DMARCbis Migration Checklist

A practical, phase-by-phase roadmap for migrating to DMARCbis — straight from Email Decoded. Tick items as you go; your progress is saved in this browser, no account needed.

DMARC itself split into three separate RFCs in 2026 — RFC 9989 (core policy), RFC 9990 (aggregate reports), and RFC 9991 (failure reports) — replacing the single informational RFC 7489 that governed it for over a decade. None of this changes your existing v=DMARC1 DNS record or its syntax; "DMARCbis" is simply the IETF working group's nickname for the update effort, not a new protocol you need to adopt separately. What actually matters for migration is the same phased discipline it always was: get full visibility through aggregate reports before enforcing anything, confirm every legitimate sending source (including third-party services like your CRM, helpdesk, or marketing platform) passes SPF or DKIM alignment, then move deliberately from p=none through p=quarantine to p=reject — checking reports at each step rather than jumping straight to full enforcement.