Selected DMARC subdomain policy is weaker than its domain policy
ShipReady found a selected DMARC record whose supported sp value is less restrictive than its supported p value.
Why it matters
A separate subdomain policy can be a deliberate rollout choice. Comparing it with the domain policy helps an owner confirm that the difference remains intentional.
How ShipReady detects it
What it inspects
ShipReady performs bounded DNS TXT inspection, selects one qualifying DMARC record, and parses its semicolon-separated key=value tags.
What triggers a finding
The rule triggers only when both p and sp are supported values and the scanner ranks sp below p: none below quarantine below reject. An absent or unsupported sp value does not trigger this rule.
What the evidence shows
The selected DMARC record contains supported policy values whose parsed sp value is weaker than its parsed p value.
Limits of this check
ShipReady does not inventory subdomains, test their DNS or HTTPS readiness, validate every DMARC tag, send mail, or observe how receivers treat real messages from the domain or its subdomains.
How to fix it
Review subdomain sending plans
Identify subdomains that send mail and confirm whether their different policy treatment is intentional.
Choose the intended subdomain policy
If the weaker value is no longer needed, align or remove the sp tag as appropriate for the deployment. Validate real senders separately before tightening a policy.
How to verify the change
Inspect the selected DMARC record
After DNS propagation, query the selected DMARC TXT value and confirm the intended p and sp tags are present.
Expected: The selected record's p and sp values match the intended domain and subdomain policy plan.