For a domain that sends and receives no mail, publish three DNS records: an SPF record of v=spf1 -all, a DMARC record with p=reject, and a null MX record. Together they tell receivers that no server is authorised to send as the domain and that nothing should be delivered to it.
Why bother
Companies hold many domains: old brands, typo variants, product names bought for a launch that never happened. A domain with no mail records is easy to abuse, since anyone can put it in a From address and receivers have no instruction to reject the message. Our post on protecting parked domains from spoofing covers the threat. This one is the record by record how to.
The three records
1. SPF that authorises nobody. RFC 7208 states that publishing SPF records for domains that send no mail is a well established practice, and gives the example record v=spf1 -all. The all mechanism with a minus matches every sender and returns a fail.
2. DMARC that rejects. Publish a policy at the underscore dmarc name of the domain:
_dmarc.example.org. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
Point the reporting address at a mailbox you control. If that mailbox is on a different domain from the one in the record, check how your DMARC reporting tool handles external report addresses.
3. A null MX. RFC 7505 defines the No Service MX record, informally the null MX, as a way for a domain to say it accepts no mail. Without any MX record, senders fall back to the A or AAAA record and try to deliver there. The null MX makes delivery attempts fail immediately. The record is an MX with preference 0 and a single dot as the target:
example.org. IN MX 0 .
Subdomains
DMARC set at the organisational domain applies to subdomains by default, unless they publish their own record or you set the sp tag. The np tag from the updated DMARC specification covers non-existent subdomains. A spoofer may invent a hostname that never existed, so the np policy is worth setting. See our explainer on sp and np tags.
Add the SPF and null MX records on any real subdomain that exists and does not send, as SPF is looked up per hostname.
Rollout steps
- Confirm the domain sends nothing. Check mail logs, any app config and your sender register. A forgotten marketing tool counts.
- Publish SPF, DMARC and null MX together.
- Use a short DNS TTL for the first day, then raise it.
- Send a test from another account using the domain in the From address. Confirm it fails.
- Watch the aggregate reports for a few weeks. Unexpected passing mail means something does send.
- Put the domain in your inventory with an owner and a renewal date.
What this does not fix
A lock on mail does not stop a lookalike domain registered by someone else, and it does not protect the web side. Keep the registration safe with the registrar checklist, and delete DNS records that point at services you no longer use.
For your code and dependencies, Safeguard provides SBOM and dependency scanning. The free scan is at gold.safeguard.sh/scan.
Quick check
Is p=reject risky on a domain that sends nothing?
Not if you have confirmed nothing sends. Start with reports if unsure, but a truly silent domain gains protection from reject straight away.
Do I need all three records?
Each does a different job. SPF and DMARC stop spoofed mail being accepted, and the null MX stops delivery attempts to the domain. Publish all three.
Sources
Last reviewed: 19 October 2026.
