DMARC subdomain policy is none
The DMARC sp tag is none, so subdomains are not covered by a stricter policy.
Why it matters
A subdomain can still be used to send mail that fails alignment and is delivered.
What to do
Set sp=quarantine or sp=reject if subdomains should not send mail, or publish DMARC on the ones that do.
Reference
DMARC publishes policy for handling messages that fail SPF/DKIM alignment.