The sp tag is an optional field in a DMARC record (RFC 7489) that specifies the policy receivers should apply to mail from subdomains of the published domain. It takes the same values as p: none, quarantine or reject.
By default, subdomains inherit the organisational domain's p policy. The sp tag breaks that inheritance. For example, p=reject; sp=none enforces reject on the top domain while leaving subdomains unprotected, or you can do the reverse to lock down subdomains you never send from.
This matters because attackers often spoof made-up subdomains such as billing.yourdomain.com, which carry no DMARC record of their own. Publishing sp=reject at the organisational domain closes that gap in one record. Note that sp only applies where the subdomain has no DMARC record itself; a subdomain that publishes its own record always wins.
Check your current setting with a DMARC lookup. As a rule, set sp=reject once your main domain is at enforcement and you have confirmed no legitimate subdomain mail is being lost in aggregate reports.
Check it on your domain
- DMARC Checker: looks up and validates a domain's DMARC record and policy.
- DMARC Generator: builds a valid DMARC record from a simple form.
- DMARC Report Analyser: reads a DMARC aggregate (RUA) report in plain English.