webzod
account

Make the DMARC subdomain policy match the main policy on Cloudflare

email.dmarc.sp_weaker · effort: minutes

Why it matters

The sp tag sets a weaker policy for subdomains than the main domain has, so spoofed mail can still be sent as any subdomain. Removing sp makes subdomains follow the main policy.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

  1. In the Cloudflare dashboard open DNS > Records, edit the TXT record named _dmarc and delete the sp=... part (or make it equal to p), then save. Only change sp; do not change p=.
  2. Check your DMARC reports first for mail sent from subdomains, since they will now be held to the same policy as the main domain.
text 
Type:     TXT
Name:     _dmarc.example.com
Content:  v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com

# Keep your current p= value; quarantine is shown as an example

The examples use example.com. Replace it with your own domain.

Read the documentation (opens in a new tab)

Related

Scan your domain to see whether this applies to you.