How to Set Up DMARC, SPF, and DKIM for Multiple Subdomains

Do Subdomains Inherit Parent DMARC Records?

No. Subdomains do not automatically inherit the DMARC policy of their parent domain.

This surprises a lot of people. You have example.com with p=reject, and you spin up marketing.example.com to send via a third-party platform. You expect it to fall under the same rules. It does not.

DMARC policies apply only to the exact domain or subdomain they are published on. marketing.example.com only cares about the DMARC record at marketing.example.com, not the one at example.com. The parent domain record does not propagate downward.

This actually makes subdomain configuration simpler than it first appears. Each subdomain is a blank slate. You decide what SPF, DKIM, and DMARC it gets, independent of everything else.

Understanding SPF, DKIM, and DMARC at the Subdomain Level

Each record type does something different:

SPF authorizes specific mail servers to send email on behalf of your domain. On a subdomain, it works exactly the same as on a root domain. You can point it at the servers your marketing platform or SMTP provider uses.

DKIM adds a cryptographic signature to your emails. The receiving mail server verifies it against a public key published in DNS. For a subdomain, you add a DKIM selector record at the subdomain level. This is specific to the sending service, not inherited from the parent.

DMARC ties SPF and DKIM together and tells receiving servers what to do when both checks fail. A DMARC record on a subdomain checks alignment for that subdomain only. It does not inherit SPF or DKIM from the parent.

The key insight: you configure each layer independently per subdomain.

Step-by-Step: DNS Records for a New Sending Subdomain

Here is the practical setup for a subdomain like marketing.example.com sending through a platform like Brevo or Mailchimp.

1. Subdomain SPF Record

Add a TXT record at marketing.example.com:

v=spf1 include:Brevo._spf.brevo.com ~all

Replace Brevo with your actual provider. Common examples:

SendGrid: v=spf1 include:sendgrid.net ~all
Mailchimp: v=spf1 include:servers.mcsv.net ~all
Amazon SES: v=spf1 include:amazonses.com ~all

Use ~all (softfail) while testing. Switch to -all (fail) once you have confirmed everything is working.

2. Subdomain DKIM Selector Record

Your email provider will give you a DKIM public key and a selector name. Add a TXT record at:

[selector]._domainkey.marketing.example.com

The full record looks something like:

selector1._domainkey.marketing.example.com. IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA..."

Your provider gives you the exact value. Paste it verbatim. The selector name (the part before _domainkey) must match what your provider expects.

3. Subdomain DMARC Record

Add a TXT record at _dmarc.marketing.example.com:

v=DMARC1; p=none; rua=mailto:dmarc-reports@example.com; pct=100

Use p=none initially. This tells receiving servers to take no action on failing mail, but still send you aggregate reports so you can see what is happening.

Once you have verified your SPF and DKIM are passing, you can tighten the policy:

p=quarantine: failing mail goes to spam
p=reject: failing mail is bounced

The rua address can be any email address. It does not have to be on the same subdomain. Many admins use a dedicated mailbox on the root domain.

How to Protect Your Parent Domain While Subdomain Sending Is Active

Your parent domain DMARC policy at example.com should remain intact. A few things to keep in mind:

Do not add subdomain sending servers to the parent SPF record. If you add include:Brevo._spf.brevo.com to the SPF record at example.com, you are authorizing Brevo to send for the root domain too. That is probably not what you want.

Do not publish a wildcard DKIM record at the parent and assume subdomains inherit it. DKIM selectors are per-subdomain. Each sending service needs its own record on its own subdomain.

Consider subdomain alignment for the parent domain policy. When a receiving server checks a message from marketing.example.com, it looks for DMARC at marketing.example.com. Your parent domain policy at example.com does not apply to that message. That is fine, but it means you need to think about each subdomain independently.

Monitor aggregate reports from all subdomains. If you use the same rua reporting address for parent and subdomain DMARC records, you get reports for everything in one place. This is useful for keeping track of the whole picture.

Verifying Your Subdomain Setup

Before you go live, check each layer:

1. SPF check: Use a tool like DMARCFlow free SPF checker or dig to fetch the TXT record at your subdomain and confirm it contains your provider's include mechanism.
2. DKIM check: Your email provider has a verification page or diagnostic tool. Use it to confirm your DKIM record is published and resolving correctly.
3. DMARC check: Fetch _dmarc.marketing.example.com and confirm the record exists and uses the policy you intended.
4. Full DMARC alignment check: Send a test message to a known address and check the authentication results headers. You want to see SPF aligned, DKIM aligned, and DMARC passing.

DMARCFlow free tools include SPF, DKIM, and DMARC checkers that work without login. You can verify each record individually before you start monitoring. For subdomain setup, you can check each DNS record independently without needing an account.

For ongoing monitoring, DMARCFlow aggregate report parsing turns the XML reports into a readable dashboard so you can spot subdomain-level failures quickly rather than hunting through raw data.

Quick Reference: Subdomain DNS Record Checklist

Use this when setting up any new sending subdomain:

Test each record individually before sending test messages. Start with p=none on the subdomain DMARC record and move to a stricter policy only after you have confirmed SPF and DKIM are both passing.

Frequently Asked Questions

Can a subdomain use a different SPF server than the parent domain?

Yes. Each subdomain has its own SPF record. You can send from marketing.example.com via Brevo and from transactional.example.com via SendGrid, each with their own independent SPF records. The parent domain SPF record at example.com is not affected.

What happens if a subdomain does not have its own DMARC record?

The receiving server cannot find a DMARC record at the subdomain, so DMARC checking is skipped for that message. There is no inherited policy. This is why you should publish an explicit record for each sending subdomain.

Should I use the same DKIM selector for all subdomains?

No. Each sending service provides its own DKIM selector. If you use Brevo for marketing and SendGrid for transactional, they will give you different selector names. Publish both independently at their respective subdomains.

Can I use a wildcard DMARC record to cover all subdomains at once?

No. Wildcard records do not work for DMARC the way they work for some other DNS record types. Each subdomain needs its own explicit _dmarc.hostname record.

Does setting up DMARC on a subdomain affect email deliverability for the parent domain?

No. These are independent. Configuring marketing.example.com has no direct effect on email sent from example.com. Each domain and subdomain is evaluated separately by receiving mail servers.

Last updated: 2026-08-21