What does my DMARC record tell receivers to do?

What RFC 9989 changed

• Receivers find the policy and the organizational domain with the DNS tree walk (§4.10) instead of the Public Suffix List.
• The pct= tag is gone (Appendix A.6). Its useful value, pct=0, became t=y: “testing, apply one level less”.
• New np= sets a policy for subdomains that don’t exist, a favourite of spoofers.
• New psd= lets registries mark public suffixes; domain owners can use psd=n to pin their organizational domain.
• A record with no valid p= but a valid rua= is treated as p=none, so reporting still works.

Start safely

Begin with p=none and a rua address you read. Watch the daily reports for a few weeks, fix any service that fails alignment, then step to p=quarantine with t=y, then quarantine, then reject.