The promise of the np tag

RFC 9989, published in May 2026, added a fourth DMARC tag – np – to let domain owners dictate a separate policy for non‑existent subdomains [1]. In practice a record such as:

v=DMARC1; p=none; sp=quarantine; np=reject;

means mail from a subdomain that does not exist should be rejected, while legitimate subdomains follow the sp policy.

How DMARC decides non‑existence

DMARC follows the classic DNS definition: a name is non‑existent only when the resolver returns an NXDOMAIN response code [1]. An NXDOMAIN indicates that the queried name and any possible sub‑names have no records at all. By contrast, a NOERROR/NODATA reply (empty answer but existing name) is treated as “the domain exists but the requested record type is missing”.

DNSSEC changes the answer shape

When DNSSEC is enabled, an empty answer cannot be signed, so the protocol uses NSEC/NSEC3 records to prove non‑existence [2]. Traditional deployments return NXDOMAIN with signed NSEC records. To reduce response size, many large providers (Cloudflare, NS1, AWS Route 53, Azure) adopted a compact denial technique: they respond with NOERROR and a single NSEC record that includes a synthetic “next name”. This approach, first described by Cloudflare as “black lies”, removes the NXDOMAIN flag entirely [2][3].

The RFC 9824 fix and its adoption gaps

RFC 9824 (Sept 2025) formalised compact denial and introduced the NXNAME pseudo‑type in the NSEC bit‑map to signal that a name truly does not exist, plus an optional CO (Compact Answer OK) EDNS flag that lets resolvers restore the NXDOMAIN response code [3]. The specification notes that if a resolver does not understand NXNAME or the CO flag, clients must infer non‑existence from the NXNAME bit. In our June 2026 measurements, the major authoritative services listed above publish the compact NSEC record but do not set the NXNAME bit nor honor the CO flag; only Bunny DNS implements both [3].

Why the np tag breaks

Most DMARC implementations (OpenDMARC, Mail::DMARC, Rspamd, etc.) check the raw DNS response for NXDOMAIN to decide whether a subdomain is “non‑existent” [1]. When a DNSSEC‑secured domain is served by a compact‑denial provider, the resolver sees a NOERROR response with an NSEC record but no NXDOMAIN flag. Because the NXNAME bit is missing, the DMARC software concludes the subdomain exists and applies the sp or default policy, ignoring np. The result: malicious traffic sent to unused subdomains can slip past the intended reject rule.

Business impact

  • Deliverability risk – Organizations that rely on np=reject to harden their email perimeter may silently allow phishing or spoofed mail from attacker‑controlled subdomains.
  • Compliance exposure – Regulations that require documented anti‑phishing controls (e.g., NIST 800‑53, ISO 27001) could consider a non‑functioning np tag a control failure.
  • Operational cost – Detecting the gap requires DNSSEC‑aware testing, custom parsing of NSEC/NSEC3, and possibly deploying an alternative resolver that restores NXDOMAIN, adding engineering overhead.
  • Vendor lock‑in – Switching away from providers that use compact denial may involve re‑hosting DNS zones, re‑signing keys, and updating DNS‑SEC chain of trust.

Mitigation paths

  1. Explicit NXNAME handling – Extend DMARC parsers to read the NXNAME bit on NSEC/NSEC3 records and treat the name as non‑existent even when the response code is NOERROR. A short code snippet for this logic is