Which half of the estate first

After this lesson you can

Choose between enforcing the apex and enforcing subdomains first, and defend the order.

Assumes you have read sp and np and Evidence before policy.

p and sp can move independently, so enforcement is two decisions rather than one. Which goes first depends on where your unknowns are, and for most organisations the answer is not the apex.

Two shapes, both defensible

p=none;    sp=reject     subdomains enforced first
p=reject;  sp=none       apex enforced first
p=quarantine; sp=reject  apex behind subdomains  (github.com, apple.com)
p=reject;  sp=none; np=reject   apex + non-existent, subs exempt  (gov.uk)

Subdomains first

This is right when subdomains are used for a small number of controlled streams and the apex carries everything else — human mail, legacy systems, whatever a decade of vendors left behind. The controlled half is enumerable; the apex is not yet.

The enforced half is the one you can actually finish inventorying.
A mistake affects a known, narrow stream rather than all company mail.
np=reject can come at the same time and costs nothing.

The apex first

gov.uk does the opposite, for a reason specific to its structure: the apex is centrally operated and fully known, while the subdomains are delegated to hundreds of departments at every conceivable stage of readiness. The half you control is the apex, so that is the half you enforce.

$ dig +short TXT _dmarc.gov.uk

"v=DMARC1;p=reject;sp=none;np=reject;adkim=s;aspf=s;fo=1;
  rua=mailto:dmarc-rua@dmarc.service.gov.uk"

Checked 2026-09-15.

Note that np=reject sits alongside sp=none. Non-existent subdomains are enforced hard even while existing ones are exempt, because a name with no DNS records has no department behind it to break.

The rule underneath both

Enforce the half whose senders you have finished enumerating. That is the entire principle; which half that is depends on how your organisation is shaped rather than on any general best practice. If the answer is neither, you are not ready to enforce anything and the work is inventory, not policy.

np=reject is nearly always available early

Whatever order you choose for p and sp, non-existent subdomains can usually be rejected from the start. Nothing legitimate originates from a name that does not resolve, so there is no population to break — and it closes the easiest spoofing shape immediately.

Knowledge check

Your subdomains are used by three well-documented platforms. The apex carries mail from systems nobody has fully inventoried. Where do you enforce first?

Subdomains, via sp — the enforced half should be the one whose senders you have finished enumerating.
The apex, since it carries the most valuable mail and therefore the most spoofing risk.
Both at once, so the policy is consistent across the estate.
Neither — use pct to enforce a fraction of both.

Correct — Subdomains, via sp — the enforced half should be the one whose senders you have finished enumerating. Enforcement is safe exactly where the inventory is complete. Three documented platforms can be verified; an apex with unknown senders cannot, and a mistake there affects all company mail.

Not this — The apex, since it carries the most valuable mail and therefore the most spoofing risk. Value is a reason to want enforcement, not evidence that it is safe. Enforcing an unfinished inventory rejects your own mail.

Not this — Both at once, so the policy is consistent across the estate. Consistency is not a goal in itself, and sp exists precisely so the halves can move independently when they are ready at different times.

Not this — Neither — use pct to enforce a fraction of both. That randomises which mail is affected rather than reducing risk, and it makes the reports harder to read at the moment you most need them.

Last reviewed 2026-09-15

Which half of the estate first

Two shapes, both defensible

Subdomains first

The apex first

The rule underneath both

Try it on a real domain