Protect domains that never send email

What it means

Many businesses own domains they never use for email: a spelling variant, an old company name, a domain kept for a future project, a country version that only redirects to the main website.

A domain with no email records gives receivers no instructions. Scammers like these domains: they can send phishing "from" them, and receivers have no clear reason to refuse it.

Why it matters

• Phishing using your brand on a spare domain still damages your name.
• Backscatter: when spam with your domain bounces, the bounces may come back to you.
• It takes five minutes and costs nothing.

How to check

Type each unused domain at /domain-scanner. A domain that does not send email should show a strict SPF, a DMARC record with p=reject and no MX, or a "null MX".

How to fix it

Open the DNS provider of each unused domain and add these records.

1. Null SPF: no server at all may send for this domain.

   yourdomain.com  TXT  "v=spf1 -all"

2. DMARC reject: refuse any email that claims to come from it.

   _dmarc.yourdomain.com  TXT  "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"

   You can add rua=mailto:dmarc@yourmaindomain.com to receive reports about abuse attempts. Sending reports to an address on another domain may need an extra authorization record on that domain; check your DMARC reporting service's instructions.
3. Null MX if the domain should not receive email either. It tells senders immediately that the domain accepts no email, instead of letting them retry for days:

   yourdomain.com  MX  0  .

   The value is a single dot with priority 0. Remove any other MX record first. Some DNS panels do not accept a lone dot; in that case simply have no MX record.

Optional: revoke DKIM

Some experts also publish an empty DKIM key for all selectors, so any signature using the domain fails:

*._domainkey.yourdomain.com  TXT  "v=DKIM1; p="

It is not required: SPF -all plus DMARC p=reject already make every email fail.

Be careful

• Be sure the domain really never sends, not even a website form, a printer, an invoice tool or an old mailbox. These records block all of them.
• Do not use null MX on a domain that receives email, even for one forwarding address.
• Do this for subdomains you do not use too: sp=reject on your main domain protects all of them at once.
• Keep the domains renewed: an expired domain can be bought by someone else, with all its history.

Check that it is fixed

Wait a few minutes for DNS to update, then run the Domain scanner again on each domain. It should find v=spf1 -all, a DMARC record with p=reject, and either the null MX or no MX at all. Repeat the check whenever you buy a new domain.