# What is the DMARC np tag and how do you use it?

> The DMARC np tag sets a policy for non-existent subdomains. Use np=reject to block spoofed mail from subdomains you never created. Syntax and setup here.

The DMARC `np` tag sets the policy receivers apply to mail from **non-existent subdomains** — subdomains that return NXDOMAIN in DNS because they were never created. Setting `np=reject` tells receiving servers to reject any message claiming to come from a made-up subdomain like `billing.yourdomain.com` that has no DNS records of its own. It was introduced in DMARCbis and closes a spoofing route that the older `p` and `sp` tags left open. For non-existent subdomains, `np` takes priority over both.

## Quick takeaways

- `np` sets the DMARC policy for **non-existent subdomains** — names that return NXDOMAIN because they have no DNS records.
- It accepts the same three values as `p`: `none`, `quarantine`, or `reject`.
- `np` was added in [DMARCbis (RFC 9989)](/learning/what-is-dmarcbis-rfc-9989-dmarc-standard); it did not exist in the original DMARC spec.
- For a non-existent subdomain, receivers use `np` first, then fall back to `sp`, then to `p`.
- `np=reject` blocks a common phishing trick: inventing plausible subdomains you never set up.

## What is the np tag?

`np` stands for "non-existent subdomain policy." It lives in your organizational domain's DMARC record — the one published at `_dmarc.yourdomain.com` — and it applies only to subdomains that do not exist in DNS. A subdomain is "non-existent" when a lookup for it returns NXDOMAIN: no A, AAAA, MX, or any other records. In practice that means a name nobody ever created, such as `payroll.yourdomain.com` or `invoices.yourdomain.com`, when you have never published a single record for it.

This closes a real gap. Attackers like inventing subdomains that sound official, because a made-up name can slip past a policy tuned only for the subdomains you actually use. Before `np`, a message From `billing.yourdomain.com` was evaluated under your subdomain policy (`sp`) or, if that was absent, your top-level policy (`p`) — and if either sat at `none`, the spoof was delivered. With `np=reject`, mail from any non-existent subdomain is refused outright, regardless of what your other policies say. It is one of the highest-value single edits you can make to a modern DMARC record.

## How is np different from p and sp?

All three tags carry the same values — `none`, `quarantine`, `reject` — but they govern different sets of mail:

- **`p` (policy)** applies to the organizational domain itself: `yourdomain.com`.
- **`sp` (subdomain policy)** applies to subdomains that *do* exist — ones with their own DNS records — when they lack their own DMARC record.
- **`np` (non-existent subdomain policy)** applies only to subdomains that return NXDOMAIN.

The distinction between `sp` and `np` is the one that trips people up. `sp` governs subdomains you use but have not given a dedicated policy; `np` governs subdomains that were never created at all. Receivers resolve the order like this: for a non-existent subdomain, they use `np` if present, otherwise `sp`, otherwise `p`. So `np` is the most specific instruction for that case and wins when you set it. For a deeper look at how the existing subdomain tags behave, see [how subdomains inherit DMARC policy](/learning/dmarc-policy-for-subdomains).

## How do you add the np tag to your DMARC record?

You add `np` to the single DMARC record on your organizational domain — you do not publish anything on the non-existent subdomains themselves (by definition, they have no records). A fully locked-down record looks like this:

![DMARC TXT record with an np=reject tag published at _dmarc.example.com](/images/figures/dmarc-np-tag-records.webp)

*Source: Palisade, example values only.*

The steps:

1. **Open your current DMARC record.** Look up the TXT record at `_dmarc.yourdomain.com` with a [DNS lookup tool](/tools/dns-lookup) or your DNS host's dashboard.
2. **Confirm you are already at enforcement.** `np` is most useful alongside `p=reject` (or at least `quarantine`). If you are still at `p=none`, move your main policy to enforcement first — see [what DMARC is](/learning/what-is-dmarc) for the progression.
3. **Add the `np` tag.** Append `np=reject;` to the existing record. Order does not matter, but `v=DMARC1` must stay first. A complete record reads:
   `v=DMARC1; p=reject; sp=reject; np=reject; rua=mailto:dmarc@yourdomain.com`
4. **Publish and verify.** Save the TXT record, wait for DNS to propagate, then re-check it with the [DMARC checker](/tools/dmarc) to confirm it parses cleanly. A [DMARC generator](/tools/dmarc-generator) can build the full record if you are editing by hand.

Because DMARC allows only one record per domain, you edit the existing TXT rather than adding a second one — two DMARC records on the same name is an error that invalidates both.

## When should you use np=reject?

Reach for `np=reject` once your organizational domain is already at enforcement and you have confirmed your legitimate mail passes. It is the natural companion to `p=reject; sp=reject`: it extends the same strict stance to the infinite set of subdomains you never created, without you having to enumerate them. Because made-up subdomains are a favorite [phishing](/learning/does-dmarc-stop-phishing) and [lookalike](/learning/how-do-lookalike-domains-bypass-dmarc) tactic, pairing `np=reject` with an enforced policy shuts that route with a single tag.

The one thing to check first is that every subdomain you *actually send from* has real DNS records. A sending subdomain with no DNS presence can be treated as non-existent — so give each one at least a minimal record before you turn `np` to reject.

## Common issues with the np tag

### I added np=reject and legitimate mail started failing

That usually means the mail came from a subdomain you *do* use but never gave DNS records to. `np` only applies to subdomains that return NXDOMAIN, so a real sending subdomain with no records of its own gets treated as non-existent. Create at least a minimal DNS presence — an SPF record and the relevant MX or sending records — for any subdomain you send from, then confirm it resolves with a [DNS lookup](/tools/dns-lookup).

### My receiver seems to ignore the np tag

`np` is a DMARCbis addition, and support is still rolling out across receivers. A mailbox provider that has not implemented DMARCbis falls back to your `sp` (or `p`) policy for non-existent subdomains. This is why you set `sp` as well: it is the safety net for receivers that do not yet honor `np`. Keeping both means you are covered either way.

### Do I put the np tag on the subdomain's own record?

No — there is no record to put it on, because the subdomain does not exist. `np` belongs only in the organizational domain's DMARC record at `_dmarc.yourdomain.com`. Receivers read it from there when they evaluate mail from a non-existent child of that domain.

### np, sp, and p all conflict — which one wins?

For a non-existent subdomain, `np` wins if it is present. If you omit `np`, the receiver falls back to `sp`; if `sp` is also missing, it uses `p`. There is no conflict to resolve — the order is fixed and deterministic. Set `np` explicitly when you want the strictest handling for made-up subdomains.

## Frequently asked questions

### Is the np tag required?

No. `np` is optional, and a DMARC record without it is still valid. But if your domain is already at enforcement, adding `np=reject` is a low-risk, high-value edit that closes the non-existent-subdomain spoofing gap.

### Does np replace the sp tag?

No. Keep both. `sp` covers subdomains that exist but lack their own policy; `np` covers subdomains that were never created. They govern different mail, and `sp` also acts as the fallback for receivers that have not yet implemented `np`.

### What values can np take?

The same three as `p` and `sp`: `none` (monitor only), `quarantine`, and `reject`. For a domain at enforcement, `np=reject` is the usual choice.

### Will np affect my existing subdomains?

No. `np` only applies to subdomains that return NXDOMAIN. Any subdomain with real DNS records is governed by its own DMARC policy or by `sp`, never by `np`.

## Related reading

- [What is DMARCbis? DMARC's new RFC 9989 standard](/learning/what-is-dmarcbis-rfc-9989-dmarc-standard)
- [How do subdomains inherit DMARC policy?](/learning/dmarc-policy-for-subdomains)
- [What does DMARC stand for? DMARC meaning in plain English](/learning/what-does-dmarc-stand-for)