What is DMARCbis and what does it change?

You set up DMARC, it works, and then you hear "DMARCbis is coming" and wonder if you have to tear it all down and start over. You don't.

DMARC (being revised as DMARCbis) is not a new protocol and not a replacement. DMARCbis is simply the updated version of the original DMARC spec, which is about a decade old now. Same DMARC. The update cleans up a few things that tripped people up once the standard met the real world.

Three practical things change, and that is genuinely the whole list:

• pct= goes away. The old percentage dial (apply my policy to only 25% of failing mail) created confusing, half-enforced results, and most serious senders stopped using it. It is being removed. (More in "What replaced pct in DMARC?")
• np= arrives. A new tag that sets a policy for subdomains that do not exist at all. Spoofers love inventing random subdomains like login.yourbrand.com that were never real. np= lets you slam that door.
• Finding your "organizational domain" changes under the hood. DMARC has to work out where your registrable domain ends (is it brand.co.uk or co.uk?). It used to rely on a hand-maintained file called the Public Suffix List. DMARCbis replaces that with a live DNS lookup called the "tree walk." You do not configure anything. It just gets more accurate.

Here is what does not change: your DMARC record, the three policies (p=none, p=quarantine, p=reject), SPF, DKIM, alignment, and your aggregate (rua) reports. If it works today, it keeps working.

One thing to keep in mind. The update is still being finalised, so this is not a "rewrite your DNS tonight" situation. Read up, get comfortable, and make the small changes when the receivers are ready for them.

Want to see what your current record actually says? Run it through our free DMARC checker, or if you would rather someone sanity-check it with you, the SOS hotline is free.