For any domain that should never send or receive email, publish three DNS records: SPF v=spf1 -all, a null MX of 0 ., and a DMARC policy of reject. Attackers favor unused domains because nobody watches them, and a spoofed message from your name still reads as yours.
Why dormant domains matter
Companies accumulate domains: old brands, typo variants, product names that never launched, defensive registrations. If none of them publish email authentication, a receiver has no instruction on what to do with mail claiming to be from them. Spoofers look for exactly that.
The three records
SPF. RFC 7208 says publishing SPF records for domains that send no mail is a well-established best practice, and gives the record:
example.net. IN TXT "v=spf1 -all"
Null MX. RFC 7505 defines a null MX, which tells senders the domain accepts no mail. It is a single MX record with preference 0 and a root dot as the exchange. A domain that advertises it must not publish any other MX record:
example.net. IN MX 0 .
Without it, senders fall back to the domain's A or AAAA address and may retry delivery for a long time, typically about a week, before giving up. A null MX makes delivery fail immediately and helps people notice mistyped addresses.
DMARC. A reject policy, with reporting so you can see abuse attempts:
_dmarc.example.net. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.com"
With no sending at all, there is no legitimate mail to break, so you can go straight to reject. Do not skip the rua tag, since the reports show you who is trying to use the name.
Process for your whole portfolio
- Build a list of every domain the company owns, from the registrar accounts and DNS providers. Missing domains are the main risk.
- Mark each as sending, receiving only, or neither.
- Apply the three records to every domain in the neither group.
- For subdomains of a sending domain that never send, rely on the parent's sp policy or add explicit records. See the subdomain post.
- Add the check to your domain registration process, so new domains get the records on day one.
If you cannot list your domains, discovery comes first. Safeguard's asset discovery can help build an inventory of internet-facing assets, though your registrar account list remains the authoritative source for names you own.
Quick check
Will these records stop someone from spoofing my active domain?
No. They protect domains that send no mail. Your active domain needs aligned SPF or DKIM and a DMARC policy at quarantine or reject.
Sources
Last reviewed: 19 October 2026.
