DMARC subdomain diagnostics

DMARC policy for the visible From subdomain is unexpected

A visible From address such as news.example.com can inherit policy from a parent domain. Before changing DMARC, identify the exact policy owner and whether p, sp, np or test mode changes the effective result.

Problem description

Mail from your subdomain is rejected or handled differently after a DMARC change:

DMARC policy for the visible From subdomain is unexpected.

Run this automated test on my domain

Enter your domain. MailFixIt checks the relevant DNS records automatically and shows the evidence.

How an effective policy is selected

Direct record: _dmarc.subdomain.example.com supplies the policy when valid.
Inherited policy: a parent DMARC record can supply sp= for an existing subdomain or fall back to p=.
Non-existent domain: a valid np= can apply when DNS confirms that the requested subdomain does not exist.
Test mode: t=y lowers effective enforcement, so the declared and effective policies can differ.

Use the result safely

Enter the domain in the visible From address, not a guessed return-path or provider hostname.
Check whether the reported policy is direct or inherited and preserve intended parent-domain behavior.
Verify legitimate senders pass aligned SPF or DKIM before tightening p, sp or np.
Confirm a fresh message with the receiving provider after a DNS change.

The check reports current public DNS policy only. It does not independently verify a message's SPF/DKIM alignment, historical policy or inbox placement.

Frequently asked questions

Does a subdomain use its own DMARC policy?

A direct DMARC record for the visible From subdomain takes precedence. When there is no direct record, an applicable parent policy can supply sp= for existing subdomains or np= for non-existent domains, with p= as the fallback.

Does the effective DMARC policy prove a message will pass?

No. Policy discovery shows the current public DNS policy. DMARC pass or fail for a message also depends on aligned SPF or DKIM authentication and receiver behavior.

Related email diagnostics

DMARC reports not received: External report destination is not authorizedFind why DMARC aggregate reports are not arriving. Check external reporting authorization in DNS, understand the limits, and verify a safe fix. Gmail 550 5.7.40: Your message was blocked because the sending domain doesn't have a DMARC record or policyDiagnose Gmail 550 5.7.40 with a current RFC 9989 DMARC policy check. Distinguish a missing or invalid policy from temporary DNS failures and message alignment.

Primary sources: RFC 9989 DMARC.