How do I set up DMARC monitoring for a sub-domain?

If you’re using the default DMARC record we provided for your domain, we’re already collecting DMARC reports for emails sent from sub-domains. Those emails will be included in the reports you see for your main domain.

The DMARC policy for emails sent using sub-domains can be specified using the sp tag in your DMARC record.

Tracking sub-domains separately

If you’d like to monitor who’s sending emails from a specific sub-domain, add it as a new domain in DMARC Digests and follow the instructions to set up a DMARC record for the sub-domain. We’ll then process DMARC reports for the sub-domain separately to any reports we receive for your main domain, allowing you to see just the sources sending using that sub-domain.

When a mail server receives a message, it extracts the domain in the From address and tries to find a DMARC policy for that domain. For emails sent from a root domain, the mail server will look for a DMARC policy at _dmarc.yourdomain.com. When an email is sent from a sub-domain, it first looks for a DMARC policy specific to the sub-domain (e.g. _dmarc.subdomain.yourdomain.com). If this isn’t found, it will fallback to using the DMARC policy for the root domain.