Resources
DMARC Is Now an Official Internet Standard (RFC 9989): Why p=none Still Won't Save You
Author :
MailMend Team
In May 2026, RFC 9989 replaced RFC 7489 and moved DMARC onto the IETF Standards Track, with reporting split into RFC 9990 and RFC 9991. Your existing record still works. What hasn't changed is what a p=none policy does: it monitors and reports, and takes no action against mail spoofing your domain. That spoofed mail can still damage your reputation, which is why an email blacklist check belongs in your routine.
Key takeaways
RFC 9989 is now the core DMARC specification, with RFC 9990 for aggregate reports and RFC 9991 for failure reports. Records still start with v=DMARC1.
A DMARC pass only shows the sending domain was validated. It says nothing about whether the mail is trustworthy.
p=none satisfies the bulk sender rules for having a DMARC record, but it doesn't stop spoofing.
An email blacklist check shows whether your domain or IP is listed. DMARC reports show who is sending as you.
What RFC 9989 actually changed
The update tidied up a decade of inconsistencies. The pct sampling tag is gone, replaced by a test-mode tag (t=). The way receivers find your organizational domain changed too: instead of relying on the Public Suffix List, they walk the DNS tree, and new tags give domain owners more precise control over that. For most ecommerce brands, none of this needs action today. Your v=DMARC1 record keeps working.
What didn't change is DMARC's purpose. A pass confirms the domain in the From line was validated through aligned SPF or DKIM. It doesn't mean the message is well-behaved or safe from being flagged.
Why p=none feels safe and isn't
Most brands start DMARC at p=none. It asks receiving servers to report on mail claiming to come from your domain without acting on failures. It's the recommended first step, and it meets Google and Yahoo's requirement to publish a DMARC record.
The problem is that p=none does exactly what it says. It doesn't block spoofed mail or stop anyone sending fraud in your name. It just reports. If someone spoofs your domain to send spam and those messages get flagged, your domain's reputation can suffer even though your own Klaviyo mail authenticates correctly.
That's one of the more overlooked reasons a legitimate brand ends up needing an email blacklist check. The domain gets flagged because of what someone else sent while pretending to be you.
How this connects to blacklisting
An email blacklist checker compares your domain and sending IP against databases of known spam sources, such as Spamhaus. A listing rarely comes from one bad email. It comes from a pattern: rising complaints, spam-trap hits, spoofed traffic or suspicious sending behavior.
p=none doesn't prevent any of that. It only gives you visibility, and only if someone reads the reports. Most brands set DMARC up once and never open the aggregate reports again, so the one thing p=none offers goes unused.
A MailMend on/off A/B test inside Klaviyo. Authentication and blacklists decide acceptance; placement is tested separately.
Running an email blacklist check
If your Klaviyo results have dropped suddenly, an email blacklist check should be an early step, not a last resort. Free tools scan your domain and IP against dozens of lists at once. Keep a few things in mind:
Lists aren't equal. Some are used heavily by major mailbox providers. Others have little real-world effect.
Listings can be temporary. Some clear automatically once behavior improves. Others need a delisting request.
IP and domain listings are different. On a shared sending IP, another sender's behavior can get the IP listed while your domain is clean.
Moving beyond p=none
Brands serious about protecting their domain move to p=quarantine and then p=reject, which tell receivers to act on mail that fails. Do it in stages. Read your aggregate reports, authenticate every legitimate service sending as you, then tighten the policy. Under RFC 9989 you can use the test-mode tag while you move to a stricter policy. Rushing can block your own mail.
Where MailMend fits
DMARC enforcement and a clean email blacklist check help your mail get accepted. After that, Gmail still decides between Primary and Promotions, and that's the decision MailMend works on. It's built for Klaviyo and designed to improve how often your campaigns and flows land in Primary, with no changes to your copy or your list, measured in a native Klaviyo A/B test, MailMend on versus off. Book a demo; the free trial starts after your first A/B test.
Frequently asked questions
Do I need to change my DMARC record because of RFC 9989?
Not urgently. Existing records keep working. If you use pct, plan to move to the new test-mode tag when you next update the record.
Does p=none meet Gmail and Yahoo's requirements?
Yes, the bulk sender rules require a DMARC record and accept p=none. It just doesn't protect your domain from spoofing.
How often should I run an email blacklist check?
Whenever results drop suddenly and stay down, after any spike in complaints or bounces, and as a routine check every month or so.
