DMARC Subdomain Policy Inheritance

DMARC Subdomain Policy Inheritance

TL;DR: a subdomain without its own DMARC record isn't automatically unprotected — it inherits the parent domain's policy.

The rule

A subdomain doesn't need its own _dmarc.<subdomain> TXT record to be protected — DMARC (RFC 7489) lets it inherit the parent's sp= (or p= if sp= isn't set). The checker knows this and scores accordingly, instead of just reporting "no record found" for every subdomain that relies on inheritance:

Subdomain has own record?	Parent's policy	Subdomain check result
Yes	—	Scored on its own record, same as any apex domain
No	p=reject (or sp=reject)	pass — inherits sp=reject/p=reject
No	p=quarantine	warn — inherits quarantine, suggests moving to reject
No	p=none	warn — inherits none, "monitoring only, no enforcement"
No	No usable DMARC record either	fail — nothing protects this subdomain

Worked example

mail.example.com sends mail but has no _dmarc.mail.example.com record. example.com publishes p=reject. Result: mail.example.com scores pass — it inherits the reject policy automatically, no record of its own needed.

Now say example.com instead publishes p=quarantine. Same subdomain, same lack of its own record: mail.example.com scores warn, with a suggestion that the parent move to reject.

Where you'll see this

The DNS checks page for any subdomain without its own DMARC record — the result explains which parent policy it's inheriting, not just pass/fail.

See also

• SPF ~all vs -all: Conditional Mode — resolves the effective policy the same way, for the same reason.
• How Reports Are Attributed to a Domain

---

← Core Concepts · Home