DMARC sp= leaves your subdomains spoofable
The sp= tag sets the policy for subdomains. When it is absent, subdomains inherit p=. When it is present and weaker than p=, you have explicitly opened a hole.
Attackers exploit this with subdomains that were never registered — billing.yourdomain.com, secure-login.yourdomain.com — because DMARC applies to any name under the domain, registered or not.
How to fix it
- 1Unless you have a specific reason, remove sp= entirely so subdomains inherit the apex policy.
- 2If a subdomain genuinely needs a weaker policy, publish a DMARC record on that subdomain instead of weakening the whole tree.
Check whether your domain has this problem
Free, no signup, about two seconds. You get the exact record to paste.
Related guides
- DKIM record with empty p= — a revoked key still in use
- SPF include points at a domain with no SPF record — a silent PermError
- DMARC record syntax errors that make receivers skip your policy
- DMARC external destination not authorized — why you receive no reports
- Two DMARC records at _dmarc — why your policy is being ignored