Setup guides

Null MX record: how to tell the world a domain receives no email

By iBlockSpam Team How we check our guides Updated Oct 22, 2026 9 min read 6 sources

Short answer

A null MX is a single MX record with priority 0 and a single dot as its target (example.com. MX 0 .). Defined in RFC 7505, it tells senders the domain accepts no email, so mail fails at once with a clear error instead of being retried for days. Use it only on domains that never send or receive mail.

On this page 10 sections

A null MX is a one-line DNS record that says "this domain receives no email." It turns a slow, confusing failure (senders retrying for days against your web server) into an immediate, clearly worded bounce. This guide covers the exact record, how to add it at a DNS host, what senders and receivers do with it, and the cases where it will break mail you actually need.

What is a null MX record?

A null MX record is an MX (mail exchanger) record with a priority of 0 and a target of a single dot (.), defined in RFC 7505. An MX record normally names the server that accepts mail for a domain. The null MX names no server at all, so it tells every sender that the domain doesn't accept email.

In a zone file it looks like this (example):

example.com.  3600  IN  MX  0 .

RFC 7505, section 3 sets two rules:

The record has "preference number 0 and a zero-length label, written in master files as '.'". Because "." isn't a valid host name, a null MX can't be mistaken for a real mail server.
"A domain that advertises a null MX MUST NOT advertise any other MX RR." The null MX has to be the only MX record on that name.

If you need a refresher on priorities and targets, read what is an MX record or our guide to MX priority and backup MX.

Why not just leave the MX record out?

Leaving the MX record out does not mean "no email". RFC 5321, section 5.1 says that if a domain has no MX records, the address "is treated as if it was associated with an implicit MX RR, with a preference of 0, pointing to that host." In other words, senders try the domain's own A or AAAA record, which is usually your web server.

RFC 7505's introduction describes the result: if nothing listens for mail at that address, "message delivery will be attempted repeatedly for a long period, typically a week, before the sending Mail Transfer Agent (MTA) gives up." The person who mistyped an address finds out days later, and your web server collects the connection attempts.

What the domain publishes	What a sender does	What the person sending sees
Normal MX records	Delivers to the listed mail servers	Normal delivery
No MX, but an A/AAAA record	Tries the web server's address as an implicit MX, then retries	A delay notice, then a bounce days later
No MX and no A/AAAA	Reports an error	A bounce, often with a vague "host not found" reason
Null MX (`MX 0 .`)	Stops at once, no connection attempt	An immediate bounce: `556 5.1.10` "Recipient address has null MX"

RFC 7505, section 4.1 lists the benefits: typos like alice@www.example.com fail "when the user sends the message, rather than hours or days later", bounces to forged return addresses on spam "can be disposed of efficiently", and sending servers avoid "queuing and retries".

Which domains should get a null MX?

A null MX fits any domain or host name that never receives mail. Typical candidates:

Parked and defensive domains: typo variants, old brand names and country versions you own but don't use for email. Our parked domain guide covers the full record set for these.
Web-only host names: www, shop, cdn or app names that have an A or CNAME record and would otherwise act as implicit mail servers.
Retired company domains: once mail on an old domain has been redirected, forwarded for a reasonable period and switched off.

In our scan of the Tranco top 1,000 domains in October 2026, 9 domains published a null MX. Most large brands still leave web-only and parked names without one.

When should you not use a null MX?

Don't publish a null MX on any name that sends mail, receives mail, or receives bounces. RFC 7505, section 4.2 is direct: "mail systems SHOULD NOT publish a null MX record for domains that they use in RFC5321.MailFrom or RFC5322.From addresses. If a system nonetheless does so, it risks having its mail rejected."

That rules out:

Your main sending domain, even if inbound mail goes somewhere unusual. If it receives any mail, it needs real MX records.
Bounce or return-path subdomains that an email service provider uses in the envelope sender (for example, a bounces.example.com name you set up for a newsletter platform). Receivers check that these can accept bounces.
Domains with mail forwarding at the registrar or host. A null MX switches forwarding off for everyone.
Domains where you might add mail later. It's easy to remove, but anyone who emails the domain in the meantime gets a permanent failure, not a delay.

A website contact form that sends notifications "from" noreply@yourdomain counts as sending. Either send those from a properly authenticated domain or treat this domain as a sending domain.

What happens to mail sent to a null MX domain?

The sender's own mail server stops the message before it ever leaves. RFC 7505, section 4.1 says a submission or relay server that rejects a recipient because of a null MX "SHOULD use a 556 reply code" and "a 5.1.10 enhanced status code (Permanent failure: Recipient address has null MX)". The 556 code itself comes from RFC 7504, which created it "to support the new tests and actions specified in RFC 7505."

A bounce for this case might read like this (example):

556 5.1.10 <alice@example.com>: Recipient address rejected:
Domain example.com does not accept mail (nullMX)

The exact wording depends on the sender's software. Our 556 5.1.10 error page explains what the sender should do. Note that Microsoft 365 also uses 5.1.10 for a different problem, "Recipient not found", described on the 550 5.1.10 page. Read the text, not just the number.

What happens to mail sent from a null MX domain?

Receivers can reject it, because there's nowhere to send a bounce. RFC 7505 says servers that reject mail because the envelope sender or From domain has a null MX "SHOULD use a 550 reply code" and "a 5.7.27 enhanced status code (Permanent failure: Sender address has null MX)". The IANA enhanced status code registry lists both X.1.10 and X.7.27.

Real servers act on this. The Postfix documentation for reject_unknown_sender_domain says the reply is 550 for a null MX sender domain ("nullmx, Postfix 3.0 and later"), and reject_unknown_recipient_domain returns 556 for a null MX recipient domain. So a null MX on a domain you do send from is a reliable way to get your own mail refused.

How do you add a null MX record?

At most DNS hosts, a null MX is a normal MX record with a dot as the mail server. DNSimple's instructions, for example, say to leave the Name field blank or enter @, set Priority to 0, and set Mail server to a single period. Field names differ between hosts, so check your host's help pages at the time you make the change.

Confirm nothing uses the name for mail. Check mailboxes, forwarders, contact forms, and any email service that uses it as a bounce domain.
Write down the current records. Run the domain through MX Lookup and keep a copy so you can roll back.
Delete every existing MX record on that name. RFC 7505 forbids mixing a null MX with any other MX.
Add the null MX. Type MX, Name @ (or the host name, such as www), Priority 0, Value ..
Add the matching sender records. RFC 7505 points non-sending domains to an SPF record with -all. Publish v=spf1 -all and a DMARC record of v=DMARC1; p=reject;. The SPF Generator and DMARC Generator build both.
Verify. Run dig MX example.com +short. The expected answer is 0 .. Then run the Email Health Check, which recognizes a null MX domain.

DNS host quirks to watch for

Hosts that won't accept a dot. A control panel may reject . as a mail server value, or treat it as a relative name and append your domain (example.com.). That would create a normal MX pointing at your web server, which is worse than nothing. Check the published answer with dig after saving. If your panel can't store a null MX, ask the host's support or move DNS to a host that can.
Hosts that create one by accident. In our MX change guide we warn that some panels write 0 . when a mail server field is left empty. Check that your real domains haven't picked one up.
Hosts that add their own MX. Some registrars add default MX records for their mail or forwarding service. Delete them, or the record set breaks RFC 7505.

Does a null MX cover subdomains?

No. A null MX applies only to the exact name that publishes it. example.com MX 0 . says nothing about billing.example.com. Each name that might receive mail needs its own record, or a wildcard such as *.example.com MX 0 ..

A wildcard answers only for names that have no records of their own, so a host name like www with its own A or CNAME record isn't covered by *.example.com. Add an explicit null MX next to the A record for those names. One exception: a name that is a CNAME can't hold any other record type, so a null MX can't sit beside it. The parked domain checklist has the full pattern for subdomains, and the DMARC subdomain policy guide explains how DMARC covers them.

Common null MX mistakes

Mistake	What happens	Fix
Null MX plus an old MX record	Breaks RFC 7505; senders may still deliver to the old host	Keep only `0 .`
Null MX on a domain you send from	Receivers can reject your mail with `550 5.7.27`	Use real MX records
Target saved as `example.com.` instead of `.`	A normal MX that points at your web server	Re-enter the value and check with `dig`
Null MX with no SPF or DMARC	Mail can't arrive, but forgers can still send as you	Add `v=spf1 -all` and `p=reject`
DMARC `rua` address on the same domain	Reports can't be delivered to a null MX domain	Send reports to a domain that accepts mail
Forgetting `www` and other host names	Those names still act as implicit mail servers	Add explicit null MX records

Next steps

List every domain and host name you own that never receives mail, and check each one with the free MX Lookup.
Publish MX 0 ., v=spf1 -all and a DMARC reject record on each one, using the procedure above.
Re-check after any DNS host or registrar move, because records don't always survive a transfer.
To get an email when a domain's MX, SPF or DMARC records change, sign up for the Free Domain Watch, which checks public records weekly.

Browse our other email setup guides.

Frequently asked questions

What does MX 0 . mean in DNS?

It is a null MX record. The 0 is the priority and the single dot is an empty host name, which RFC 7505 uses to mean that no mail server exists for the domain. Any sender that looks up the domain learns straight away that it accepts no email and should fail the message immediately.

Is a null MX the same as having no MX record?

No. With no MX record at all, RFC 5321 tells senders to try the domain's own A or AAAA address as an implicit mail server, so mail can be retried for days against your web server. A null MX states that no mail server exists, so senders give up on the first attempt with a clear error.

Can I send email from a domain that has a null MX?

You shouldn't. RFC 7505 says mail systems should not publish a null MX for domains they use in the envelope sender or the From address, and warns that such mail risks rejection. Postfix, for example, can reject such mail with a 550 5.7.27 error, because bounces could never be returned.

What error do people get when they email a null MX domain?

RFC 7505 says the sending or relay server should reject the recipient with reply code 556 and enhanced status code 5.1.10, Recipient address has null MX. In practice the sender usually gets a bounce from their own provider within seconds, rather than a delay warning hours later.

Does a null MX record stop spoofing of my domain?

Not on its own. A null MX only covers incoming mail. To stop others sending as the domain, also publish an SPF record of v=spf1 -all and a DMARC record with p=reject. RFC 7505 itself points domains that send no mail to an SPF -all policy.

Sources

See how your domain measures up

Run a free Email Health Check: MX, SPF, DKIM, DMARC and transport security in one scan, with the raw records shown. No sign-up.

Keep reading