Guides · Updated 2026-10-11

How to protect domains that never send email

Attackers love unused domains because nobody watches them. If a domain never sends or receives mail, publish:

• SPF: v=spf1 -all (no server may send).
• DMARC: v=DMARC1; p=reject; sp=reject; rua=mailto:…
• Null MX (RFC 7505): an MX record with priority 0 and target ., declaring the domain accepts no mail.

You can also publish an empty DKIM wildcard key if your DNS host supports it, but SPF and DMARC are what matter. Check the result with our checker.

Sources

• RFC 7505: Null MX
• M3AAWG: Protecting parked domains
• RFC 7489: DMARC

This guide is general information, not legal or professional advice. Provider screens change; always confirm the exact values shown in your own account.