auth.dmarc.deprecated_tag

Deprecated DMARC Tags

What we check

We check the DMARC record for tags that RFC 9989 (DMARCbis) removed from DMARC: pct, ri, and rf. They are harmless, but ineffective at spec-current receivers — so while they remain in the record, old and new receivers behave differently.

What this finding means

Your DMARC record contains one or more tags that the updated specification no longer defines:

pct — percentage of failing mail the policy applies to. DMARCbis removes it; current receivers apply the policy in full regardless, older ones still honour it. (If pct is below 100 this also raises the separate "policy not fully enforced" finding.)
ri — the requested aggregate-report interval. Receivers already send reports roughly daily; the tag has no reliable effect.
rf — the failure-report format. Effectively unused now that forensic (ruf) reporting is rarely delivered.

None of these break DMARC. They're residue from older guidance, and they cause inconsistent behaviour only because some receivers still read them while spec-current ones ignore them.

Why it matters

Inconsistent enforcement. The pct tag in particular means spec-current and legacy receivers apply your policy differently — you can't predict which behaviour a given receiver uses.
Clutter and confusion. Deprecated tags make the record harder to read and can mislead anyone auditing it into thinking they still do something.
Not a security hole. This is a hygiene finding — removing the tags aligns your record with the current spec without changing protection at compliant receivers.

How to fix

Remove pct, ri, and rf from the record. In particular, don't rely on pct for staged rollouts — move p=none → quarantine → reject instead:
```
_dmarc.example.com.  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
```

How it's graded

Deprecated DMARC tags are informational and carry no point deduction on their own. (A pct below 100 is scored separately through the policy-enforcement baseline.) See Grading Methodology for the full scoring model.

Evidence example

$ dig +short TXT _dmarc.example.com
"v=DMARC1; p=reject; pct=100; ri=86400; rua=mailto:dmarc-reports@example.com"
                    ^^^^^^^^  ^^^^^^^^ removed from DMARC by RFC 9989 (DMARCbis)