Do I need a DMARC record for each subdomain?

10 May 2026 · The DMARC Engine Team · 1 min read

In most cases you do not need a separate DMARC record for each subdomain. One record published at _dmarc.yourdomain covers your organisational domain and, by inheritance, its subdomains.

How inheritance works

DMARC (RFC 7489) applies your organisational policy to subdomains unless you say otherwise. The sp= tag in your top-level record sets the policy for subdomains specifically:

v=DMARC1; p=reject; sp=reject; rua=mailto:reports@yourdomain

If you omit sp=, subdomains simply inherit the p= value. So a single record at the org level can enforce across mail.yourdomain, news.yourdomain, and so on. See subdomain policy (sp) for detail.

When to add a subdomain-specific record

Publish a record at _dmarc.sub.yourdomain only when that subdomain needs different handling, for example:

• A subdomain still has unaligned senders you are working through, so it stays at p=none while the parent is already at reject.
• A bulk-mail or transactional subdomain needs its own rua reporting address.
• You want a tighter or looser alignment mode for one subdomain.

A subdomain record overrides inheritance entirely, its own p= takes effect, and sp= is then irrelevant for that subdomain's own children.

DMARC Engine hosts these records for you and manages the staged rollout per domain, so you do not have to hand-edit DNS. Start your setup or read the requirements.