Your DMARC Rollout Guide Still Teaches a Removed Tag

A Google Workspace page stamped "last updated 2026-09-10 UTC" still advises starting DMARC enforcement with v=DMARC1; p=quarantine; pct=5 to quarantine 5% of failing mail. However, the May 2026 DMARC standard removed the pct tag entirely. Here is how modern receivers handle DMARC records.

Google and Microsoft still teach a percentage rollout

Google's Recommended DMARC rollout uses v=DMARC1; p=quarantine; pct=5; rua=mailto:dmarc@example.com as its primary example, telling admins to start small and gradually increase the percentage. Google's Set up DMARC page similarly recommends pct to control the proportion of email affected by policy.

Microsoft Learn outlines a rollout stepping through pct=10, 25, 50, 75, and 100. Its documentation still points to RFC 7489—the specification obsoleted by RFC 9989.

None of these pages mentions the replacement tag: t=.

RFC 9989 marks the DMARC pct tag as historic

Published in May 2026, RFC 9989 is the standard introducing the new DMARC tree walk.

The standard also lists pct under "Tags Removed" in Appendix C.5.2. Its IANA registry entry marks the tag as historic, defined as deprecated and not expected in current implementations.

Section 4.7 leaves pct off the list of valid tags and defines no rules for processing it. Because an RFC 9989-compliant receiver has no instructions for pct=5, the record asks it to quarantine 100% of failing mail.

Receivers rarely applied pct= accurately

Appendix A.6 explains why the tag was removed:

RFC 9989, Appendix A.6: pct "was usually not accurately applied, unless the value specified was either 0 or 100 (the default), and the inaccuracies with other values varied widely from one implementation to another."

Microsoft's documentation contradicts itself on this point. Its message headers reference states that action=pct.quarantine means the system randomly skipped enforcement because pct was under 100%. Conversely, its DMARC setup page claims the exact same header value means the message was included in the sampled percentage.

12 South Korean domains still set pct below 100

In our 1 September survey of 9,934 .co.kr domains, 1,450 published a usable DMARC policy. Twelve set p=quarantine with pct between 5 and 90, the shape of a percentage rollout. None of the 1,450 domains published t=.

Stage enforcement with t=y

RFC 9989 stages enforcement using t=y:

• If p=quarantine and t=y, receivers apply a policy of none.
• If p=reject and t=y, receivers apply a policy of quarantine.

The t= tag does not alter report generation (rua). Appendix A.6 notes that y and n serve as modern equivalents to pct=0 and pct=100.

Older RFC 7489 receivers ignore unknown tags like t=y (§6.3) and evaluate pct=0 instead (§6.6.4):

RFC 7489, §6.6.4: "If the email is not subject to the "quarantine" policy (due to the "pct" tag), the Mail Receiver SHOULD apply local message classification as normal." […] "If the email is not subject to the "reject" policy (due to the "pct" tag), the Mail Receiver SHOULD treat the email as though the "quarantine" policy applies."

At receivers following either standard, combining these tags achieves the exact same result:

pct=0 instructs RFC 7489 receivers, while t=y instructs RFC 9989 receivers. Once fully deployed, both tags can be removed together.

Two limitations apply:

1. Undocumented pct=0 behavior: Google documents pct only as a whole number from 1 to 100, leaving Gmail's handling of pct=0 unspecified.
2. Unannounced t= support: Gmail, Microsoft 365, Yahoo, Naver, and Kakao have not confirmed whether they honor t=.

Recommended Rollout Steps

1. Test quarantine: Publish v=DMARC1; p=quarantine; pct=0; t=y. Retain your rua= address so reports continue flowing.
2. Enforce quarantine: Move to v=DMARC1; p=quarantine once authentication reports are clean. This quarantines all failing mail.
3. Test reject: Publish v=DMARC1; p=reject; pct=0; t=y. Failing mail is quarantined in the meantime.
4. Enforce reject: Finish with v=DMARC1; p=reject to reject all failing mail.

Did your own DMARC rollout step through a percentage, or go straight to full enforcement?

References

1. RFC Editor — RFC 9989: Domain-Based Message Authentication, Reporting, and Conformance (DMARC) (May 2026, IETF Standards Track)
2. RFC Editor — RFC 7489: Domain-based Message Authentication, Reporting, and Conformance (DMARC) (March 2015, Informational; obsoleted by RFC 9989)
3. Google Workspace — Recommended DMARC rollout (read 12 September 2026)
4. Google Workspace Admin Help — Set up DMARC (read 12 September 2026)
5. Microsoft Learn — Set up DMARC to validate email in Microsoft 365 (read 12 September 2026)
6. Microsoft Learn — Anti-spam message headers (read 12 September 2026)
7. Panke — Email spoofing: we tested 10,000+ Korean domains (1 September 2026; 9,934 .co.kr domains)