The specifications, and which ones still apply.

RFC 9989 is the current DMARC standard, replacing RFC 7489 in 2026. What the document covers, the tag registry as it stands, and where to read what changed.

RFC 9990 specifies the DMARC aggregate report — the XML your rua address receives. Split out of RFC 7489, with a clarified schema and required DKIM selectors.

RFC 9991 specifies DMARC failure reports — the per-message detail ruf requests. Split from RFC 7489, and the reason almost nobody sends them.

RFC 7489 was the original DMARC document. It is obsolete — replaced in 2026 by RFCs 9989, 9990 and 9991. Here is what to cite instead.

RFC 9091 was the experimental extension letting public suffix operators publish DMARC for domains beneath them. It is now folded into RFC 9989.

RFC 6591 defines the Abuse Reporting Format extension that DMARC failure reports are built on, and the fields a failure report carries.

RFC 7960 catalogues why legitimate mail fails DMARC — mailing lists, forwarders and gateways — and which of those problems have no clean fix.

RFC 7208 defines SPF — which servers may send for your domain, the ten-lookup limit, and every mechanism and modifier the syntax allows.

RFC 6376 defines DKIM — the cryptographic signature on outgoing mail, the selector that names the key, and what a signature does and does not prove.

RFC 8617 defines ARC, which preserves authentication results across forwarders and mailing lists — the main reason legitimate mail fails DMARC.

RFC 8601 defines the Authentication-Results header — where dmarc=pass, spf=fail and dkim=pass come from, and how to read one correctly.

RFC 8463 adds Ed25519 signatures to DKIM — much shorter keys that fit DNS comfortably, and why almost nobody uses them alone.

RFC 6377 is the best-current-practice document for running a mailing list without breaking DKIM — written before DMARC made the problem worse.

RFC 5617 defined ADSP, DMARC's failed predecessor. Its status is Historic, and understanding why explains most of DMARC's design.

RFC 8461 defines MTA-STS — how a domain declares that inbound mail must arrive over authenticated TLS, and how senders discover and cache that policy.

RFC 8460 defines TLS-RPT — daily JSON reports on whether mail to your domain arrived over TLS, and why any of it failed to.

RFC 7672 defines DANE for SMTP — publishing certificate constraints in DNSSEC-signed DNS, the alternative to MTA-STS for enforcing TLS.

RFC 3207 defines STARTTLS, which encrypts mail in transit — and is trivially stripped, which is the problem MTA-STS and DANE exist to solve.

RFC 5322 defines the message format itself — including the From header that DMARC aligns against, and why it is distinct from the envelope sender.

RFC 5321 defines SMTP and the envelope — including the MAIL FROM address that SPF checks, which is not the From header your recipient sees.

RFC 8058 defines one-click unsubscribe — a requirement for bulk senders at Google and Yahoo since 2024, alongside DMARC.