sp= in a DMARC record sets the policy for subdomains of your domain, using the same values as p=: none, quarantine or reject. If you leave sp= out, subdomains follow the p= policy. It applies only to subdomains that do not publish a DMARC record of their own. RFC 7489 defines it.
Why it matters
Attackers do not have to forge your main domain. They can use a subdomain such as billing.example.com, even one you have never created. If your subdomains send no mail, a stricter subdomain policy closes that door. If some subdomains do send mail, such as a newsletter on news.example.com, a strict sp= can block them, so it needs the same care as any enforcement step.
How to do it
- Decide how subdomains are used. List which ones send mail, which do not, and which belong to outside services.
- If subdomains should simply follow the main policy, do nothing. With no sp= tag, p= applies to them.
- To keep the main domain and subdomains on different policies, add sp= to the record at
_dmarc.example.com. This example enforces reject on subdomains while the main domain is still in quarantine:
v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc-reports@example.com
- This example does the opposite, monitoring subdomains while the main domain is enforced:
v=DMARC1; p=reject; sp=none; rua=mailto:dmarc-reports@example.com
- If one subdomain needs its own rules, publish a separate record at
_dmarc.news.example.com. That record takes precedence for the subdomain, and sp= on the parent no longer applies to it. - Review the aggregate reports to see which subdomains appear before you tighten sp=.
For reference, a receiver first looks for a record at _dmarc on the exact domain in the From address. If none exists, it falls back to the record at the organisational domain, and uses sp= there if the From domain is a subdomain.
Common mistakes
- Assuming sp= is needed to cover subdomains. Without it, p= already covers them.
- Setting sp=none by accident and leaving subdomains open while the main domain is on reject.
- Making sp= strict before checking that real subdomain senders pass.
- Expecting the parent's sp= to override a subdomain's own DMARC record. It does not.
- Forgetting a subdomain that a third-party service sends from, which then fails once sp= is strict.
Frequently asked questions
Do I need sp= if my subdomains send no mail?
It is a useful safeguard. A record with sp=reject tells receivers to reject forged mail from any subdomain without its own record.
Can sp= be weaker than p=?
Yes. You can set p=reject and sp=none, for example while you work out which subdomains send mail.
What values can sp= take?
The same three as p=: none, quarantine and reject. If the tag is missing, the p= value is used for subdomains.
Related guides
- Set Up DMARC: From p=none to Quarantine and Reject
- DMARC p=none vs p=quarantine vs p=reject
- What does a correct DMARC record look like?
- DNS records basics for launch
Want a view of how your domain is set up? Try the free website sample.