Make the DMARC subdomain policy match the main policy

Why it matters

The sp tag sets a weaker policy for subdomains than the main domain has, so spoofed mail can still be sent as any subdomain. Removing sp makes subdomains follow the main policy.

Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.

The fix

1. Check the reports for mail sent from subdomains (a help desk, a newsletter subdomain, an app). Those senders need SPF or DKIM in alignment before subdomains are enforced.
2. Only remove sp= (or set it to the same value as p); do not change p=. Keep sp at none only if a subdomain really cannot be fixed yet.
3. Edit the existing _dmarc record in place.

; sp removed: subdomains follow p. Keep your current p= (quarantine is shown as an example)
_dmarc.example.com.  IN TXT  "v=DMARC1; p=quarantine; rua=mailto:dmarc-reports@example.com"

The examples use example.com. Replace it with your own domain.

Read the documentation ↗(opens in a new tab)

Related

• Reported by the DMARC policy check
• Publish a DMARC record, starting in monitoring mode
• Keep only one DMARC record
• Fix the invalid DMARC record
• Move DMARC from monitoring to quarantine, then reject
• Move DMARC from quarantine to reject
• Remove the pct tag from the DMARC record
• Remove the t=y test flag from the DMARC record
• Add a report address to the DMARC record
• Remove or fix the invalid tags in the DMARC record