DMARCbis Adoption Data (DMARC2)

t=y
Testing Mode

Setting t=y indicates that a domain is in "testing mode." This new tag replaces the pct= tag from the original DMARC specification, providing a clearer way to signal testing intent. When t=y is set, Mail Receivers are encouraged to treat the policy as less strict. Specifically:

• A policy of p=reject with t=y (former pct=0) may be treated as p=quarantine
• A policy of p=quarantine with t=y (former pct=0) may be treated as p=none

This approach allows domain owners to monitor the impact of stricter policies without immediately enforcing them, thereby reducing the risk of legitimate email being rejected during the testing phase.

Example:

v=DMARC1; p=reject; rua=mailto:[your-domain.com]@rua.dmarcdkim.io; t=y

psd=y
Public Suffix Domain Policy

The psd=y tag allows a Public Suffix Domain (PSD) like gov.uk or bank to publish a DMARC policy that applies to all domains beneath it, even if those subdomains haven't explicitly set DMARC records.

This is particularly helpful in environments where:

• Security policy needs to be enforced at a registry or sector level.
• Many subdomains are registered or operated independently (e.g., by municipalities or banks).
• Centralized governance of domain security is required.

Example (published at the PSD level):

_dmarc.bank. IN TXT "v=DMARC1; p=quarantine; psd=y"

np=reject
Subdomain Policy for Non-Existent Domains

The np= tag specifies a DMARC policy for subdomains that do not exist (NXDOMAIN), but may still be spoofed.

This closes a loophole where attackers could forge emails from random.nonexistent.company.com to bypass the main DMARC policy of company.com

Example:

v=DMARC1; p=reject; np=reject; rua=mailto:[your-domain.com]@rua.dmarcdkim.io

With this configuration:

• Legitimate mail from company.com must pass DMARC checks.
• Any forged email from a non-existent subdomain like secure-login.company.com will be rejected.