## TL;DR
A legitimate subdomain usually fails for one of two reasons: the subdomain inherited a strict parent policy, or the mail is authenticated only under a different domain. Subdomains without their own DMARC record inherit the organisational domain policy, including alignment mode. Check for a record at _dmarc on the subdomain itself, then check whether SPF or DKIM uses the exact subdomain.

```text
dmarc alignment failed for legitimate subdomain
```

## Use this when
- Mail From a subdomain such as billing or alerts fails DMARC while root-domain mail passes.
- A new subdomain sender was launched and receivers started rejecting or junking it.

## Not for this skill when
- The root domain itself fails alignment. Use the general alignment fix instead.
- The subdomain mail is actually unauthorised. Do not align a sender you do not control.

## Steps
1. Query DNS for a TXT record at _dmarc for the subdomain and for the parent domain. Verify: you know which record actually governs the subdomain.
2. Read the failing headers and note whether SPF or DKIM authenticated the subdomain, the parent, or a third party domain. Verify: the authenticated domain is identified.
3. If alignment is strict in the inherited record, publish a subdomain DMARC record with relaxed alignment, or align authentication exactly to the subdomain. Verify: the published record matches the intended mode.
4. If a vendor sends for the subdomain, give it a dedicated subdomain return path and a DKIM selector published under that subdomain. Verify: vendor mail now authenticates under the subdomain.
5. Send test mail from the subdomain to a mailbox that shows Authentication-Results. Verify: dmarc=pass with the subdomain as the From domain.

## Variant phrasings
### subdomain dmarc record inherits parent policy
The inheritance variant when no subdomain record exists.
### dmarc spf alignment subdomain relaxed vs strict
The mode comparison variant.

Compatibility: RFC 7489 organisational domain and subdomain policy inheritance, Google Workspace and Microsoft 365 sending.

## Why it happens
Receivers look up DMARC at the exact From domain first. Without a subdomain record they fall back to the organisational domain record and apply its policy and alignment modes. Teams often authenticate subdomain mail under the parent or a vendor domain and are surprised when strict settings reject it.

## Edge cases / pitfalls
- Publishing p=none on the subdomain only changes enforcement, not alignment. A non-aligned message still reports fail.
- A separate subdomain record is also the safe way to quarantine one noisy stream without tightening the whole domain.
- Wildcard DNS records can create a misleading _dmarc answer. Query the exact name.

## Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Fr9FJx6HFW4FWBJD8Ihipw