DMARC pct was removed in RFC 9989: how to stage policy changes in 2026

What changed in the current specification

RFC 9989, published in 2026, replaces the older DMARC base specification and explicitly removes the pct tag. The earlier mechanism attempted to let domain owners request enforcement for only a percentage of failing messages. Operational experience showed inconsistent handling across receivers, so percentage rollout is no longer part of the current core protocol. This matters for SEO content because many high-ranking tutorials still describe pct as a normal production control. A current guide should explain the new model instead of repeating advice that was reasonable under RFC 7489.

Unknown tags do not create a reliable rollout plan

DMARC records use a tag-value format and current receivers are instructed to ignore unknown tags. That means leaving pct=10 in a record is not a portable way to ask for ten-percent enforcement under RFC 9989. Some legacy tooling may still display or interpret it, which creates exactly the kind of mixed behavior the new specification sought to remove. For an operator, the safe assumption is that pct no longer controls enforcement. Design the rollout around controls that exist in the current standard and around your own ability to observe legitimate mail streams.

Start with visibility, not an imagined percentage

A practical small-sender rollout begins by ensuring SPF and DKIM are configured, publishing a valid DMARC record, and collecting aggregate reports through rua where useful. Under p=none, receivers still evaluate DMARC and reports can reveal which systems use the domain, which authentication path passes, and which third parties are misaligned. Before moving to quarantine or reject, map every legitimate sender. The purpose of the observation phase is not to wait an arbitrary number of days; it is to reduce unknown mail sources until enforcement will not surprise your own operations.

Use t= carefully if you are testing current DMARC policy

RFC 9989 introduces a t tag with a binary testing signal rather than percentage sampling. It does not recreate pct. The semantics are different, and receiver behavior should be read from the current specification before relying on it. For many small senders, the simpler path is still to keep p=none while inventory is incomplete, then move deliberately once legitimate traffic is aligned. Do not treat a testing tag as a substitute for reading aggregate evidence and sending controlled tests through every platform you actually use.

Subdomain policy can narrow the blast radius

If different mail streams use different subdomains, DMARC’s domain and subdomain policy structure can give you a cleaner staged path than percentage enforcement. For example, a dedicated outbound subdomain can publish its own record while the organizational domain maintains a different policy. The exact inheritance rules now include p, sp, and np in RFC 9989. This is not a reason to create subdomains just to dodge reputation history; it is a way to scope authentication policy to mail streams that already have distinct domain identities and operational owners.

Example migration from an old tutorial

Suppose the current record is v=DMARC1; p=none; rua=mailto:dmarc@example.com and an old checklist tells you to change it to p=quarantine; pct=10. In 2026, first remove pct from the plan. Review aggregate reports, confirm the mailbox provider and outbound platform both produce aligned pass, test any forms or aliases, and decide whether quarantine is appropriate for the whole policy domain or a narrower subdomain. Make one documented change, observe receiver results, then continue. The rollout is evidence-driven rather than percentage-driven.

Update documentation and automated validators

The hidden risk is not only the DNS record. Internal templates, infrastructure-as-code, DNS snippets, blog posts, and QA scripts may still expect pct. Search your repository for the tag and update references to the current specification. If a validator flags a record for lacking pct, the validator is outdated. Conversely, if a checker silently accepts pct, that does not prove receivers will apply it. Standards migration is a content-maintenance problem as much as a DNS problem, especially for a site that wants to remain trustworthy after 2026.

Treat RFC version as part of the source citation

When publishing DMARC guidance, name RFC 9989 and the 2026 publication context so readers can distinguish current behavior from archived tutorials. Aggregate reporting now has its own specification, RFC 9990, and failure reporting is in RFC 9991. Keeping these references explicit prevents a future editor from “correcting” the article back to RFC 7489 simply because that older number appears more often in search results. For a technical content site, freshness is part of accuracy.

Replace percentage rollouts with an evidence-based enforcement plan

RFC 9989 marks the old `pct` tag historic and explains why: operational experience showed that intermediate percentage values were not applied consistently. If an old playbook says `p=reject; pct=10`, do not assume one in ten failures will receive reject treatment under current DMARC. The replacement `t` tag preserves testing behavior related to the old `pct=0` use case, but it is not a new arbitrary sampling percentage. The safer migration is to collect aggregate evidence, inventory legitimate sources, fix alignment gaps, and then choose the policy you are willing to publish for the applicable domain scope.

For a small team, put the rollout decision in a dated worksheet. Record the number of known sending systems, which ones pass aligned DKIM or SPF, any unexplained sources in aggregate reports, and the subdomains that inherit policy. Before moving from monitoring to enforcement, test important transactional and person-to-person routes as well as outbound campaigns. If you need to limit risk, narrow the scope architecturally—for example by publishing an appropriate policy on a dedicated subdomain or by using `sp`/`np` according to the domain tree—rather than relying on a removed sampling knob. Also update internal validators so a historic `pct` tag is flagged instead of being copied indefinitely from pre-2026 tutorials.

Field checklist

• Remove pct from new DMARC rollout plans.
• Reference RFC 9989 rather than relying on RFC 7489-era tutorials.
• Inventory legitimate mail under p=none before stronger policy.
• Use reporting and scoped domain policy instead of assumed percentage enforcement.
• Search code and documentation for stale pct guidance.
• Retest every legitimate sender after each policy change.