DMARCbis:
The next generation of email authentication

DMARCbis introduces several important updates designed to make email authentication more reliable, easier to implement, and better suited for today’s threat environment. Below are the most significant changes security professionals and domain owners should be aware of.

Improved specification structure

The updated document is now split into three separate drafts:

• Core protocol: Defines DMARC
• Aggregate reporting: Outlines how daily reports are generated and formatted
• Forensic reporting: Details how forensic reports provide information on authentication failures

This separation makes the protocol easier to understand, implement, and maintain over time.

Conformance requirements for full participation

DMARCbis introduces clearer rules for what businesses and receivers must do to fully support the standard. By setting clear expectations, the update improves interoperability and strengthens global adoption.

DNS Tree Walk algorithm

One of the most significant updates DMARCbis includes is the replacement of the Public Suffix List (PSL) with a DNS Tree Walk algorithm. The algorithm queries successive levels of the domain hierarchy, moving up one label at a time, until it finds a record with psd=y (public suffix domain) or psd=n (organizational boundary).

Important technical details:

• The walk is limited to a maximum of eight levels to prevent excessive DNS queries
• If a domain has eight or more labels, it removes the leftmost labels until only seven remain before starting the walk
• The walk stops when it finds a valid DMARC record with an explicit psd value

This DNS-native approach:

• Eliminates reliance on third-party lists
• Enhances the likelihood of uniform updates
• Improves the accuracy and reliability of boundary detection

Transition consideration: During the transition period, some implementations may still use the PSL while others use Tree Walk, potentially leading to different domain determinations. Companies should consider using strict alignment and publishing explicit DMARC records for all domains to avoid interoperability issues.

Managing this manually can be complex, but a purpose-built platform like Sendmarc can simplify the process.

New tags (psd, np, t)

DMARCbis introduces new policy tags to give businesses finer control. These are:

• psd: Explicitly marks public suffix domains
  • y indicates the domain is a public suffix domain
  • n indicates the domain is the organizational domain
  • u is the default, letting Tree Walk determine the organizational domain
• np: Defines policies for non-existent subdomains, preventing spoofing attacks using fake names like ceo.example.com
• t: Replaces the legacy pct tag with a clearer “testing mode” signal
  • y indicates testing mode (policy shouldn’t be enforced)
  • n is the default (apply the published policy)

Removed tags (pct, rf, ri)

A few legacy tags have been deprecated because they caused inconsistency:

• pct (percentage)
• rf (report format)
• ri (report interval)

The new t tag provides a simpler testing signal, while reporting formats and intervals are now standardized.

Enhanced reporting

Aggregate and forensic reporting are now defined in dedicated drafts, with aggregate reporting adopting stricter requirements to improve consistency and security. Updates include:

• Mandatory external URI validation for reports sent outside the domain
• Standardized formatting and filenames for attachments
• Stricter enforcement of XML and gzip

Important guidance on mailing lists

DMARCbis introduces important guidance regarding mailing lists and email forwarding. The specification now discourages using a p=reject policy when there’s a possibility that mailing lists are involved in your company’s email flows. This is because mailing lists often break both SPF and DKIM alignment, potentially causing legitimate emails to be rejected and automatically unsubscribing users from mailing lists.

Businesses should carefully consider their email ecosystem before implementing strict rejection policies. That said, Sendmarc strongly encourages domain owners to work toward a p=reject policy wherever possible, because it’s the only way to guarantee full protection against unauthorized use of your domain.