# DMARC policies for subdomains DMARC lets a parent domain protect its subdomains. A sending domain can use an exact DMARC record, or it can inherit a policy from a parent domain. You do not need to add a child record when Lettermint verifies an inherited policy. Lettermint follows the DNS tree-walk rules in [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html#section-4.10.1). It checks the sending domain first. If there is no valid record, it checks parent domains. The walk uses no more than eight DMARC queries. ## Exact and inherited policies An exact policy is published at the sending domain. For `mail.example.com`, the record name is `_dmarc.mail.example.com`. The `p` tag sets the policy. An inherited policy is published at a parent domain. For example: ```text Sending domain: mail.example.com _dmarc.mail.example.com no record _dmarc.example.com v=DMARC1; p=reject; sp=quarantine Policy domain: example.com Effective policy: quarantine ``` The parent record uses `sp=quarantine` for the existing subdomain. The child domain does not use `p=reject` because the record is not exact. When Lettermint verifies an inherited policy, the DNS page shows the parent record that supplies the policy. It does not show a second child record. It also does not show copy actions for the parent record because you do not need to publish that record again. :::info Lettermint checks active records again on a schedule. If you later publish an exact child record, Lettermint replaces the inherited policy display after the next successful check. ::: ## Policy tags | Tag | Purpose | | --- | --- | | `p` | Sets the policy for the domain where the record is published. It is also the fallback policy for subdomains. | | `sp` | Sets the policy for existing subdomains of the organizational domain. If it is absent, `p` applies. | | `np` | Sets the policy for non-existent subdomains. If it is absent, `sp` applies, and then `p` applies. | | `psd` | Marks a public suffix boundary. `psd=y` marks a public suffix. `psd=n` marks an organizational domain. | | `t` | Enables test mode with `t=y`. This reduces `reject` to `quarantine`, or `quarantine` to `none`. | DNS returns `NXDOMAIN` when a domain does not exist. DNS returns `NOERROR` with no requested record when the domain exists but that record type is absent. DMARC uses this difference when it selects `np`. ## Create an exact child policy You can publish an exact record when the child domain needs a different policy or separate report destinations. 1. Select the policy that must apply to the child domain. 2. Publish the record at `_dmarc.`. 3. Set the selected child policy with `p`. 4. Add reporting and alignment tags only when the child domain needs them. 5. Wait for Lettermint to verify the new record. For example, this record sets an exact quarantine policy for `mail.example.com`: ```text _dmarc.mail.example.com TXT "v=DMARC1; p=quarantine" ``` :::warning Do not copy a parent record without review. An exact record uses `p`, not `sp`. For example, copying `p=reject; sp=quarantine` to a child changes the effective child policy from `quarantine` to `reject`. ::: ## When no child record is required Do not add a child record only to make the DNS page look complete. Keep the inherited setup when all these statements are true: - Lettermint shows the DMARC record as active. - The policy domain is a parent of the sending domain. - The effective policy is correct for the sending domain. An exact child record remains an option. Add it only when you want to change the policy or the other DMARC settings for that child domain. ## Next steps Add and verify the DNS records for a sending domain. Learn how Lettermint provides SPF alignment.