This is a strange set of changes to me. Most of them seem to have little to no benefit. None of them seem worth the migration effort except for "policy for non-existent subdomains".

There are two changes I would like to see but that don't seem to be addressed.

1. Option to require DKIM, instead of the current SPF *or* DKIM. I can hold my key close and have less trusted forwarders (which is sometimes necessary for receivers who are very picky about source IP) without allowing them to send mail that I didn't pass to them. For example with AWS SES I can hold the key and let them deliver my mail. But with the current situation they can also corrupt or make up new mail and it is trusted because it passes SPF. If I could say that the message *must* have a DKIM signature then they can't do that.

2. Solving mailing lists. Right now I use p=reject so my participation on many mailing lists (including IETF ones) is basically prevented. Google Groups does sender rewriting when solves this in an ugly way, but it isn't common and it would be nice to have a standardized solution.

Why bother adding a successor to pct? It works fine, so what if people always use pct=0 or pct=100, that is fine. No need to add a new spelling and confuse everyone.

> what’s the “denominator” and how do you estimate it?

Roll a d100 and if it is <= pct then apply the policy to the message. I don't get what is confusing about this.