One record governs three populations: the domain itself, subdomains that exist, and subdomains that do not. p, sp and np address them in that order, and each inherits from the one before it when absent.
The inheritance
p applies to the domain itself sp applies to subdomains (absent -> takes p) np applies to NON-EXISTENT subs (absent -> takes sp)
So v=DMARC1; p=reject silently rejects for every subdomain and every name that has never existed. That is usually what you want and it is never what the record says, which matters when someone else reads it.
np, and why it exists
RFC 9091 added np for a specific abuse: an attacker sends as invoices.example.com, a name that has no DNS records at all. There is nothing to compromise and nothing to misconfigure — the name simply does not exist, so no legitimate mail can come from it, and enforcing hard costs nothing.
That lets you be strict where strictness is free while staying permissive where real mail lives. gov.uk does exactly this:
"v=DMARC1;p=reject;sp=none;np=reject;adkim=s;aspf=s;fo=1; rua=mailto:dmarc-rua@dmarc.service.gov.uk"
| Population | Policy | Why |
|---|---|---|
gov.uk itself | reject | Centrally operated, fully enumerated, safe to enforce. |
| Existing subdomains | none | Delegated to departments at wildly different stages of readiness. Enforcing would break them. |
| Non-existent subdomains | reject | Nothing legitimate can originate there, so enforcement has no victims. |
Read without np, that record looks like a domain that gave up on its subdomains. With it, it is a precise statement about who controls what.
The other direction
sp can also be stricter than p. GitHub and Apple both do this:
"v=DMARC1; p=quarantine; sp=reject; pct=100; rua=mailto:dmarc@github.com; ruf=mailto:dmarc@github.com; fo=1" "v=DMARC1; p=quarantine; sp=reject; rua=mailto:d@rua.agari.com; ruf=mailto:d@ruf.agari.com;"
The apex carries the mail whose sender inventory is hardest to complete, so it sits at quarantine. Subdomains are used for known, controlled streams, so they can be rejected outright. It is a rollout in progress, frozen at a sensible intermediate state.
sp is not inherited down more than one level
DMARC does not walk the tree. A receiver looks at the exact domain, and failing that, at the organisational domain — and nothing in between. a.b.c.example.com with no record of its own is governed by sp at example.com, not by anything at b.c.example.com. That is the subject of the next lesson and it surprises nearly everyone.