSolution":29},199,"spf-dkim-dmarc-passing-the-5000-email-threshold",{"fr":131,"en":129,"ar":132,"es":133},"spf-dkim-dmarc-delivrabilite-emails-pro","spf-وdkim-وdmarc-تجاوز-عتبة-5000-رسالة","spf-dkim-dmarc-superar-el-umbral-de-5000-correos","SPF, DKIM, DMARC: passing the 5,000-email threshold","Gmail and Outlook reject senders without aligned SPF, DKIM and DMARC with an SMTP 550 error. Here is how to configure all three records.",4,"2026-08-01T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[141],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fspf-dkim-dmarc-delivrabilite-emails-pro-poster.svg",{"id":144,"slug":145,"slugs":146,"title":150,"excerpt":151,"readTime":152,"views":153,"isPinned":19,"publishedAt":154,"updatedAt":155,"category":156,"categories":157,"featuredImage":29,"bgImage":30,"posterImage":159,"relatedSolution":29},345,"dmarc-p-quarantine-email-deliverability",{"fr":147,"en":145,"ar":148,"es":149},"dmarc-p-quarantine-email-delivrabilite","dmarc-p-quarantine-email-deliverability-ar","dmarc-p-quarantine-entregabilidad-email","DMARC p=quarantine: stop sending in monitor-only mode","In 2026, Google and Microsoft throttle senders of more than 100 emails\u002Fday stuck on DMARC p=none. SPF, DKIM, DMARC and List-Unsubscribe one-click checklist.",9,1,"2026-09-10T00:00:00+00:00","2026-09-10T13:10:45+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[158],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fdmarc-p-quarantine-email-delivrabilite-poster.svg",{"id":161,"slug":162,"slugs":163,"title":167,"excerpt":168,"readTime":169,"views":18,"isPinned":19,"publishedAt":170,"updatedAt":21,"category":171,"categories":172,"featuredImage":29,"bgImage":30,"posterImage":174,"relatedSolution":29},459,"self-hosted-email-server-on-vps-comparison-2026",{"fr":164,"en":162,"ar":165,"es":166},"serveur-email-self-hosted-comparatif-vps-2026","مقارنة-خوادم-البريد-self-hosted-على-vps-2026","comparativa-servidores-email-self-hosted-en-vps-2026","Self-hosted email server on VPS: 2026 comparison","Stalwart, Mailcow or Postfix+Dovecot: compare RAM, complexity and spam filtering scope to choose the right email server for your VPS in under 10 minutes.",10,"2026-10-16T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[173],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Fserveur-email-self-hosted-comparatif-vps-2026-poster.svg",{"id":176,"slug":177,"slugs":178,"title":182,"excerpt":183,"readTime":152,"views":153,"isPinned":19,"publishedAt":184,"updatedAt":138,"category":185,"categories":186,"featuredImage":29,"bgImage":30,"posterImage":188,"relatedSolution":29},331,"email-deliverability-on-vps-port-25-cold-ip-and-ptr",{"fr":179,"en":177,"ar":180,"es":181},"email-deliverabilite-vps-port-25-dkim-ptr","تسليم-البريد-الإلكتروني-على-vps-المنفذ-25-وـ-ptr","entregabilidad-de-email-en-vps-puerto-25-ip-fria-y-ptr","Email deliverability on VPS: port 25, cold IP and PTR","Port 25 blocked by the provider, fresh IP flagged as spam, missing PTR: the three structural blockers to resolve before your first send from a VPS.","2026-09-05T00:00:00+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":25},[187],{"id":23,"name":24,"slug":25,"color":26,"icon":25},"\u002Fblog\u002Fcovers\u002Femail-deliverabilite-vps-port-25-dkim-ptr-poster.svg",1792361065547]