Why DMARC's new "NP" tag can fail with DNSSEC
A new DMARC specification update introduces an 'np' tag for non-existent subdomains, but it conflicts with existing DNSSEC standards. This incompatibility creates potential security gaps for organizations using DNSSEC with major providers.
Why it matters
Email security protocols are critical for preventing phishing; technical conflicts in these standards can leave enterprise networks vulnerable.
Matteo 18 min. read The recently updated DMARC specification, published as RFC 9989, introduces the new np tag. Its purpose is to specify the policy that receivers should apply when the sender domain is a non-existent subdomain of the domain where the DMARC record is published.
The article provides a technical analysis of an industry standard conflict without taking a political stance.
Get smarter about the news
Sign up free for a feed built around what you actually care about, Dive Deeper research on any story, and the full text of every article.
Create free accountAlready have an account? Sign in