DMARC’s np tag breaks under DNSSEC, exposing subdomains to abuse
The new DMARC np tag, meant to enforce policy on non‑existent subdomains, collides with RFC 9824 DNSSEC's Compact Denial of Existence, causing receivers to ignore np when DNSSEC is enabled. This breaks intended subdomain protection for domains on Cloudflare, AWS, Azure, and other DNS providers, and the IETF has yet to resolve it.