Skip to content
warn

DMARC sp= leaves your subdomains spoofable

The sp= tag sets the policy for subdomains. When it is absent, subdomains inherit p=. When it is present and weaker than p=, you have explicitly opened a hole.

Attackers exploit this with subdomains that were never registered — billing.yourdomain.com, secure-login.yourdomain.com — because DMARC applies to any name under the domain, registered or not.

How to fix it

  1. 1Unless you have a specific reason, remove sp= entirely so subdomains inherit the apex policy.
  2. 2If a subdomain genuinely needs a weaker policy, publish a DMARC record on that subdomain instead of weakening the whole tree.

Check whether your domain has this problem

Free, no signup, about two seconds. You get the exact record to paste.

Related guides