Subdomains are exempt from an enforcing DMARC policy
Updated
32% of the 222 domains we could check fail this. Sample: the first 1,000 domains by rank in the Majestic Million, checked on 2026-10-12. How we measured
What this check looks for
Your main domain is protected, but the record explicitly exempts every subdomain. Attackers routinely spoof a subdomain that was never used for mail, because it looks convincing and is not covered.
Why it matters
A recipient reads billing.‹domain› as you. Leaving subdomains unprotected undoes much of the value of enforcing on the apex.
When the check passes, your report says: “The enforcing policy covers subdomains as well as the domain”.
What it costs your score
When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.
It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.
- Severity
- medium
- Default confidence
- confirmed
- Status when triggered
- fail
- Deduction
- 10 points
- Family cap
- email-auth.dmarc · 40
- Category
- Email authentication
- Module
- Email dmarc
- Fix owned by
- dns host
- In the ruleset since
- 2026.09
How to fix it
Remove sp=none so subdomains inherit the apex policy.
Spoofing a never-used subdomain is a standard technique precisely because sp=none leaves it open.
Check the aggregate reports for legitimate mail sent from subdomains.
Give any such subdomain its own SPF and DKIM setup.
Remove the
sp=nonetag, or setsp=quarantineas an intermediate step.
How to confirm it worked
dig +short TXT _dmarc.‹domain› — the record must not contain sp=none
A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.
Technical detail
_dmarc.‹domain› sets p=‹policy› with sp=none. Per RFC 9989 §4.7, sp overrides p for subdomains; where it is absent, subdomains inherit p. Publishing sp=none alongside an enforcing p is therefore an explicit decision to leave every subdomain unprotected.
Standards and references
- RFC 9989 §4.7 — sp tag § 4.7
Test this on your domain
Run the check that produces this finding, on its own, against any domain.