Copy page

Domains

DMARC policies for subdomains

DMARC lets a parent domain protect its subdomains. A sending domain can use an exact DMARC record, or it can inherit a policy from a parent domain. You do not need to add a child record when Lettermint verifies an inherited policy.

Lettermint follows the DNS tree-walk rules in RFC 9989. It checks the sending domain first. If there is no valid record, it checks parent domains. The walk uses no more than eight DMARC queries.

Exact and inherited policies

An exact policy is published at the sending domain. For mail.example.com, the record name is _dmarc.mail.example.com. The p tag sets the policy.

An inherited policy is published at a parent domain. For example:

Code
Sending domain: mail.example.com

_dmarc.mail.example.com   no record
_dmarc.example.com        v=DMARC1; p=reject; sp=quarantine

Policy domain: example.com
Effective policy: quarantine

The parent record uses sp=quarantine for the existing subdomain. The child domain does not use p=reject because the record is not exact.

When Lettermint verifies an inherited policy, the DNS page shows the parent record that supplies the policy. It does not show a second child record. It also does not show copy actions for the parent record because you do not need to publish that record again.

Policy tags

Tag	Purpose
p	Sets the policy for the domain where the record is published. It is also the fallback policy for subdomains.
sp	Sets the policy for existing subdomains of the organizational domain. If it is absent, p applies.
np	Sets the policy for non-existent subdomains. If it is absent, sp applies, and then p applies.
psd	Marks a public suffix boundary. psd=y marks a public suffix. psd=n marks an organizational domain.
t	Enables test mode with t=y. This reduces reject to quarantine, or quarantine to none.

DNS returns NXDOMAIN when a domain does not exist. DNS returns NOERROR with no requested record when the domain exists but that record type is absent. DMARC uses this difference when it selects np.

Create an exact child policy

You can publish an exact record when the child domain needs a different policy or separate report destinations.

1. Select the policy that must apply to the child domain.
2. Publish the record at _dmarc.<sending-domain>.
3. Set the selected child policy with p.
4. Add reporting and alignment tags only when the child domain needs them.
5. Wait for Lettermint to verify the new record.

For example, this record sets an exact quarantine policy for mail.example.com:

Code
_dmarc.mail.example.com TXT "v=DMARC1; p=quarantine"

When no child record is required

Do not add a child record only to make the DNS page look complete. Keep the inherited setup when all these statements are true:

• Lettermint shows the DMARC record as active.
• The policy domain is a parent of the sending domain.
• The effective policy is correct for the sending domain.

An exact child record remains an option. Add it only when you want to change the policy or the other DMARC settings for that child domain.

Next steps