Subdomains are exempt from an enforcing DMARC policy

MediumConfirmedemail.dmarc.subdomain-policy-none

What this check looks for

Your main domain is protected, but the record explicitly exempts every subdomain. Attackers routinely spoof a subdomain that was never used for mail, because it looks convincing and is not covered.

Why it matters

A recipient reads billing.‹domain› as you. Leaving subdomains unprotected undoes much of the value of enforcing on the apex.

When the check passes, your report says: “The enforcing policy covers subdomains as well as the domain”.

What it costs your score

When this check fails it removes 10 points from your Email authentication score, before the status, confidence and repeat multipliers are applied. Email authentication carries a weight of 15 in the overall score.

It shares the email-auth.dmarc family ceiling of 40 points: however many findings that family produces, together they cannot remove more than that from Email authentication. One underlying problem showing up in several places is still one problem.

Severity: medium
Default confidence: confirmed
Status when triggered: fail
Deduction: 10 points
Family cap: email-auth.dmarc · 40
Category: Email authentication
Module: Email dmarc
Fix owned by: dns host
In the ruleset since: 2026.09

How the whole score is calculated

How to fix it

Remove sp=none so subdomains inherit the apex policy.

Spoofing a never-used subdomain is a standard technique precisely because sp=none leaves it open.

Check the aggregate reports for legitimate mail sent from subdomains.
Give any such subdomain its own SPF and DKIM setup.
Remove the sp=none tag, or set sp=quarantine as an intermediate step.

How to confirm it worked

dig +short TXT _dmarc.‹domain› — the record must not contain sp=none

A named slot like ‹domain› — and the braces left in the configuration below — is filled in with your own values when this rule appears on a report.

Technical detail

_dmarc.‹domain› sets p=‹policy› with sp=none. Per RFC 9989 §4.7, sp overrides p for subdomains; where it is absent, subdomains inherit p. Publishing sp=none alongside an enforcing p is therefore an explicit decision to leave every subdomain unprotected.

Standards and references

RFC 9989 §4.7 — sp tag § 4.7

Test this on your domain

Run the check that produces this finding, on its own, against any domain.

Open the email dmarc checker Build the fix