What does the DMARC np= tag do?

DMARC `np=` Tag: Non-existent Subdomain Policy (np)

The DMARC np tag (RFC 9989) sets the policy for mail from subdomains that do not exist in DNS (NXDOMAIN). Closes a spoofing loophole for random non-existent subdomains.

Published May 10, 2026 · Last verified August 7, 2026 · Maintained by TamingDNS

Importance
Optional

Tag
np=

Default
Inherits from sp= or p=

Example
np=reject

✅ Valid Values

none No action for non-existent subdomains.

quarantine Quarantine mail from non-existent subdomains.

reject Reject mail from non-existent subdomains.

💬 What This Tag Does

Added in RFC 9989 (DMARCbis), the "np" tag specifies the policy for emails from subdomains that don't exist in DNS at all. Before DMARCbis, attackers could spoof addresses like random123.example.com, a subdomain with no DNS records, and potentially slip past subdomain policy checks. Setting np=reject blocks this loophole specifically for non-existent subdomains without affecting your real subdomains.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Each goes in a TXT record at _dmarc.yourdomain.com. Check yours with the DMARC Checker or assemble one in the DMARC Builder.

v=DMARC1;p=reject;sp=none;np=reject;adkim=s;aspf=s;fo=1;rua=mailto:dmarc-rua@dmarc.service.gov.uk

The record gov.uk publishes. Real subdomains are left open, invented ones are refused, and both alignment modes are strict.

v=DMARC1; p=none; np=reject; rua=mailto:dmarc-feedback@example.com

Worth publishing early. Nothing you send is affected while you are still monitoring, and names that do not exist cannot be legitimate senders anyway.

v=DMARC1; p=reject; sp=none; np=reject; rua=mailto:dmarc-feedback@example.com

Here all three policies do different jobs: the apex rejects, existing subdomains are exempt, and non-existent ones are still shut.

v=DMARC1; p=reject; sp=none; rua=mailto:dmarc-feedback@example.com

The gap "np" was added to close. With no "np" tag the sp policy applies to non-existent subdomains too, so this record leaves invented names on p=none.