Do subdomains inherit root domain authentication automatically?

Short answer: no. Subdomains don't automatically inherit the authentication records you've set up on your root domain. If you start sending from marketing.yourdomain.com or transactional.yourdomain.com, you're starting from scratch on authentication unless you set it up explicitly.

Here's how it breaks down for each protocol.

SPF does not inherit at all. An SPF record lives at a specific domain in DNS. If you publish one at yourdomain.com, it covers mail sent from yourdomain.com. Mail sent from news.yourdomain.com needs its own SPF record at news.yourdomain.com. No record means no pass, and a missing SPF record on a sending subdomain is a surprisingly common reason authentication fails quietly after you spin up a new subdomain.

DKIM also doesn't inherit. DKIM works through selector records published in DNS, and those selectors have to match the sending domain. Your ESP or mail platform generates a key pair for a specific domain, and you publish the public key at a selector under that domain. A subdomain needs its own selector configured by your sending platform, or DKIM simply won't sign correctly for that subdomain.

DMARC is the one partial exception. If a subdomain doesn't have its own DMARC record, receiving mail servers fall back to the organizational domain's DMARC policy. You can also use the sp= tag in your root DMARC record to set a specific policy just for subdomains (for example, sp=reject while keeping p=none on the root during a rollout). That said, relying on fallback isn't a great long-term plan. Subdomains that send regularly deserve their own DMARC record so you get visibility into their authentication results in your aggregate reports.

The practical takeaway: before you send from any new subdomain, check that SPF and DKIM are explicitly configured for it. Don't assume the root domain's setup covers you. You can verify your subdomain's SPF record with our free SPF checker, or use the DKIM lookup tool to confirm your selector is resolving correctly. If you're unsure where to start, our SOS hotline is free and we actually pick up.