DMARC report URI size limits changed in 2026: the old !10m-style maximum is no longer part of RFC 9989

Start with the mechanism, not the score

RFC 9989’s change summary states that the ability to specify a maximum report size in the DMARC URI was removed. RFC 9990 instead defines aggregate-report packaging, recommends GZIP compression, and discusses transport-size constraints.

Legacy DMARC examples may show a size limit appended to a report URI with an exclamation suffix. RFC 9989 removed that URI size-limit syntax, so current record generators should not teach it as an active mechanism. This is separate from whether a reporting receiver can practically send or accept large aggregate reports; RFC 9990 defines aggregate reporting behavior and transport considerations. For an operator, the key action is to distinguish an old record artifact from a present-day control. A syntactically familiar value copied from an older blog can survive in DNS for years even after the underlying specification has moved on.

Where operators commonly misclassify the result

The exclamation-mark size suffix can survive in copied DNS snippets for years, creating the impression that it remains a current standardized capability simply because old parsers recognize the syntax.

Do not respond to a large-report problem by inventing new `!10m`-style values or assuming receivers will honor an old suffix. That can create a record nobody on the team can explain and a false sense of capacity control. Also avoid changing the `rua` destination and enforcement policy in the same edit. If reports are too large for your processor, the bottleneck may be mailbox limits, decompression, XML parsing, storage, or a reporting vendor’s ingestion cap. The DMARC policy record should identify where reports go; your reporting pipeline should be engineered to handle what it receives.

How to reproduce it without adding volume

Search DNS templates, infrastructure code, documentation and live _dmarc records for report URIs containing a size suffix. Compare each example against the current RFC rather than an archived RFC 7489 tutorial.

Inspect the exact DMARC TXT record and flag any report URI containing the retired size notation. Then validate the base `mailto:` destination, including external reporting authorization when reports are sent outside the policy domain. On the receiver side of your reporting pipeline, measure compressed and uncompressed sizes, parse failures, and duplicate-report behavior. Test with representative files rather than a tiny sample. This separates obsolete DNS syntax from an actual ingestion problem and gives you a change that can be verified without touching message authentication or disposition.

A narrow remediation path

Publish a clean rua mailto URI, ensure external destination authorization exists when the report goes to another organizational domain, and make the receiving mailbox or processor capable of handling compressed XML.

Clean up the record using current RFC 9989 syntax and move capacity controls into the reporting system. Keep enough storage and parser limits for realistic aggregate files, support compressed input where your tooling does, and alert on parse failures instead of silently dropping oversized data. If a third-party DMARC service still documents the old suffix, ask how it handles current RFCs before copying its template. Record the cleanup as a standards-version update so future maintainers understand why the old notation disappeared rather than reintroducing it from an archived tutorial.

What this looks like in a small stack

Instead of rua=mailto:dmarc@example.com!10m, a current record can simply identify the report destination. The report generator decides packaging and may compress the XML so the message is more likely to fit transport limits.

If an old DMARC record contains the removed suffix, clean it as a standards-debt item and update any templates that can recreate it. Search infrastructure-as-code repositories, DNS setup docs, and customer onboarding snippets, not just the live record. Otherwise the obsolete syntax can reappear the next time someone “restores” DNS from an old example. For the receiving mailbox or report service, test decompression and XML parsing limits separately. Aggregate data can contain many source rows, so a tiny parser memory limit is an application problem rather than something the policy record should try to solve. Keep failed report samples when safe so parser fixes can be regression-tested. This produces a cleaner boundary: DMARC DNS publishes current policy/report destinations; the reporting service owns transport, size, deduplication, storage, and analytics.

Evidence worth saving for the next incident

Keep the final DMARC record, external-authorization record if used, receiving mailbox limit, parser behavior for xml and xml.gz, and a sample accepted report from multiple generators.

When to stop changing things

Do not confuse report attachment size with DMARC policy enforcement. Reporting can fail or be delayed while message authentication and policy evaluation still operate normally.

Field checklist

• Capture the raw evidence for DMARC rua maximum report size suffix removed RFC 9989 before editing DNS, queue state, or mailbox metadata.
• Confirm the cited mechanism using dmarc-rfc, dmarc-aggregate rather than a generic deliverability score.
• Keep a known-good control case so the failing layer can be compared without changing several variables at once.
• Apply the narrow repair described for DMARC report URI size limits changed in 2026: the old !10m-style maximum is no longer part of RFC 9989 and preserve a rollback or retry path.
• Repeat the original failing test after the change; do not substitute a different checker as proof of recovery.
• Store timestamp, affected identity, raw result, action taken, and the post-change result in the operator log.