What does the DMARC sp= tag do?

DMARC `sp=` Tag: Subdomain Policy (sp)

The DMARC sp tag sets a separate policy for subdomains that don't have their own DMARC record. Without it, subdomains inherit the parent's p= policy.

Published May 10, 2026 · Last verified August 7, 2026 · Maintained by TamingDNS

Importance
Recommended

Tag
sp=

Default
Inherits from p

Example
sp=none

✅ Valid Values

none No enforcement for subdomains. Useful when subdomains send legitimate mail you haven't fully audited.

quarantine Quarantine failing subdomain mail.

reject Reject failing subdomain mail.

💬 What This Tag Does

The "sp" tag lets you apply a different policy to subdomains that don't have their own DMARC record. If omitted, subdomains inherit the parent domain's "p" policy. This is useful when you want strict policy on your root domain but need to allow subdomains more flexibility, or vice versa.

📋 Complete Example Records

Every one of these is a complete record you can paste as it stands. Each goes in a TXT record at _dmarc.yourdomain.com. Check yours with the DMARC Checker or assemble one in the DMARC Builder.

v=DMARC1; p=reject; sp=none; rua=mailto:dmarc-feedback@example.com

Locks the apex while leaving existing subdomains alone. Useful when a department runs its own mail and you have not audited it yet.

v=DMARC1; p=reject; rua=mailto:dmarc-feedback@example.com

No "sp" at all, which is the stricter option. Subdomains with no record of their own inherit p=reject.

v=DMARC1; p=none; sp=reject; rua=mailto:dmarc-feedback@example.com

The other way round. The apex is still being monitored while every subdomain is already enforced.

_dmarc.mail.example.com. TXT "v=DMARC1; p=reject; sp=none"

Published on a subdomain, where the "sp" is ignored. Policy discovery has already settled on this record, so there is no further subdomain level for it to govern.