DMARCbis: what the new standard means for email teams

TL;DR: DMARCbis moves DMARC, aggregate reporting and failure reporting onto the IETF Standards Track, formalising full-message policy enforcement, DNS-based public suffix handling and clearer reporting rules, according to Red Sift. The update makes indefinite monitoring mode and partial enforcement increasingly out of step with how email authentication should now be governed.

Editorial analysis by NHI Mgmt Group, based on content published by Red Sift: “DMARCbis is now an IETF Proposed Standard: What that means today”.

By the numbers:

• In May 2026, the IETF published RFC 9989, the updated DMARC specification.
• RFC 9990 defines aggregate reporting as a standard, including XML schema and delivery requirements.
• RFC 9991 covers failure reporting as near-real-time, per-message reports for DMARC failures.

Key questions

Q: How should security teams move DMARC from monitoring to enforcement without breaking legitimate mail?

A: Start by inventorying every authorised sender, including marketing, support, and transactional platforms, then validate SPF and DKIM for each one.

Q: Why does removing partial DMARC enforcement matter for email security teams?

A: Partial enforcement creates uneven protection because some failing mail is still allowed through, which leaves room for inconsistent receiver behaviour and long-lived exceptions.

Q: How can security teams use DMARC reporting to diagnose authentication failures?

A: Use aggregate reports to spot trends in sending sources, alignment failures and policy changes over time, then use failure reports for message-level troubleshooting when a specific failure needs diagnosis.

Practitioner guidance

• Audit long-lived pct usage Identify any DMARC records still relying on pct as more than a short transition mechanism, then plan a move to full policy enforcement.
• Revisit indefinite p=none monitoring Confirm whether monitoring mode is still justified, and if not, establish a path to rejection or quarantine with clear ownership.
• Validate reporting pipelines against the new RFC split Check that your tooling and processes can consume aggregate and failure reporting as separate operational inputs, not one blended feed.

Bottom line: DMARCbis tightens email authentication governance by making policy semantics and reporting more explicit across the ecosystem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →