Check your DMARC record and the policy that actually applies

Usually not. If the subdomain has no record of its own, receivers apply the organizational domain's policy, and the sp= tag on that record is what governs subdomains, falling back to p= when sp= is absent. Many checkers skip this and report "no DMARC" for a subdomain that is in fact fully covered, so a missing record on the subdomain alone is not evidence of a problem.

Start at p=none with a rua address so you collect reports without affecting delivery. Read the reports until you are confident every legitimate source is passing SPF or DKIM with alignment, then move to p=quarantine, and finally p=reject. Moving straight to reject before your reports are clean risks blocking your own mail.

pct= applies the policy to only that percentage of failing mail; the rest is treated as the next lower policy. So p=reject; pct=10 rejects a tenth of failing mail and delivers the other ninety percent as if the policy were none. Reporting a flat "reject" there overstates your protection, which is why this checker surfaces pct explicitly.