What is the DMARC np tag and how do you use it?

The DMARC np tag sets the policy receivers apply to mail from non-existent subdomains — subdomains that return NXDOMAIN in DNS because they were never created. Setting np=reject tells receiving servers to reject any message claiming to come from a made-up subdomain like billing.yourdomain.com that has no DNS records of its own. It was introduced in DMARCbis and closes a spoofing route that the older p and sp tags left open. For non-existent subdomains, np takes priority over both.

At a glance

Quick takeaways

• np sets the DMARC policy for non-existent subdomains — names that return NXDOMAIN because they have no DNS records.
• It accepts the same three values as p: none, quarantine, or reject.
• np was added in DMARCbis (RFC 9989); it did not exist in the original DMARC spec.
• For a non-existent subdomain, receivers use np first, then fall back to sp, then to p.
• np=reject blocks a common phishing trick: inventing plausible subdomains you never set up.

What is the np tag?

np stands for "non-existent subdomain policy." It lives in your organizational domain's DMARC record — the one published at _dmarc.yourdomain.com — and it applies only to subdomains that do not exist in DNS. A subdomain is "non-existent" when a lookup for it returns NXDOMAIN: no A, AAAA, MX, or any other records. In practice that means a name nobody ever created, such as payroll.yourdomain.com or invoices.yourdomain.com, when you have never published a single record for it.

This closes a real gap. Attackers like inventing subdomains that sound official, because a made-up name can slip past a policy tuned only for the subdomains you actually use. Before np, a message From billing.yourdomain.com was evaluated under your subdomain policy (sp) or, if that was absent, your top-level policy (p) — and if either sat at none, the spoof was delivered. With np=reject, mail from any non-existent subdomain is refused outright, regardless of what your other policies say. It is one of the highest-value single edits you can make to a modern DMARC record.

How is np different from p and sp?

All three tags carry the same values — none, quarantine, reject — but they govern different sets of mail:

• p (policy) applies to the organizational domain itself: yourdomain.com.
• sp (subdomain policy) applies to subdomains that do exist — ones with their own DNS records — when they lack their own DMARC record.
• np (non-existent subdomain policy) applies only to subdomains that return NXDOMAIN.

The distinction between sp and np is the one that trips people up. sp governs subdomains you use but have not given a dedicated policy; np governs subdomains that were never created at all. Receivers resolve the order like this: for a non-existent subdomain, they use np if present, otherwise sp, otherwise p. So np is the most specific instruction for that case and wins when you set it. For a deeper look at how the existing subdomain tags behave, see how subdomains inherit DMARC policy.

How do you add the np tag to your DMARC record?

You add np to the single DMARC record on your organizational domain — you do not publish anything on the non-existent subdomains themselves (by definition, they have no records). A fully locked-down record looks like this:

Source: Palisade, example values only.

The steps:

1. Open your current DMARC record. Look up the TXT record at _dmarc.yourdomain.com with a DNS lookup tool or your DNS host's dashboard.
2. Confirm you are already at enforcement. np is most useful alongside p=reject (or at least quarantine). If you are still at p=none, move your main policy to enforcement first — see what DMARC is for the progression.
3. Add the np tag. Append np=reject; to the existing record. Order does not matter, but v=DMARC1 must stay first. A complete record reads:

v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc@yourdomain.com

1. Publish and verify. Save the TXT record, wait for DNS to propagate, then re-check it with the DMARC checker to confirm it parses cleanly. A DMARC generator can build the full record if you are editing by hand.

Because DMARC allows only one record per domain, you edit the existing TXT rather than adding a second one — two DMARC records on the same name is an error that invalidates both.

When should you use np=reject?

Reach for np=reject once your organizational domain is already at enforcement and you have confirmed your legitimate mail passes. It is the natural companion to p=reject; sp=reject: it extends the same strict stance to the infinite set of subdomains you never created, without you having to enumerate them. Because made-up subdomains are a favorite phishing and lookalike tactic, pairing np=reject with an enforced policy shuts that route with a single tag.

The one thing to check first is that every subdomain you actually send from has real DNS records. A sending subdomain with no DNS presence can be treated as non-existent — so give each one at least a minimal record before you turn np to reject.

Common issues with the np tag

I added np=reject and legitimate mail started failing

That usually means the mail came from a subdomain you do use but never gave DNS records to. np only applies to subdomains that return NXDOMAIN, so a real sending subdomain with no records of its own gets treated as non-existent. Create at least a minimal DNS presence — an SPF record and the relevant MX or sending records — for any subdomain you send from, then confirm it resolves with a DNS lookup.

My receiver seems to ignore the np tag

np is a DMARCbis addition, and support is still rolling out across receivers. A mailbox provider that has not implemented DMARCbis falls back to your sp (or p) policy for non-existent subdomains. This is why you set sp as well: it is the safety net for receivers that do not yet honor np. Keeping both means you are covered either way.

Do I put the np tag on the subdomain's own record?

No — there is no record to put it on, because the subdomain does not exist. np belongs only in the organizational domain's DMARC record at _dmarc.yourdomain.com. Receivers read it from there when they evaluate mail from a non-existent child of that domain.

np, sp, and p all conflict — which one wins?

For a non-existent subdomain, np wins if it is present. If you omit np, the receiver falls back to sp; if sp is also missing, it uses p. There is no conflict to resolve — the order is fixed and deterministic. Set np explicitly when you want the strictest handling for made-up subdomains.

Related reading

• What is DMARCbis? DMARC's new RFC 9989 standard
• How do subdomains inherit DMARC policy?
• What does DMARC stand for? DMARC meaning in plain English