What does sp=none do in a DMARC record?

RFC 7489 section 6.3 defines sp as the requested policy for all subdomains of the queried domain. sp=none asks receivers to take no action on mail from any subdomain, whatever the p tag says for the domain itself.

Do subdomains inherit the DMARC p policy?

Yes, but only when sp is absent. RFC 7489 section 6.3 says that if sp is absent, the policy specified by the p tag MUST be applied for subdomains.

How do I fix sp=none under p=quarantine?

Delete the sp=none tag. Subdomains then inherit p=quarantine on their own. If one subdomain genuinely needs a weaker policy, publish a DMARC record on that subdomain instead.

How do I check my sp tag?

Run dig +short TXT _dmarc.example.com and compare the sp value to the p value. If sp is weaker than p, your subdomains are on the weaker policy.

DMARC sp=none with p=quarantine: why your subdomains are unprotected

Your DMARC record asks for quarantine on mail from example.com and asks for nothing on mail from anything under it.

Anyone can put a made-up subdomain of yours in the From header, and your own policy asks the receiver to do nothing about it.

What the record looks like

v=DMARC1; p=quarantine; sp=none; rua=mailto:dmarc@example.com

What the standard says

RFC 7489, section 6.3, on the sp tag:

sp: Requested Mail Receiver policy for all subdomains (plain-text; OPTIONAL). Indicates the policy to be enacted by the Receiver at the request of the Domain Owner. It applies only to subdomains of the domain queried and not to the domain itself. Its syntax is identical to that of the "p" tag defined above. If absent, the policy specified by the "p" tag MUST be applied for subdomains. Note that "sp" will be ignored for DMARC records published on subdomains of Organizational Domains due to the effect of the DMARC policy discovery mechanism described in Section 6.6.3.

Read the last sentence twice. If you delete sp=none, every subdomain inherits p=quarantine on its own. The sp tag only makes sense when you want subdomains treated differently from the domain, and none is the weakest value it can carry.

Why it happens

Two common paths. A record generator added sp=none as a safe start and nobody removed it after p moved from none to quarantine. Or one subdomain once sent unauthenticated mail, a ticketing tool or an old newsletter platform, and sp=none was the quick way to stop the complaints.

The first is a leftover. The second is a real decision, and it should name the subdomain.

Check it yourself

dig +short TXT _dmarc.example.com

Look for p= and sp=. If sp is present and weaker than p (none under quarantine, or none or quarantine under reject), you have this finding.

The fix

Remove sp=none so subdomains inherit p. If one subdomain genuinely needs a weaker policy, publish a DMARC record on that subdomain itself, at _dmarc.that.example.com, instead of weakening every subdomain at once.

RFC 7489 section 6.6.3 has receivers look for a record on the exact subdomain first, so that record wins for that subdomain only.

If you need to build the record from scratch, Sidemail's DMARC generator does it in a minute.

Run your domain audit at audit.humerly.com. No signup, no card.