DMARC finding
Subdomains unprotected by DMARC
The subdomain policy is weaker than the domain policy, and an attacker picks the subdomain.
Finding code
dmarc_subdomains_unprotected
This finding appears in the findings array of
the spam checker and
the POST /v1/sender API response when the
condition above is detected.
How to fix it
The fix.
Add sp=reject (or match the domain policy) so subdomains are protected. An attacker who cannot spoof the domain will try a subdomain instead.
Related DMARC findings
Other things we check.
| Finding | What it means |
|---|---|
dmarc_missing
|
No DMARC record |
dmarc_multiple_records
|
Multiple DMARC records |
dmarc_syntax_error
|
DMARC syntax error |
dmarc_monitoring_only
|
DMARC monitoring only |
dmarc_quarantine_only
|
DMARC quarantine only |
dmarc_partial_coverage
|
DMARC partial coverage |
dmarc_no_aggregate_reports
|
No DMARC aggregate reports |