Key points at a glance
- Since May 2026, RFC 9989 (DMARC) and RFC 9990 (aggregate reports) replace the previous standard RFC 7489.
- pct, rf and ri are gone; new are t=y (test mode), np (non-existent subdomains) and psd (only for public suffix operators).
- np=reject is recommended; psd=y does not belong in a company domain’s record.
What is DMARCbis?
DMARCbis is the name for the revised DMARC rules. Since May 2026, two new documents replace the old standard RFC 7489: RFC 9989 describes DMARC itself, RFC 9990 the aggregate reports that mail providers send to your reporting address.
The goal stays the same: with p=none, p=quarantine or p=reject, your record says what should happen to emails that claim to come from your domain but fail the check.
Source: RFC 9989 and RFC 9990 from the RFC Editor.
- Removedpct, rf and ri
- Newt=y, np and psd
- Recommendednp=reject, no psd=y on company domains
What is gone: pct, rf and ri
pct set the share of emails the policy applies to, for example pct=25 for a careful move to quarantine. rf set the format of failure reports, ri the requested interval between aggregate reports. None of the three exists in the new standard.
Older receivers still honour pct, receivers following the new standard do not. If you are tightening your policy step by step, update your record deliberately.
Free domain check
Is your company address protected?
Enter your domain or your email address. You see the result right here, with a traffic light and a grade from A to F.
You opened a link to a result. The check only starts when you click, always with the current state.
Privacy: if you enter an email address, we transmit only the domain; the part before the @ never leaves your browser. We use the domain only for this check of public DNS records and do not store it in plain text; we do not store the result. We store your IP address only as a checksum and for at most one day to curb abuse.
The quick check is based on public DNS data at the time of the query and does not replace a full review; no warranty.
Keep an eye on it continuously instead of checking once:
Book a free initial callMonitor your domain – 14 days freePrefer some help? Ask us to set it up- No commitment
- No credit card
- Ends on its own after 14 days
No-obligation request by email · price on request
What happens next
- Your email program opens a prepared request with your domain. Add your name and send it.
- We get back to you and discuss with you or your IT partner which records (SPF, DKIM, DMARC) are needed and what the setup costs.
- The setup needs access to the DNS management of your domain. We agree the handover with you – please never send us passwords by email.
- If you wish, DomainRadar then monitors your domain continuously and alerts you when something changes.
No email program opens? Write to us with your domain at info@domainradar.ch.
Good to know: this protection stops anyone forging exactly your domain. Against look-alike addresses, always confirm payment changes by phone.
All checks
Quick check based on public DNS records. Continuous monitoring also checks certificates, blocklists and your DMARC reports.
Your result as a PDF
As a report to keep or to forward to your IT.
Free and without an account: you confirm your address by email and can unsubscribe at any time.
What is new: t=y, np and psd
Three tags have been added:
- t=y switches on test mode: receivers apply one level milder. quarantine becomes none, reject becomes quarantine.
- np sets the policy for subdomains that do not exist. If np is missing, sp applies, and if sp is missing too, p. np=reject is recommended: mail servers that check DMARC then reject emails from made-up subdomains of your domain.
- psd is meant only for operators of public suffixes. psd=y on a company domain is wrong.
No psd=y on company domains
If your company domain’s DMARC record contains psd=y, the domain claims to operate a public suffix. Remove the tag.
Three paths to p=reject
If you have been tightening step by step with pct, you face a question: older receivers only know pct, new ones only t=y. There are three ladders:
- Classic: as before with pct. Receivers following the new standard no longer know pct.
- Bridge: pct for older receivers plus t=y for new ones. This way no receiver gets a harder jump than planned.
- DMARCbis: t=y only. Older receivers do not know t=y and apply the full level.
- p=quarantine; t=yReceivers apply none
- p=reject; t=yReceivers apply quarantine
- p=rejectForgeries are rejected
CarefulFull protection
Check every level
Whichever ladder you choose: review the reports after each level before tightening further.
Frequently asked questions
Do I need to change my DMARC record now?
It is worth checking. The new standard no longer knows pct, rf and ri, and without np, sp or p applies to non-existent subdomains. The free check shows what to do for your domain.
What does t=y mean?
t=y switches on test mode: receivers following the new standard apply one level milder, so none instead of quarantine and quarantine instead of reject. Older receivers do not know t=y and apply the full level.
How DomainRadar helps
DomainRadar also checks every DMARC record against RFC 9989: it points out outdated pct, rf and ri, recommends np=reject, warns about psd=y and checks the values of np, t and psd. The “DMARCbis compliant” badge in the portal and the monthly report shows whether your record follows the new standard.
You also get a ready-to-copy record following DMARCbis and, while pct is below 100, a transition record that acts as a bridge. The rollout assistant offers the Classic, Bridge and DMARCbis ladders; Classic remains the default. DomainRadar reads reports in the new format just like the old ones, and the free check shows the new notes as well. DomainRadar never changes your DNS: you add the recommendations yourself.
The domain check stays free. Afterwards you test DomainRadar with all features for 14 days – no credit card, the trial ends on its own.