The new DMARC "np" tag, designed to secure non-existent subdomains, often fails on domains using DNSSEC due to technical incompatibilities with the "Compact Denial of Existence" standard, RFC 9824.

Key Points

• RFC 9989 introduced the "np" tag to define policies for non-existent subdomains, but it relies on the traditional NXDOMAIN DNS response code.
• Many major DNS providers, including Cloudflare, AWS Route 53, and Azure, use "compact denial" (RFC 9824), which returns a NOERROR code instead of NXDOMAIN.
• Because most DMARC implementations strictly look for NXDOMAIN, they fail to recognize non-existent subdomains when compact denial is active.
• Optional mechanisms to restore the NXDOMAIN signal, such as the CO flag, currently lack widespread support among DNS resolvers and authoritative servers.
• Research indicates that nearly half of all DNSSEC-signed domains among the top one million websites utilize compact denial, leaving them vulnerable to this policy mismatch.

Why it Matters

This technical conflict prevents the "np" tag from reliably blocking malicious emails on unused subdomains for a significant portion of the internet. Domain owners should currently assume that the "np" policy will not function as intended until DMARC implementations or DNS providers achieve better cross-standard compatibility.