# Does a subdomain need its own SPF record?

> SPF policies do not automatically inherit from a parent domain. Publish a record at each actual envelope or HELO domain that needs SPF authorization.

A subdomain needs its own SPF record only when SPF evaluates that subdomain as the MAIL FROM or HELO identity and it must authorize sending. SPF does not inherit a policy from the parent domain. A visible From address on a subdomain does not by itself require SPF there, because SPF usually checks the envelope sender. Inspect a delivered message first, then publish one SPF policy at each exact envelope or HELO domain used by real mail.

## Quick takeaways

- SPF policy is retrieved for the evaluated SMTP identity.
- Parent-domain SPF does not automatically cover a subdomain.
- The visible From domain may differ from the SPF envelope domain.
- Each active SPF owner name should have one policy record.
- Relaxed DMARC alignment can relate a subdomain to its organizational domain after SPF passes.


![SPF policy follows the evaluated subdomain, shown as a four-step technical sequence.](/images/editorial/spf-record-for-subdomains/spf-record-for-subdomains-visual-guide.svg)

*This diagram summarizes the article's diagnostic sequence. Use the linked standards, current provider documentation, and production evidence for exact decisions. [Open the full-size diagram](/images/editorial/spf-record-for-subdomains/spf-record-for-subdomains-visual-guide.svg).*

## Who is affected?

This matters to organizations that use bounce subdomains, marketing subdomains, transactional platforms, or HELO names under separate labels. It also matters when a DNS audit flags a From subdomain that never appears as an SPF identity.

The [SPF overview](/learning/what-is-spf) explains which address SPF evaluates. The [DMARC overview](/learning/what-is-dmarc) explains the later alignment comparison.

## What are the requirements?

[RFC 7208](https://www.rfc-editor.org/rfc/rfc7208.html) selects the SMTP identity and performs a DNS lookup for that domain. If no SPF policy is found there, the result is none. The evaluator does not walk up to a parent domain to borrow its record.

A parent and subdomain can publish different policies because they are different DNS owner names. Each name must still return no more than one SPF record, and each policy must authorize only the services that use that identity.

[DMARC](https://www.rfc-editor.org/rfc/rfc9989.html) does not change this lookup. It can treat an SPF-authenticated subdomain and visible parent domain as aligned in relaxed mode when they share an Organizational Domain. Strict alignment requires the domains to match exactly.

## When does the requirement take effect?

The policy is needed as soon as production mail presents the subdomain in MAIL FROM or, for a null reverse path, in the HELO identity used for SPF. A change to the visible From address alone may not change the SPF lookup at all.

Check every platform because one sender may use the parent envelope domain while another assigns an account-specific bounce subdomain.

## How do I implement the requirement?

### 1. Capture actual SMTP identities

Inspect delivered headers from each sender and record smtp.mailfrom, Return-Path, SPF domain, and HELO where relevant.

### 2. Group sources by exact owner name

List every service authorized to send with each envelope domain. Do not combine policies merely because names share a parent.

### 3. Publish one policy at each active identity

Create or update the SPF TXT record at that exact domain. Use provider-supported mechanisms and keep within SPF processing limits.

### 4. Remove unused authorization deliberately

After confirming a service no longer uses an identity, remove its authorization and monitor for unexpected failures. Do not delete a subdomain policy solely because the parent has one.

## How do I validate compliance?

Query each exact SPF owner name and run a message through every production route. Confirm SPF pass for the expected envelope domain and verify alignment with the visible From domain where SPF is expected to satisfy DMARC.

Use Palisade's [DNS lookup tool](/tools/dns-lookup) to inspect exact owner names and [Email Security Score](/tools/email-security-score) for public posture. Production headers and aggregate reports show whether any identity was missed.

## Frequently asked questions

### Does a From subdomain always need SPF?

No. SPF normally checks the envelope domain. The From subdomain needs SPF only if a sender actually uses it as the evaluated SPF identity.

### Can the parent SPF include all subdomains?

No inheritance mechanism makes that happen. Each evaluated subdomain needs a policy at its own name.

### Can a subdomain reuse the same provider include?

Yes, if that provider is authorized to use the subdomain identity. Publish it in the subdomain's single policy and verify the resulting lookup count.

### Does relaxed DMARC alignment remove the need for subdomain SPF?

No. SPF must first pass at the evaluated domain. Relaxed alignment only compares that authenticated domain with From afterward.

### What if the subdomain never sends mail?

Do not authorize senders there. Depending on the domain's design, an explicit restrictive policy can document that the SMTP identity is not permitted.