The sp tag sets the DMARC policy for subdomains of your domain. If you omit it, subdomains inherit the main p policy. Use sp=reject to lock down every subdomain — including unused ones attackers love to spoof — even while you ramp the main domain more slowly.
With no sp tag, a subdomain follows p. Add sp= to override: e.g. p=quarantine; sp=reject keeps the org domain cautious while hard-blocking spoofed subdomains.
The newer np tag sets a policy specifically for non-existent subdomains — a strong control, since attackers invent subdomains that were never used.
Check your DMARC record now
Open the free DMARC checker →Not necessarily — they inherit the org domain’s policy (or its sp). Publish a separate record on a subdomain only when you want different settings or reporting for it.
