Topic starter
27/10/2026 7:13 pm
TL;DR: RFC 9989 adds an np= DMARC policy for nonexistent subdomains, giving domain owners a way to reject spoofed mail that claims to come from invented addresses under their brand, according to Valimail. The change does not replace SPF, DKIM or DMARC enforcement, but it removes ambiguity and tightens receiver guidance for email impersonation.
Editorial analysis by NHI Mgmt Group, based on content published by Valimail: “What the new DMARC np= tag means for email security”.
Key questions
Q: How should security teams handle nonexistent subdomains in DMARC policy?
A: Treat nonexistent subdomains as part of your email identity surface, not as a harmless edge case.
Q: Why do invented subdomain sender names increase phishing risk?
A: Because the visible From address can look legitimate even when the subdomain does not exist in DNS.
Q: What are the signs that DMARC policy is still ambiguous?
A: Ambiguity shows up when existing subdomains and nonexistent subdomains are handled the same way, when receiver behaviour varies widely, or when your organisation has no published rule for invented sender identities.
Practitioner guidance
- Define explicit policy for nonexistent subdomains Review your subdomain namespace and decide whether invented sender names under your brand should be rejected, quarantined or ignored by receiver policy.
- Align p=, sp= and np= settings Make sure your organisational domain policy, existing subdomain policy and nonexistent subdomain policy tell a consistent story to mailbox providers.
- Test receiver behaviour before assuming enforcement Validate how your major mailbox partners handle np= and whether their filtering or rejection behaviour matches your published intent.
Bottom line: DMARC’s new np= tag addresses a real policy gap around nonexistent subdomains, which attackers can exploit for brand impersonation.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →