The DMARC policy is enforced for the domain but not for its subdomains.

SPOOF_SUBDOMAINS_UNPROTECTED · Severity: Warning

• WarningSPOOF_SUBDOMAINS_UNPROTECTED

  The DMARC policy is enforced for the domain but not for its subdomains.

  The policy for subdomains (sp, or p when sp is missing) works out as none, so receivers are asked to take no action on mail that fails DMARC and claims to come from a subdomain, even though the domain itself asks for action. Test mode (t=y) lowers both policies one step.

  Recommendation: Add an sp tag that enforces for subdomains, once you know which subdomains send mail.

Reported by

• Email spoofing check

Available through the API

• Email spoofing check API

All findings