Why DMARC's new "NP" tag can fail with DNSSEC

The internet’s email gatekeepers just rolled out a new rule meant to crack down on fake messages from made-up subdomains — think bogus addresses pretending to come from unused corners of a company’s website. In theory, the new np setting in the latest DMARC standard should let site owners say, “If this subdomain doesn’t exist, reject the mail.” In practice? The comments section basically turned into a digital food fight over why it can quietly fail when paired with DNSSEC, the security system meant to make website address lookups more trustworthy.

The spiciest reaction came from readers arguing this is less a DNSSEC disaster and more a provider shortcut scandal. One commenter accused major DNS companies of giving the “wrong” kind of answer on purpose because it’s smaller, faster, and avoids extra hassle — which, if true, makes this feel less like a bug and more like a convenience-driven plot twist. Others took aim at the new rule itself, saying the whole idea is weirdly designed: if a subdomain clearly exists for a website, why should email treat it like a ghost town just because it lacks mail records?

And then came the dry humor. Some readers basically shrugged and said many mail servers already distrust domains that can’t receive mail, so this new feature feels like a fix for a corner case in search of a bigger audience. Translation: important standard, messy reality, and the crowd is not impressed. The mood is very much “how did the experts ship this?” with a side of “classic internet standards drama, no notes.”