[dmarc-ietf] Re: Compatibility of "np" tag with RFC 9824 (Compact Denial of Existence in DNSSEC)

["John R. Levine" <[e-mail]>]

Please see my response to your erratum.

RFC 9824 section 5 explains how resolvers recover the correct NXDOMAIN 
response so they don't break every application that expects NXDOMAIN to 
work.  We debated this at great length while writing the RFC.

R's,
John


On Tue, 9 Jun 2026, Matteo Contrini wrote:

> Hi all,
>
> in RFC 9989, a domain is determined to be non-existent if the response code 
> for the DNS query is NXDOMAIN. This definition is used in the "np" tag 
> (non-existent subdomain policy).
>
> However, authoritative name servers doing DNSSEC online signing often use the 
> so-called "NSEC Black Lies" method, now known as RFC 9824 - Compact Denial of 
> Existence in DNSSEC, to authenticate non-existent domain responses. Instead 
> of responding with NXDOMAIN and NSEC/NSEC3 records, they respond with NODATA, 
> an empty answer section, and a single NSEC record signaling the pseudo-record 
> type NXNAME.
>
> A DMARC implementation following RFC 9989 would therefore never see NXDOMAIN 
> and treat all domains using DNSSEC and Compact Denial of Existence as 
> existent, even if they're not. The issue appears to be potentially 
> significant since the NSEC Black Lies/Compact Denial of Existence method has 
> been used extensively in commercial DNS providers, such as Cloudflare (since 
> 2016), NS1 and Bunny DNS.
>
> My question is whether the new "np" tag is therefore to be considered 
> incompatible with RFC 9824 - Compact Denial of Existence in DNSSEC, or if I 
> missed something. I've looked at previous discussions in this mailing list 
> but couldn't find anything relevant. I could only find that RFC 9091, which 
> RFC 9989 obsoleted, had a broader non-existent definition which also included 
> NODATA.
>
> Best regards,
>
> --
> Matteo
>
>

Regards,
John Levine, [e-mail], Primary Perpetrator of "The Internet for Dummies",
Please consider the environment before reading this e-mail. https://jl.ly