# Do subdomains inherit DMARC policy?

> Subdomains can fall under an applicable parent DMARC policy. Learn how p, sp, np, and an explicit subdomain record determine the requested handling.

Yes. A subdomain with no DMARC policy record of its own can be covered by an applicable parent policy discovered through DMARC's DNS Tree Walk. For an existing subdomain, the parent record's sp value applies when present; otherwise its p value is used. For a non-existent subdomain, np can apply before fallback to sp or p. An explicit valid DMARC record at the Author Domain takes precedence for that domain. SPF does not use this inheritance model.

## Quick takeaways

- A subdomain does not always need its own DMARC record.
- An explicit record at the Author Domain is evaluated first.
- sp can set handling for existing subdomains.
- np can set handling for non-existent subdomains under current DMARC.
- Without an applicable override, p provides the fallback handling preference.


![DMARC policy discovery for subdomains, shown as a four-step technical sequence.](/images/editorial/dmarc-policy-for-subdomains/dmarc-policy-for-subdomains-visual-guide.svg)

*This diagram summarizes the article's diagnostic sequence. Use the linked standards, current provider documentation, and production evidence for exact decisions. [Open the full-size diagram](/images/editorial/dmarc-policy-for-subdomains/dmarc-policy-for-subdomains-visual-guide.svg).*

## Who is affected?

This matters to domains that send from marketing or transactional subdomains and to owners protecting unused names from spoofing. It also matters when different teams control DNS at different levels.

DMARC policy applies to the visible From domain. Review the [DMARC overview](/learning/what-is-dmarc) for authentication and alignment before treating subdomain policy as a standalone control.

## What are the requirements?

Receivers first look for a DMARC policy at the exact Author Domain. When none is found, [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html) defines a bounded DNS Tree Walk that can discover an applicable organizational or public-suffix policy.

If the applied policy record belongs above an existing Author subdomain, [the `sp` tag](https://www.rfc-editor.org/rfc/rfc9989.html#section-4.7) supplies the subdomain handling preference when present. If `sp` is absent, `p` applies. For a non-existent subdomain, `np` can supply the preference; otherwise the receiver falls back through `sp` and `p` as defined by the standard.

An explicit record at _dmarc.sub.example.com can state the policy for mail From sub.example.com. It must still be one valid record, and the subdomain's real senders need aligned SPF or DKIM.

## When does the requirement take effect?

The discovery process runs for each message's Author Domain. DNS caching means a new explicit record or changed parent tag may reach receivers at different times until TTLs expire.

RFC 9989 is the current protocol reference. The np tag and current tree-walk rules should be checked before copying assumptions from older DMARC guidance.

## How do I implement the requirement?

### 1. Inventory visible From domains

List the organizational domain, active sending subdomains, parked names, and delegated DNS zones. Use message and aggregate evidence rather than a guessed inventory.

### 2. Choose the parent defaults

Set p for the policy domain and decide whether existing or non-existent subdomains need different sp or np handling.

### 3. Add explicit records only for intentional differences

Publish a subdomain record when that Author Domain needs its own policy, reporting, or staged rollout. Avoid creating hundreds of identical records without an operational reason.

### 4. Authenticate each active sender

Configure aligned SPF and DKIM for every application using a subdomain in From. Policy inheritance does not create authentication.

## How do I validate compliance?

Query the exact subdomain policy location, then follow the current discovery path to the applicable parent. Confirm p, sp, or np produces the intended handling. Send through active sources and review aggregate reports by header_from domain.

Use Palisade's [DNS lookup tool](/tools/dns-lookup) to inspect the hierarchy and [Email Security Score](/tools/email-security-score) for public configuration. Reports remain necessary for rarely used subdomains.

## Frequently asked questions

### Does a subdomain inherit SPF too?

No. SPF retrieves policy for the exact evaluated SMTP identity and does not borrow a parent record.

### What happens when sp is missing?

For an existing subdomain covered by the parent policy, the applicable p value is used.

### What does np control?

It expresses the requested handling for failing mail that uses non-existent subdomains under the applicable policy domain.

### Does a subdomain record override the parent?

Yes. A valid policy discovered at the exact Author Domain applies to that domain before a parent fallback.

### Should I publish p=reject at the parent immediately?

Only after inventory and reports show legitimate parent and subdomain sources authenticate and align. Stage enforcement with production evidence.