Most DMARC guides are written as if a company has one domain. Real companies have many names: a main domain for staff mail, news.example.com for newsletters, mail.example.com for transactional messages, support.example.com for the help desk, and dozens of old or unused hostnames that someone created and forgot. Each of these can appear in a From address, and attackers like subdomains because a record that protects the main domain may or may not protect them. The sp= tag exists to answer the question "what should happen to mail from my subdomains?", but it interacts with inheritance, alignment and separate subdomain records in ways that are easy to get wrong. This guide explains how receivers find the DMARC policy for a subdomain, what sp= does, when to publish a record on a subdomain, how alignment works for subdomains that send, and the plan we recommend for enforcing DMARC without breaking mail.
How receivers find the policy
When a message arrives with billing.example.com in the From header, the receiver first asks DNS for a TXT record at _dmarc.billing.example.com. If one exists, it applies that record. If none exists, the receiver determines the organisational domain, which is the registered domain under a public suffix (here, example.com), and looks for _dmarc.example.com. If that record exists, it applies it, and chooses which policy tag to use: if the From domain is a subdomain and the record has an sp= tag, the receiver uses sp=; otherwise it uses p=. This is the behaviour defined in RFC 7489. Newer work on the standard describes a "tree walk" that generalises this lookup, and it adds a tag for non-existent subdomains, so check the current status of the standard and the documentation of the receivers you care most about before relying on the newer details.
What p= and sp= do
The p= tag is the policy for the domain where the record is published. The sp= tag is the policy for its subdomains. A few examples show the combinations:
| Record on example.com | Policy for example.com | Policy for subdomains without their own record |
|---|---|---|
v=DMARC1; p=reject | reject | reject (inherited from p=) |
v=DMARC1; p=reject; sp=none | reject | none (monitor only) |
v=DMARC1; p=none; sp=reject | none | reject |
v=DMARC1; p=quarantine; sp=reject | quarantine | reject |
| No record on example.com | no policy | no policy |
Two behaviours are worth remembering. A subdomain inherits p= when sp= is absent, so an enforcing parent policy automatically applies to every subdomain that sends mail without its own record. That is a common cause of "my newsletter subdomain suddenly fails". And an sp=reject next to p=none is a valid and sometimes sensible combination: you keep the main domain in monitoring while shutting down spoofing on subdomains that never send.
When to publish a record on a subdomain
A DMARC record published at _dmarc.news.example.com overrides the parent for mail whose From domain is news.example.com. Use this when the subdomain has a different risk profile or a different team. For example:
- A sending subdomain in its own rollout. The marketing subdomain may still be in monitoring (
p=none) while the main domain is atreject. Publish a separate record on the subdomain with its own reporting address. - A subdomain run by a third party. A vendor-hosted help center or status page may need to send mail as its own subdomain. Give it a record and its own authentication, and keep it apart from the main domain.
- A sending subdomain with different reporting needs. Direct its aggregate reports to the team that owns it, using the
rua=tag.
Separate records also help when you split mail streams by subdomain, which is a practice we recommend for transactional and marketing traffic: see sending subdomain strategy and separating transactional and marketing streams.
Alignment for subdomains
DMARC requires SPF or DKIM to pass with a domain that aligns with the From domain. There are two alignment modes. In relaxed mode (the default), the organisational domains must match, so a DKIM signature from d=mail.example.com aligns with a From of news.example.com or example.com. In strict mode (adkim=s or aspf=s), the domains must be exactly equal. If you set strict alignment on a parent record, subdomains that rely on a parent-level signing domain will stop aligning. Unless you have a specific reason, leave alignment relaxed. Details are in DMARC alignment explained.
A practical consequence: if you send as news.example.com and your sending service signs with d=news.example.com or with d=example.com, DKIM aligns under relaxed mode. If the service signs with its own domain, alignment fails regardless of how you set sp=. The remedy is to complete the service's domain authentication so it signs with your domain; see verifying your sending domain.
Protecting subdomains that never send
Attackers do not need to guess the name of a subdomain you actually use. They can send mail with a From address on secure-login.example.com or payments.example.com, names that may not exist in DNS at all. If your parent record has p=none and no sp=, nothing stops this at receivers that follow your policy. If the parent record enforces (p=quarantine or reject), those fake subdomains are covered through inheritance, provided that no more specific record weakens it. This is a strong argument for enforcement on the parent, with sp=reject as an explicit statement of intent. For domains that send no mail at all, use the full set of protective records in parked and non-sending domains.
A rollout plan that does not break mail
- Discover your subdomains. List the hostnames that appear in From addresses. Your DMARC aggregate reports show the From domains that real mail uses; check your DNS zone, your vendors and your marketing team. See aggregate reports and the move to reject.
- Publish p=none with reporting on the parent domain. Add
rua=mailto:...and, if useful, setsp=noneat first so that subdomain mail is also only monitored. - Authenticate each real sender. Make sure each sending service signs with your domain, and that SPF lists the right sources for the envelope domain.
- Publish records on subdomains that need a different path. A sending subdomain that is not ready can have its own
p=nonewhile the parent moves ahead. - Move the parent to quarantine, then reject. Watch the reports after each step. Use the
pct=tag if you need a gradual rollout. - Set sp= deliberately. When the main domain enforces, choose whether subdomains inherit (omit
sp=) or follow a different policy (set it). - Move each sending subdomain to enforcement after its own reports are clean, and then retire the individual overrides if they are no longer needed.
Typical problems and fixes
| Problem | Cause | Fix |
|---|---|---|
| A newsletter subdomain began to fail after the parent moved to reject | It inherited p=reject and its sender is not aligned | Authenticate the sender with your domain, or publish a subdomain record while you fix it |
| Subdomain spoofing still works | Parent is p=none and sp is absent or none | Enforce on the parent or set sp=reject |
| Reports for subdomains arrive at the wrong mailbox | Subdomain has no rua; parent rua is used | Publish a subdomain record with its own rua |
| Subdomain record ignored | It is at the wrong name; it must be _dmarc.subdomain | Check the exact DNS name and the TXT value |
| Alignment fails after setting adkim=s | Strict mode needs exact domain match | Return to relaxed alignment or sign with the exact subdomain |
| Cannot tell which subdomains send mail | No reporting in place | Publish p=none with rua and read the reports for a few weeks |
Use the SPF, DKIM and DMARC checker to view the record that applies to a given subdomain, and dig TXT _dmarc.news.example.com +short to see whether the subdomain has its own. The syntax of the tags is covered in DMARC record syntax.
Authenticate your sending subdomain Set up a dedicated subdomain with aligned DKIM and return-path records, ready for DMARC enforcement.
References and further reading
Frequently asked questions
Do subdomains inherit my DMARC policy?
Yes. If a subdomain has no DMARC record, receivers use the parent record, applying sp= if it exists and p= otherwise.
What does sp= mean in a DMARC record?
It sets the policy for subdomains of the domain where the record is published, separate from the policy for the domain itself.
Do I need a DMARC record on every subdomain?
No. Publish one only when a subdomain needs a different policy or reporting address from the parent.
Can I enforce DMARC on the parent but not on a sending subdomain?
Yes. Publish a record on that subdomain with its own policy, such as p=none, while you finish authenticating its senders.
Does relaxed alignment cover subdomains?
Yes. In relaxed mode a DKIM or SPF domain aligns when it shares the organisational domain with the From domain, so a subdomain can align with its parent.