Email authentication for subdomains

What it means

A subdomain is a name under your domain, like news.yourdomain.com or mail.yourdomain.com. Companies use them to separate newsletters, shop emails or support tools from their main email.

Each email record behaves differently with subdomains:

• SPF is not inherited. The SPF of yourdomain.com does not cover news.yourdomain.com. A subdomain that sends needs its own SPF record.
• DKIM keys live under the signing domain: selector._domainkey.news.yourdomain.com if the email is signed for the subdomain.
• DMARC is inherited. If a subdomain has no DMARC record, receivers use the one of the main domain. Its sp= tag sets the policy for subdomains; without it, p= applies to them too.

Why it matters

• A newsletter tool on a subdomain without SPF or DKIM fails authentication.
• Scammers can invent subdomains like billing.yourdomain.com to send fake emails if your DMARC does not cover them.
• Moving the main domain to p=reject also affects subdomains, so they must be ready.

How to check

• Use the Domain scanner at /domain-scanner with the subdomain name to see its SPF, DMARC and MX.
• Send a test email from the tool that uses the subdomain to the test address on the home page. The report shows which domain SPF and DKIM were checked for, and whether DMARC aligns.

How to fix it

1. Add SPF on each sending subdomain, with only the services that send for it:

   news.yourdomain.com  TXT  "v=spf1 include:spf.newsletter-example.com ~all"

   Many email services handle this for you with a custom "return path" or "bounce" subdomain; follow their setup page.
2. Set up DKIM for the subdomain in the sending tool, and publish the record it gives you, at the name it gives you.
3. Choose the DMARC policy for subdomains on the main domain:

   _dmarc.yourdomain.com  TXT  "v=DMARC1; p=quarantine; sp=reject; rua=mailto:dmarc@yourdomain.com"

   Here the main domain is quarantined and all subdomains are rejected when they fail.
4. Give one subdomain its own policy if it needs a different one, for example while you test a new tool:

   _dmarc.news.yourdomain.com  TXT  "v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com"

About alignment

By default DMARC uses "relaxed" alignment: an email with From news.yourdomain.com passes if SPF or DKIM passes for any name under yourdomain.com. Strict alignment (adkim=s, aspf=s) requires the exact same name.

Tips

• Subdomains that never send email should be protected too: a strict sp= covers them all at once.
• Read your DMARC reports before tightening sp=, to find subdomains you forgot. Delivmail DMARC monitoring in the paid dashboard can help.

Check that it is fixed

After a few minutes, run the Domain scanner on the subdomain, then send a new test email from the tool that uses it. SPF, DKIM and DMARC should pass for the subdomain.