MediumPolicy · usually medium
Subdomain policy is weaker than the domain policy
sp= is set to a laxer value than p=, leaving subdomains less protected.
Check your own domain
What causes this
The sp tag sets the policy for subdomains. When it is weaker than p — for example p=reject with sp=none — every subdomain of your domain, including ones that do not exist, is left effectively unprotected. Attackers prefer subdomains precisely because they are so often overlooked, and a non-existent subdomain is just as usable for a forged From address as a real one.
What it breaks
Mail forged from subdomains is not subject to your main policy. This is a common gap in otherwise well-configured domains.
How to fix it
Raise sp to match p, or remove sp so subdomains inherit the domain policy.
- Confirm no legitimate subdomain sends mail that would fail the stricter policy.
- Either delete the sp tag — subdomains then inherit p — or set sp to the same value as p.
Specification: RFC 7489 — DMARC
Related problems
- BIMI record published without DMARC enforcementBIMI requires a DMARC policy of quarantine or reject. The record will be ignored.
- External reporting address is not authorisedReports are directed to another domain that has not published the required authorisation record.
- DMARC record requests no aggregate reportsThere is no rua address, so you receive no data about who sends as your domain.
- DMARC policy is set to noneThe policy monitors but does not act — failing mail is still delivered.
- Non-sending domain is not protected against forgeryThis domain appears not to send mail, but publishes no policy preventing others from doing so.