RFC 9989 and DMARC: What Changed and What Multi-Domain Organizations Need to Do

RFC 9989 is the new DMARC standard, published in May 2026. It replaces RFC 7489 and RFC 9091, and its most significant change is removing DMARC's dependency on the Public Suffix List (PSL) for determining organizational domains.

If you manage email authentication for an organization with multiple domains or subdomains, this change affects how you publish and manage DMARC records.

What Is RFC 9989?

RFC 9989 is an Internet Standards Track document that updates the DMARC (Domain-based Message Authentication, Reporting, and Conformance) protocol. It was published in May 2026 by the IETF and represents the current state of the DMARC standard.

DMARC lets domain owners specify what receiving mail servers should do when an email fails authentication. It also lets owners request aggregate reports about authentication attempts on their domain.

RFC 9989 obsoletes two earlier DMARC RFCs:

• RFC 7489 (the original DMARC specification from 2015)


• RFC 9091 (an earlier update to DMARC)

Why the Public Suffix List Was a Problem for Multi-Domain Organizations

The Public Suffix List (PSL) is a database of domain suffixes like .com, .co.uk, or github.io. It is maintained by the Mozilla Foundation and used by browsers to identify where one person's domain ends and another organization's begins.

The original DMARC specification used the PSL to determine the "organizational domain" for a given email sender domain. This meant that when a mail server received an email from mail.example.com, it would look up .com in the PSL to decide whether to apply DMARC checks at the mail.example.com level or the example.com level.

For most organizations this worked fine. But for large organizations with hundreds of domains and subdomains, the PSL-based approach created problems.

The subdomain problem

If you own brand1.com, brand2.com, and brand3.com, and each brand has multiple product subdomains, you had to publish individual DMARC records for every subdomain that sends email. Without explicit records, subdomains would fall through and rely on whatever the receiving server decided to do.

The alternative was to publish wildcard DMARC records like _dmarc.brand1.com, but wildcard DMARC records are not supported by all receiving servers and can create unexpected results.

This made DMARC management for large portfolios unnecessarily complex. Organizations that should have been leading email security adoption held back because the operational overhead was too high.

How RFC 9989 Changes DMARC Policy Discovery

RFC 9989 changes how DMARC policy discovery works. Instead of relying on the PSL to find the organizational domain, RFC 9989 uses a different approach based on DNS tree walking and explicit organizational domain declaration.

Under RFC 9989, an organization can declare an organizational domain explicitly rather than having receivers infer it from the PSL. This means:

1. You publish a DMARC record at your organizational domain level (e.g., example.com)
2. Subdomains that do not have their own explicit DMARC record can now inherit policy from the organizational domain
3. The inheritance is defined by the RFC rather than by what the PSL says about your domain

What this means practically

If you own example.com and send email from subdomains like marketing.example.com, hr.example.com, and support.example.com, you now have options:

• Publish DMARC at example.com with p=quarantine or p=reject
• Subdomains that do not have their own DMARC record will inherit the policy from example.com
• Subdomains that send email independently can still have their own explicit DMARC records

This is a significant simplification for multi-domain organizations. Instead of auditing every subdomain and ensuring each has a proper DMARC record, you can focus on your organizational domain policy and handle exceptions as they arise.

What Multi-Domain Organizations Need to Do Now

RFC 9989 is already in effect. Mail servers that comply with the RFC will handle DMARC policy discovery differently. Here is what you should do:

1. Audit your current DMARC state

Before making any changes, understand what your current DMARC records look like across all your domains. If you do not already use a DMARC aggregate report service, now is a good time to start. DMARC reports give you visibility into which domains and subdomains are sending email and how they are passing authentication.

2. Identify your organizational domains

Determine which domains in your portfolio are organizational domains versus subdomains. An organizational domain is typically the apex domain that owns the subdomains beneath it.

3. Review subdomain email sending patterns

Check whether your subdomains send email independently or only relay through your main mail servers. Subdomains that send independently may need their own explicit DMARC policies rather than relying on inheritance.

4. Consolidate where it makes sense

If you have been publishing the same DMARC policy across many subdomains, you may be able to consolidate to the organizational domain level and let inheritance handle the rest.

5. Update your monitoring

With RFC 9989 inheritance in place, your aggregate reports may show different patterns. More subdomains will appear under your organizational domain policy, which is expected and correct.

How DMARCFlow Helps You Manage DMARC Across All Your Domains

RFC 9989 makes multi-domain DMARC management simpler in theory. In practice, you still need visibility into what every domain and subdomain is doing with email authentication.

DMARCFlow aggregates DMARC reports across all your domains in one place. When subdomains inherit policy from organizational domains under RFC 9989, DMARCFlow shows you the full picture so you can:

• See authentication results across your entire domain portfolio from one dashboard
• Identify subdomains that are failing DMARC despite inheritance
• Track progress toward full DMARC enforcement (p=reject) across all domains
• Receive alerts when new domains or subdomains start sending email

If you manage email authentication for multiple domains, DMARCFlow is the practical tool that makes RFC 9989 adoption manageable rather than just theoretically possible.

FAQ

Does RFC 9989 eliminate the need for subdomain DMARC records?

Not entirely. Subdomains that send email independently still need their own DMARC records. RFC 9989 means that subdomains without explicit DMARC records can now inherit policy from the organizational domain, but subdomains with independent email sending should have their own explicit policies.

When did RFC 9989 take effect?

RFC 9989 was published in May 2026 and is now the current DMARC standard. It obsoletes RFCs 7489 and 9091. Major mailbox providers have been updating their DMARC implementations to comply with the new standard.

Do I need to update my DMARC records?

If you are a multi-domain organization, review your DMARC setup to see if you can consolidate policies at the organizational domain level. Start by auditing your current state with aggregate reports, then make changes incrementally.

Is the Public Suffix List still used at all?

RFC 9989 removes the PSL as a required part of DMARC policy discovery. However, the PSL remains a useful tool for other purposes (browser security, certificate transparency) and may still be used as a fallback in some implementations.

How does RFC 9989 affect DMARC reporting?

The aggregate report format remains similar, but the scope of what is covered changes. When organizational domains can now cover subdomains through inheritance, you may see more subdomains appearing in your reports under the organizational domain policy. This is expected and correct behavior under RFC 9989.