Subdomain Policy (DMARC)

What is a Subdomain Policy in DMARC?

A subdomain policy in DMARC (Domain-based Message Authentication, Reporting & Conformance) specifies how email from a domain’s subdomains should be handled if those subdomains don’t have their own DMARC records.

It’s defined using the optional sp tag (e.g., sp=reject) in a DMARC record. This allows domain owners to apply a different enforcement policy for subdomains than for the parent domain.

Example:

In this case, mail from the main domain (yourdomain.com) would be quarantined, while mail from subdomains (like mail.yourdomain.com) would be rejected if it fails DMARC checks.

How a Subdomain Policy Works

By default, if no sp tag is present, subdomains inherit the policy (p=) of the main domain. The sp tag overrides this behavior, letting administrators enforce stricter or more lenient rules for subdomains.

This distinction is particularly useful when:

• Some subdomains are used by third-party senders (e.g., marketing.yourdomain.com).
• You’re testing DMARC policies gradually, using a relaxed policy for subdomains while tightening the main domain.
• You want to enforce stricter rules for subdomains to prevent abuse or unauthorized sending.

Subdomain policies are recognized by receiving servers just like top-level DMARC policies, influencing how unauthenticated email is treated - none, quarantine, or reject.

The Role of Subdomain Policies in Domain Protection

Subdomain policies help prevent attackers from exploiting neglected or unmonitored subdomains. Even if your main domain is protected by DMARC, a missing subdomain record could allow spoofing from addresses like billing.mail.yourdomain.com.

By setting an explicit subdomain policy, you close those gaps and ensure consistent enforcement across your entire domain structure.

Many organizations choose sp=reject as a best practice once DMARC monitoring is stable, ensuring that no subdomain can send unauthenticated mail.

Subdomain Policy and DMARCeye

DMARCeye helps visualize how your DMARC policy (including the sp tag) applies across all domains and subdomains. In your aggregate reports, it highlights which subdomains are sending mail, whether they’re covered by a specific DMARC record, and how messages are handled under the parent domain’s policy.

This visibility allows you to identify weak spots (like unprotected subdomains or inconsistent enforcement) and move confidently toward a reject-all configuration without disrupting legitimate email flows.

Sign up for a free trial of DMARCeye today and secure your email domain.

To learn more about DMARC and DMARC-related terms, explore the DMARCeye Glossary.