DMARC sp Tag Exceptions & Uses

The "sp" tag is short for subdomain policy. It lets a domain specify a different DMARC policy for its subdomains than the one applied to the organizational domain itself.

By default, if you omit the sp tag, your subdomains simply inherit the policy set in the p tag. Including sp lets you override that inheritance for existing subdomains. It is worth remembering that subdomain policy is evaluated against the organizational domain's published record, so the relationship between p and sp is what determines how a subdomain's mail is handled.

If a subdomain publishes its own explicit DMARC record, that record takes precedence over the parent's policy for that subdomain, even if the subdomain's own record is just p=none. In the absence of a record on the subdomain, the parent's sp value (or, if sp is absent, the parent's p value) applies.

A key companion: the np tag

RFC 9989 introduced the np tag, which sets the policy for non-existent subdomains, meaning subdomain names that do not resolve in DNS at all. This matters because sp only governs subdomains that exist. Attackers frequently forge mail from random, never-registered subdomains (for example, marketing-promo.yourdomain.com),and sp does not cover those. The np tag closes that gap. If np is absent, processing falls back to sp, and if sp is also absent, to p.

For domains that want the strongest subdomain protection, publishing sp=reject and np=reject (where appropriate for your mail flows) protects both your existing subdomains and any non-existent ones from being used in impersonation.

Why do you need the sp (and np) tags?

If your DMARC record is:

v=DMARC1; p=reject; sp=none; rua=mailto:[email protected];

Then your root domain is protected, but your subdomains, even ones you never use to send mail, remain vulnerable to impersonation, because sp=none tells receivers not to enforce on them.

If your record is:

v=DMARC1; p=none; sp=reject; rua=mailto:[email protected];

Then you are not yet enforcing on the root domain you use for sending, but your unused subdomains are protected against impersonation.

To also protect non-existent subdomains, you can add np:

v=DMARC1; p=none; sp=reject; np=reject; rua=mailto:[email protected];

If you want your subdomain policy to match your root domain policy, you can simply leave the sp tag out, and your subdomains will inherit the policy set in p.

If you are using a DMARC record generator, you typically need to enable the subdomain policy option and choose your desired sp (and, where supported, np) value, as shown below.