What happens to subdomains if sp= is not set in a DMARC record?

Without an explicit sp= tag, subdomains inherit the same policy as the p= tag. Set sp= explicitly for different enforcement on subdomains.

DMARC Record Generator

Build a valid DMARC TXT record — policy, reporting addresses, alignment mode, and rollout percentage.

Policy (p=)

Subdomain Policy (sp=) — optional

Aggregate Report Emails (rua=) — comma-separated

Forensic Report Emails (ruf=) — optional, comma-separated

Enforcement Percentage (pct=)

DKIM Alignment (adkim=)

SPF Alignment (aspf=)

Generated DMARC record — publish as a TXT record on _dmarc.yourdomain.com

Source: RFC 7489 (DMARC). See the full methodology page. Reviewed: July 2026.

Roll out gradually — don't start at reject

The safe rollout path is p=none (monitor only, collect aggregate reports, verify legitimate mail is passing SPF/DKIM alignment) → p=quarantine at a low pct= like 10-25% → gradually raise pct= to 100% → finally p=reject. Jumping straight to p=reject on day one risks silently blocking legitimate mail from services you forgot were sending on your domain's behalf (marketing platforms, helpdesk tools, internal scripts using SMTP relay).

What "alignment" actually checks

DMARC doesn't replace SPF or DKIM — it adds a check that the domain in the visible "From" header matches (aligns with) the domain validated by SPF or DKIM. Relaxed alignment (the default, recommended for most setups) allows the organizational domain to match even if a subdomain differs (e.g. mail.example.com aligns with example.com). Strict alignment requires an exact match, which breaks if you send from subdomains — only use strict if you're certain every sending source uses the exact root domain.

Aggregate vs. forensic reports

rua (aggregate reports) are daily XML summaries of pass/fail volume by source — the useful, high-signal report type most teams should set up. ruf (forensic reports) send per-message failure samples in near-real-time and can include actual message content/headers — many large mailbox providers (Gmail, Yahoo) don't send these at all due to privacy concerns, and receiving them yourself can create your own data-handling obligations. Most setups only need rua.

Already have a DMARC record and want to check it instead of building a new one? Use the DMARC Record Checker.

Do I need a DMARC record if I already have SPF and DKIM?

Yes — SPF and DKIM alone don't tell receiving mail servers what to do when a message fails both, and don't align the visible From header with the authenticated domain. DMARC is the policy layer that ties them together and is increasingly required by major mailbox providers (Gmail and Yahoo enforced DMARC requirements for bulk senders starting 2024).

What happens to subdomains if I don't set sp=?

Without an explicit sp=, subdomains inherit the same policy as p=. Set sp= explicitly if you want different enforcement for subdomains — for example, a strict p=reject on your main domain but sp=none while you're still onboarding a new subdomain's mail flow.