Subdomain policy weaker than the domain policy

Check id: dmarc.subdomain_weaker · fix effort: low

What it means

Your main domain is protected but your subdomains are held to a lower bar. Attackers spoof whatever's easiest.

The technical detail

sp= is weaker than p=. Mail spoofing anything.yourdomain.com bypasses your enforcement.

How to fix it

1. Remove sp= (subdomains then inherit p=) or set it to the same level.