dotvitals

Subdomain has no DMARC record and inherits the parent policy

InfoConfirmedemail.dmarc.inherited-from-parent

What this check looks for

This subdomain publishes no DMARC record of its own, so receivers apply the policy from your main domain. That is normal and usually what you want.

Why it matters

It matters mainly for what you are looking at: the policy protecting this name is the parent's, so changing it changes every subdomain that has no record of its own.

What it costs your score

This check never deducts. It reports a fact — or reports that something could not be verified — and is shown on the report without moving the score.

Severity
info
Default confidence
confirmed
Status when triggered
info
Deduction
0 points
Family cap
none
Category
Email authentication
Module
Email dmarc
Fix owned by
dns host
In the ruleset since
2026.09

How the whole score is calculated

How to fix it

Nothing to do, unless this subdomain needs a policy or reporting address of its own.

Inheritance is the designed behaviour; a per-subdomain record is only needed when the subdomain differs.

  1. To give this subdomain its own policy, publish a record at _dmarc.‹domain› — it replaces the inherited one completely.

  2. To tighten every subdomain at once, set sp= on the organizational domain instead.

How to confirm it worked

  • dig +short TXT _dmarc.‹organizational domain› — this is the record in force

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

No TXT record exists at _dmarc.‹domain›, so per RFC 9989 §4.10 the receiver walks up the DNS tree and applies the first policy record it finds — here ‹organizational domain›, whose record is ‹parent record›. When that record carries an sp= tag, the sp value — here ‹effective policy› — is what applies to this subdomain rather than p=. Publishing a record directly on the subdomain overrides the inherited policy entirely, including its reporting addresses.

Standards and references

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email dmarc checker

Other email dmarc checks