Subdomain Security Checker
Discover email authentication gaps across all your subdomains and sending infrastructure - before attackers exploit them. We find your subdomains, then check SPF, DKIM, and DMARC (including inherited policy) on every one.How the Subdomain Security Checker Works
Subdomains are the most overlooked attack surface in email security. This tool discovers them, then checks each one for DMARC, SPF, and DKIM coverage and flags which are open to spoofing.
1
Enter your root domain
Type your primary domain (e.g. company.com). The scanner discovers subdomains from public Certificate Transparency logs and by probing common mail, marketing, support, dev, and transactional names.
2
Authentication checks run
Each resolving subdomain is checked for a valid SPF record, DKIM signatures at common selectors, and its effective DMARC policy - including protection inherited from the parent domain's sp= or p=.
3
Get a prioritized action list
See which subdomains are vulnerable, which need improvement, and get specific remediation steps ordered by risk - so your team knows exactly what to fix first.
Why Subdomain Email Security Matters
Organizations typically lock down their root domain but leave subdomains unprotected. Attackers know this - and actively exploit subdomain email infrastructure to bypass filters and spoof trusted brands.
Subdomains can be spoofed independently
A DMARC policy on your root domain does not automatically protect subdomains. Without inheritance or their own record, attackers can freely send email from
How to protect subdomains → support.yourdomain.com, mail.yourdomain.com, and more.p=none gives attackers a free pass
A DMARC record with
Understanding DMARC p=none → p=none only monitors - it does not block or quarantine spoofed email. Subdomains stuck in monitoring mode are effectively unprotected from a deliverability standpoint.Subdomain inheritance explained
If a subdomain has no DMARC record, receivers fall back to the root domain's
DMARC subdomain policy guide → sp=, or its p= if there is no sp=. Most organizations never set sp=, so this tool computes the real effective policy for each subdomain.Common Subdomain Email Security Vulnerabilities
These are the most common gaps our scanner finds across subdomain infrastructure - and what to do about each one.
No DMARC record
Missing DMARC on subdomain
The most critical finding. Without a DMARC record - and without an enforced parent policy to inherit - anyone can send email from the subdomain and it passes unauthenticated. Receiving servers have no policy to enforce.
Add a DMARC TXT record at
_dmarc.subdomain.yourdomain.com with at minimum p=quarantine. DMARC p=none
Policy too weak to block spoofing
A policy of
p=none means monitoring mode only. Spoofed emails still reach inboxes - the policy generates reports but takes no enforcement action.Upgrade to
p=quarantine once you have reviewed your reports, then advance to p=reject. No SPF record
Missing SPF on subdomain
Without SPF, receiving mail servers cannot verify that the sending server is authorized to send from the subdomain. It is required for DMARC alignment and baseline deliverability.
Add a TXT record at the subdomain:
v=spf1 include:youresp.com ~all - use your ESP's documented include. Inherited-only protection
Relying on the parent policy
A subdomain with no record of its own but covered by the root's
sp=reject is protected against spoofing - but has no reporting, no explicit control, and can send its own legitimate mail into rejection if it is not aligned.Publish a dedicated DMARC record on each sending subdomain rather than leaning on inheritance.
Frequently Asked Questions
Does my root domain DMARC policy protect subdomains?
Not automatically. A DMARC policy applies to the exact domain it is published on. Subdomains are covered by the root's policy only if the root record includes a subdomain-policy tag -
sp=quarantine or sp=reject. If there is no sp=, receivers fall back to the root's p= for subdomains. Either way, a subdomain with its own DMARC record always overrides the parent. This tool computes the effective policy for you.What is subdomain spoofing and how does it work?
It is when an attacker forges the "From" address using a subdomain of your domain - for example
[email protected]. If that subdomain has no effective DMARC enforcement, receiving servers have no policy telling them to reject the message. Because the subdomain is associated with a trusted brand, these attacks succeed at high rates against employees, customers, and partners.How does the scanner discover my subdomains?
Two ways, combined. First we query public Certificate Transparency logs (crt.sh) for names that have been issued TLS certificates. Second we actively probe a curated list of common email and infrastructure subdomains over DNS. We then check which names actually resolve. Discovery is never exhaustive - internal-only or brand-new subdomains may not appear - but it surfaces the attack surface most organisations overlook.
Should I add DMARC to non-sending subdomains too?
Yes. Non-sending subdomains are frequently targeted precisely because organisations assume they need no protection. For a subdomain that never sends mail, publish a DMARC record with
p=reject and an SPF record of v=spf1 -all. That tells receivers to reject any message claiming to come from it.What does "Vulnerable" mean in the results?
Vulnerable means the name has no effective DMARC enforcement - it has no DMARC record and no enforced parent policy, or its effective policy is
p=none (monitoring only). Spoofed mail from it can reach inboxes. "Warning" means it is enforced but relies only on the parent policy, is missing SPF, or is otherwise incomplete. "Secure" means it has its own DMARC record at p=quarantine or p=reject.Is DKIM detection definitive?
No. DKIM keys live at selector-specific names we cannot enumerate from DNS, so we probe a small set of common selectors. "Detected" is reliable, but "Not detected" only means none of the common selectors matched - a custom selector may still be in use. That is why DKIM does not by itself mark a subdomain as vulnerable in this tool.
How do I protect all my subdomains at once?
For immediate, blanket coverage set
sp=reject on your root domain's DMARC record - it covers every subdomain that has no policy of its own. Then work through each sending subdomain to configure proper SPF, DKIM, and its own DMARC. A hosted platform like PowerDMARC lets you manage every policy centrally, alerts you when new subdomains appear, and guides you to p=reject safely with aggregate and forensic reporting.More Free Email Authentication Tools
Verify your full email authentication stack with PowerDMARC's free tool suite.
DMARC Checker
Validate your DMARC record and enforcement policy.
Check DMARC →SPF Record Checker
Validate your SPF record for authorized senders.
Check SPF →DKIM Checker
Look up and validate DKIM records for any domain.
Check DKIM →Sender Reputation
Score a domain's full email authentication posture.
Check reputation →Protect every subdomain with PowerDMARC
Centrally manage DMARC policies across all your domains and subdomains, get real-time forensic alerts, and reach enforcement without complexity.
