DMARC policies for subdomains
DMARC lets a parent domain protect its subdomains. A sending domain can use an exact DMARC record, or it can inherit a policy from a parent domain. You do not need to add a child record when Lettermint verifies an inherited policy.
Lettermint follows the DNS tree-walk rules in RFC 9989. It checks the sending domain first. If there is no valid record, it checks parent domains. The walk uses no more than eight DMARC queries.
Exact and inherited policies
An exact policy is published at the sending domain. For mail.example.com, the
record name is _dmarc.mail.example.com. The p tag sets the policy.
An inherited policy is published at a parent domain. For example:
Code
The parent record uses sp=quarantine for the existing subdomain. The child
domain does not use p=reject because the record is not exact.
When Lettermint verifies an inherited policy, the DNS page shows the parent record that supplies the policy. It does not show a second child record. It also does not show copy actions for the parent record because you do not need to publish that record again.
Lettermint checks active records again on a schedule. If you later publish an exact child record, Lettermint replaces the inherited policy display after the next successful check.
Policy tags
| Tag | Purpose |
|---|---|
p | Sets the policy for the domain where the record is published. It is also the fallback policy for subdomains. |
sp | Sets the policy for existing subdomains of the organizational domain. If it is absent, p applies. |
np | Sets the policy for non-existent subdomains. If it is absent, sp applies, and then p applies. |
psd | Marks a public suffix boundary. psd=y marks a public suffix. psd=n marks an organizational domain. |
t | Enables test mode with t=y. This reduces reject to quarantine, or quarantine to none. |
DNS returns NXDOMAIN when a domain does not exist. DNS returns NOERROR with
no requested record when the domain exists but that record type is absent.
DMARC uses this difference when it selects np.
Create an exact child policy
The selected DMARC record also supplies the aspf alignment setting. If an
inherited record uses aspf=s, Lettermint's Return-Path subdomain does not
match the sending domain exactly. The DNS notice names the parent record that
needs an update. See SPF alignment with DMARC.
Change only aspf=s to aspf=r when you edit that record. Keep its enforcement,
DKIM alignment, and reporting settings unchanged. The change can affect other
senders that use the parent policy.
If the parent policy must remain strict, create an exact child policy with
aspf=r using the steps below. Preserve the intended effective policy and
reporting destinations for the child domain. Do not copy the parent record
without review.
You can publish an exact record when the child domain needs a different policy or separate report destinations.
- Select the policy that must apply to the child domain.
- Publish the record at
_dmarc.<sending-domain>. - Set the selected child policy with
p. - Add reporting and alignment tags only when the child domain needs them.
- Wait for Lettermint to verify the new record.
For example, this record sets an exact quarantine policy for
mail.example.com:
Code
Do not copy a parent record without review. An exact record uses p, not sp.
For example, copying p=reject; sp=quarantine to a child changes the effective
child policy from quarantine to reject.
When no child record is required
Do not add a child record only to make the DNS page look complete. Keep the inherited setup when all these statements are true:
- Lettermint shows the DMARC record as active.
- The policy domain is a parent of the sending domain.
- The effective policy is correct for the sending domain.
An exact child record remains an option. Add it only when you want to change the policy or the other DMARC settings for that child domain.
Next steps
Domain verification
Add and verify the DNS records for a sending domain.
Return-Path and SPF
Check the SPF alignment requirements for Lettermint.