Make the DMARC subdomain policy match the main policy on Cloudflare
Why it matters
The sp tag sets a weaker policy for subdomains than the main domain has, so spoofed mail can still be sent as any subdomain. Removing sp makes subdomains follow the main policy.
Staged change. Do this in stages and check each one before the next, so a mistake does not break your site or your mail.
The fix
- In the Cloudflare dashboard open DNS > Records, edit the TXT record named _dmarc and delete the sp=... part (or make it equal to p), then save. Only change sp; do not change p=.
- Check your DMARC reports first for mail sent from subdomains, since they will now be held to the same policy as the main domain.
text
Type: TXT Name: _dmarc.example.com Content: v=DMARC1; p=quarantine; rua=mailto:[email protected] # Keep your current p= value; quarantine is shown as an example
The examples use example.com. Replace it with your own domain.
Related
- Reported by the DMARC policy check
- Publish a DMARC record, starting in monitoring mode
- Keep only one DMARC record
- Fix the invalid DMARC record
- Move DMARC from monitoring to quarantine, then reject
- Move DMARC from quarantine to reject
- Remove the pct tag from the DMARC record
- Remove the t=y test flag from the DMARC record
- Add a report address to the DMARC record
- Remove or fix the invalid tags in the DMARC record
Scan your domain to see whether this applies to you.