4 min read
Protecting parked and non-sending domains from spoofing
Domains and subdomains that never send mail are easy to spoof and easy to lock down. The three records to publish: SPF, DMARC and a null MX.
Why they matter
Attackers prefer domains that look official and have no protection. A parked domain, an old brand, or a spare domain bought defensively can all be used to send mail that appears to come from you, because nothing tells receivers to refuse it.
The three records
An SPF record that authorizes nothing, a DMARC record at p=reject, and a null MX that says the domain does not receive mail either.
v=spf1 -all
DMARC for the domain
Because the domain sends no mail, there is nothing legitimate to break, and you can publish p=reject straight away. Keep a reporting address so you learn if someone tries to use it.
v=DMARC1; p=reject; rua=mailto:your-report-address@example.com
A null MX
A null MX, defined in RFC 7505, is an MX record with priority 0 and a single dot as the host. It tells senders the domain does not accept mail, so they stop trying.
0 .
Subdomains of a domain that does send
If your main domain sends mail and you want its unused subdomains covered, the sp= tag in the main DMARC record sets the policy for subdomains that have no record of their own. Be careful: any subdomain that does send must be authenticated first.