Mark the old reference as obsolete

RFC 9989 and the reporting documents RFC 9990 and RFC 9991 obsolete RFC 7489. RFC 9989 also obsoletes the experimental public-suffix extension RFC 9091. Keep old documents for migration context, but do not present their syntax and algorithms as the current protocol without qualification.

Search policies, code, tests, runbooks, and articles for explicit RFC numbers and DMARC tags. Record whether each item describes a protocol requirement, a receiver’s deployed behavior, or historic advice.

Update the tag model

RFC 9989 added active tags np, psd, and t. It made pct, rf, and ri historic. In particular, intermediate pct rollout was removed after inconsistent implementation; do not promise percentage enforcement. RFC 9989 also removed maximum report size suffixes from reporting URIs.

Do not mechanically replace pct=0 with t=y. The current testing tag has defined semantics and receiver deployment considerations that require a policy review. Rebuild the rollout plan around sender inventory, scoped domains, evidence, and rollback.

Update discovery and reporting

Current DMARC uses a bounded DNS tree walk for policy and organizational-domain discovery, including public-suffix behavior, rather than relying only on the older public suffix list process. sp and np distinguish existing and non-existent subdomain policy when applicable.

Aggregate report format and delivery now live in RFC 9990, including the 2.0 XML namespace and current external-destination authorization. Failure reporting lives in RFC 9991 and can contain more sensitive message data; assess privacy and actual receiver support before requesting it.

Test compatibility, do not assume it

Build fixtures for current records and reports, and retain labeled legacy report support if production receivers still send it. Test policy discovery across representative receivers with authorized messages. Where a receiver behaves according to older rules, document that observation and date instead of redefining the standard around it.

Publish the migration note

For every changed record or procedure, record old interpretation, current rule, deployed-system evidence, owner, and rollback. Update source links and review dates. A standards update is complete when operators can tell current protocol, legacy compatibility, and provider policy apart—without silently breaking existing report ingestion or mail flows.