Each DNS name has its own records, and a subdomain is a different name. Whether it needs its own email records depends on the record.
SPF and MX records are read at the exact name that sends or receives email. If mail comes from news.example.com, that name needs its own SPF record, and its own MX records if it receives mail.
A DKIM key is looked up at the selector name under the signing domain. The domain in the signature decides where the receiver looks, so a subdomain that signs needs its key published there.
If a subdomain has no DMARC record, receivers use the one from the main domain. The sp= tag in that record sets the policy for subdomains separately from the main domain.
A subdomain used by an email service can fail checks even though the main domain passes. Checking each sending name separately avoids surprises.
DNS Domain Detective checks a domain or subdomain you enter, so you can look at each name on its own. Open DNS Domain Detective
DNS Domain Detective is now available on the App Store.
Last reviewed: 2026-11-02
#DNS #DKIM #SPF #DMARC #EmailSecurity #SysAdmin #MSP #iOS
This page gives general information and is not legal, financial or medical advice. [email protected]