Our _dmarc TXT record by default protects all subdomains, so an
adversary can't send mails on behalf of any subdomains (p=reject, p
stands for policy). We add a _dmarc.list TXT record with the same policy
to allow sending mails via list.pub.solar's postfix.
See https://dmarcly.com/blog/how-dmarc-works-with-subdomains-dmarc-sp-tag
for more context