Why DMARC's new "np" tag can fail with DNSSEC
Summary
The article analyzes DMARC RFC 9989's new np tag and its incompatibility with DNSSEC (RFC 9824). It explains how DNSSEC denial-of-existence mechanisms can cause np to misbehave, surveys real-world adoption among major providers and open-source DMARC implementations, and concludes that np may not be reliably applied until broader NXDOMAIN restoration support exists.