Monitoring & Risk

Subdomain Monitor: find subdomains you forgot about

Your main domain can be at p=reject and still be abused through mail.old-project.example.com if that subdomain has weaker or no protection. Subdomain Monitor lists what exists and what each one is doing.

Where to find it

Monitoring & Risk → Subdomain Monitor

What you'll see

• Total subdomains found, and how many are new today.
• A table with first-seen and last-seen dates for each.
• An Inspect Details button on every row that opens DNS Inspector already filled in for that subdomain.

Closing the gap

By default, subdomains inherit your main domain's DMARC policy unless the record sets a separate subdomain policy with sp=. Check that your DMARC record's sp= is at least as strict as p=, and that no subdomain publishes its own weaker _dmarc record. Set a New Subdomain alert under Alerting to hear about new ones as they appear.