We have mail server in G Suite using our primary domain. say abc.com. To help prevent spoofing on emails sent from our domain, We have enabled SPF, DMARC, and DKIM security methods on G Suite. All the email sending from domains abc.com is now monitored with DMARC reports enabled.

Similarly, we would like to ask about securing subdomains level spoofing. One of our customers reported spoofing emails from subdomains, for e.g.: an email pretends to from one of our subdomains xyz.abc.com. Below is the exact example;

---------- Forwarded message ---------
From: IG <[email protected]>
Date: Wed, Nov 18, 2020 at 1:13 PM
Subject: "your boredom solution"
To: <[email protected]>

We have not set any email server on our subdomain xyz.abc.com, But spammers used the subdomains to send emails on our behalf. I am aware that I can add a subdomain on the G Suite and generate the DKIM and DMARC records for it after adding MX records. But I am sure that is not effective for this kind of subdomain level spoofing since we have a large no of subdomains and spammers can use any one of them for spoofing.
I have no plans for mail server setup for our subdomains for security since we are not sending or receiving any emails from those subdomains. We have primary domain as mail server.

Please assist us. It would be grateful if you could help us to know that how can I prevent these types of fraudulent emails from spammers to our customers. Also, I am aware that they can use any prefix to our domain to send an email. How I can act to prevent spammers who forge my subdomains to send fake messages that appear to come from my organization. Please let me know if there are tools available, that we need to implement to mitigate this risk.

  • Per DMARCLY: >This can be achieved by setting your organizational domain's policy to p=reject, and don't override it on any subdomains. This way, all the subdomains under your organizational domain will have p=reject, and no one without explicit authorization can deliver emails on behalf of your organization. That is, assuming the mailboxes receiving the mail respect the DMARC policy. Apr 25 at 21:35
  • I’m voting to close this question because it's about administering an email service. It might be on-topic in Server Fault. Another related site is Information Security. Apr 26 at 14:21

1 Answer 1


DMARC is to monitor incoming emails, not sending emails from your domain.

If i will send now an email from my server using your domain to one of your emails then you shouldn't receive that email because of your DMARC policy.

However if i send the same email to someone else that is not from your domain then that person will receive the email if his domain doesn't have DMARC policy enabled.

DMARC will filter incoming emails to your domain, all emails and if the email is not authenticated with its own domain then it is mark as spam or fake and you won't receive if your DMARC policy is p=reject.

So anyone can use your domain to send emails, but what is important is if the receiver domain has DMARC policy to reject those emails that are not authenticated. Some filters are on the email service provider, for example if you have gmail then Google has its own filter as well.

Hope this helps.

Not the answer you're looking for? Browse other questions tagged or ask your own question.