# How to protect parked and non-sending domains from spoofing

URL: https://iblockspam.com/blog/protect-parked-domains-from-spoofing
Last updated: 2026-10-09
Published: 2026-10-09
Topic: SPF, DKIM & DMARC
Author: iBlockSpam Team

> Lock down domains that never send email: Null MX, SPF -all, DMARC p=reject, the optional empty DKIM key, and subdomain wildcards, with a copy-paste checklist.

## Short answer

For a domain that never sends or receives email, publish three DNS records: a Null MX (MX 0 .), an SPF record of v=spf1 -all, and a DMARC record with p=reject. Together they tell receivers that any message using the domain is forged. Add wildcard SPF and MX records to cover subdomains.

Most businesses own more domains than they use: old brand names, typo variants, country versions and defensive registrations. If those domains have no email records at all, attackers can send mail "from" them and receivers have nothing to check against. A few DNS records turn each one into a domain that receivers can reject outright.

## Why do parked domains get spoofed?

Anyone can put any domain in the From line of an email. CISA's guidance on [BOD 18-01](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security) says it directly: "Even if you do not send mail from your domain, anyone can spoof it to give the appearance that mail is coming from you."

Parked domains are attractive because:

- They look official. `yourbrand.net` or an old company name is convincing in an invoice scam.
- Nobody watches them. There are no reports, no users and no complaints.
- Receivers have nothing to check. With no SPF and no DMARC, a forged message isn't "failing" anything.

[M3AAWG](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg_parked_domains_bcp-2022-06.pdf) adds that domains similar to well-known domains are especially vulnerable. The fix is to publish records that say "this domain sends no mail and receives no mail", so receivers can reject forgeries. For domains that do send mail, see [how to stop spoofing of your domain](https://iblockspam.com/blog/stop-email-spoofing-of-your-domain).

## Which DNS records does a parked domain need?

The core records come from M3AAWG, the [UK NCSC](https://www.ncsc.gov.uk/blog-post/protecting-parked-domains) and Microsoft's own guidance. All three recommend the SPF and DMARC records; M3AAWG and the NCSC add the Null MX:

| Record | Name | Value | What it says |
|---|---|---|---|
| MX (Null MX) | `example.com` | `0 .` | This domain accepts no mail |
| TXT (SPF) | `example.com` | `v=spf1 -all` | No server may send mail for this domain |
| TXT (DMARC) | `_dmarc.example.com` | `v=DMARC1; p=reject;` | Reject any mail using this domain that fails DMARC |
| TXT (DKIM, optional) | `*._domainkey.example.com` | `v=DKIM1; p=` | No valid signing keys exist |

### Null MX

A Null MX ([RFC 7505](https://www.rfc-editor.org/rfc/rfc7505.html)) is a single MX record with priority 0 and a target of `.`. It tells senders that the domain accepts no mail, so delivery fails immediately instead of being retried for days. RFC 7505 says a domain with a Null MX must not publish any other MX record. It also gives receivers a reason code: mail from a sender domain with a Null MX can be rejected with `550 5.7.27`, "Sender address has null MX".

M3AAWG explains why it matters even for web-only domains. Some receivers check that a sender's domain can receive replies, and a domain with an A record would otherwise look like it could. You can read more in [what is an MX record](https://iblockspam.com/blog/what-is-an-mx-record).

### SPF -all

`v=spf1 -all` lists no authorized servers and ends with a hard fail. Every message using the domain in its envelope sender fails SPF. Microsoft's [SPF guide](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure) gives exactly this record for parked domains. For more record patterns, see [SPF record syntax and examples](https://iblockspam.com/blog/spf-record-syntax-examples).

### DMARC p=reject

SPF only checks the envelope sender. DMARC protects the visible From address, which is what people actually see. With `v=spf1 -all` and no DKIM keys, no message can produce an aligned pass, so every forgery fails DMARC. `p=reject` asks receivers to refuse those messages. Under [RFC 9989](https://www.rfc-editor.org/rfc/rfc9989.html), the policy also covers subdomains that don't publish their own record.

The `rua` reporting address is optional. M3AAWG calls it optional, and [Microsoft](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure) says reports are arguably not needed, because there should be no legitimate mail to fix. The NCSC includes one. Reports can show you who is abusing the domain. If you add `rua`, it must point to a mailbox on a domain that receives mail. If that domain differs from the parked one, it has to publish an authorization record such as `parked.example._report._dmarc.reports.example.net TXT "v=DMARC1"`.

### DKIM: optional, and guidance differs

This is the one point where the sources disagree:

- **M3AAWG (2022)** says there's no need to publish any DKIM record for a parked domain, and none should be published. A forged signature fails anyway because no public key exists.
- **The UK NCSC** suggests a wildcard empty key, `*._domainkey.example.com TXT "v=DKIM1; p="`. It says this isn't strictly required, but some receivers treat a missing record with extra caution, and it revokes any keys that might be cached. In [RFC 6376](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1), an empty `p=` means the key "has been revoked".
- **Microsoft** says DKIM CNAME records aren't recommended for parked domains.

Both approaches leave a forged signature failing. Pick one and apply it consistently. If the domain once sent mail, the empty key is a tidy way to retire old selectors.

## How do you protect subdomains of a parked domain?

Attackers can also invent subdomains, such as `billing.yourbrand.net`.

- **DMARC already covers them.** A DMARC record on the parent applies to subdomains that don't have their own record, including subdomains that don't exist. Microsoft's DMARC guide says the same. Don't publish `sp=none` or `np=none`, which would leave a gap. Our guide to [DMARC subdomain policy](https://iblockspam.com/blog/dmarc-subdomain-policy-sp) explains `sp` and `np` in detail.
- **SPF and MX don't inherit.** Each name needs its own record. M3AAWG suggests wildcards for both, and Microsoft suggests a wildcard SPF record, if your DNS host supports them:

```
*.example.com.  TXT  "v=spf1 -all"
*.example.com.  MX   0 .
```

One catch: a DNS wildcard only answers for names that have no records of their own ([RFC 4592](https://www.rfc-editor.org/rfc/rfc4592.html)). If `www.example.com` has an A record, the wildcard SPF and MX don't apply to it. Add explicit `TXT "v=spf1 -all"` and `MX 0 .` records for every host name you keep, as M3AAWG's examples show.

## What if the domain has a website but no email?

The same records apply. Keep the A, AAAA or CNAME records for the website and add the Null MX, SPF and DMARC records alongside them. Also add explicit SPF and Null MX records to host names like `www`, because wildcards won't cover them.

Contact forms are the usual trap. If the website sends form notifications "from" this domain, it isn't a non-sending domain. Either send those notifications from a domain that has proper SPF, DKIM and DMARC, or set this one up properly as a sending domain.

## How do you manage many parked domains?

M3AAWG suggests a CNAME so all parked domains share one DMARC record:

```
_dmarc.example.com.  CNAME  _dmarc.parked.example.net.
_dmarc.example.org.  CNAME  _dmarc.parked.example.net.
_dmarc.parked.example.net.  TXT  "v=DMARC1; p=reject;"
```

Change the policy or reporting address once, and every parked domain follows. SPF and MX records still need to be on each domain. To keep track of which domains are parked and which still receive mail, see [multi-domain email security](https://iblockspam.com/blog/multi-domain-email-security-guide).

M3AAWG also recommends putting a reachable contact address in the domain's SOA record, since `postmaster@` won't work on a domain with a Null MX.

## Parked domain checklist

Work through each domain you own but don't use for email:

1. **Confirm nothing sends as it.** Ask around: old newsletters, web forms, printers, billing systems. CISA strongly encourages publishing `p=none` with an `rua` address for a short period first and reading the reports.
2. **Remove old MX records**, then add `MX 0 .`.
3. **Replace any SPF record** with `v=spf1 -all`. Make sure there's only one SPF record.
4. **Publish DMARC** at `_dmarc`: `v=DMARC1; p=reject;`, with `rua` if you want reports.
5. **Decide on DKIM.** Either publish nothing, or add `*._domainkey TXT "v=DKIM1; p="`. Remove any old DKIM CNAMEs pointing at a mail provider.
6. **Cover subdomains.** Add wildcard `TXT "v=spf1 -all"` and `MX 0 .`, plus explicit records on any host names that exist.
7. **Don't forget platform domains.** Microsoft says to add a DMARC reject record to your `*.onmicrosoft.com` domain if you don't send mail from it.
8. **Verify.** Run the domain through the [Email Health Check](https://iblockspam.com/tools/email-health-check), which recognizes a Null MX domain and shows its SPF and DMARC results. Use [MX Lookup](https://iblockspam.com/tools/mx-lookup) to confirm only the Null MX remains.
9. **Re-check after any registrar or DNS hosting change.** Make sure every record came across.

If you need help building the records, the [SPF Generator](https://iblockspam.com/tools/spf-generator) and [DMARC Generator](https://iblockspam.com/tools/dmarc-generator) produce the exact strings.

## Common mistakes

| Mistake | Problem | Fix |
|---|---|---|
| No records at all | Forgeries have nothing to fail | Publish SPF, DMARC and Null MX |
| `v=spf1 ~all` | Soft fail is a weaker signal | Use `-all` |
| DMARC `p=none` left in place | Receivers take no action | Move to `p=reject` |
| Null MX plus an old MX record | Breaks RFC 7505 | Keep only `0 .` |
| Null MX on a domain that sends mail | RFC 7505 says your mail risks rejection | Only use Null MX on non-sending domains |
| Relying on wildcards for `www` | Wildcards skip names that exist | Add explicit records |

These records stop direct forgery of your parked domains. They don't stop attackers registering new lookalike domains, which is covered in [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing).

## Next steps

1. List every domain your organization owns, including old and defensive registrations.
2. Apply the checklist to each non-sending domain.
3. Check each one with the [Email Health Check](https://iblockspam.com/tools/email-health-check).
4. Watch for changes. iBlockSpam's domain monitoring alerts you when MX, SPF or DMARC records change on domains you protect with us.

Browse our other [SPF, DKIM and DMARC guides](https://iblockspam.com/blog/topic/authentication).

## Frequently asked questions

### Can a domain with no email be spoofed?

Yes. Anyone can put any domain in the From line of a message. CISA's guidance for US federal agencies puts it plainly: even if you don't send mail from your domain, anyone can spoof it. Without SPF and DMARC records, receivers have no signal that the mail is forged.

### Do I need a DKIM record for a parked domain?

It's optional, and guidance differs. M3AAWG says no DKIM record is needed, because forged signatures fail when no key exists. The UK NCSC suggests a wildcard empty key, *._domainkey with v=DKIM1; p=, to revoke any cached keys. Either way, SPF -all and DMARC p=reject do the main work.

### Should a parked domain's DMARC record have an rua address?

It's optional. M3AAWG calls rua optional and Microsoft says reports are arguably not needed, because no legitimate mail should exist. Reports can still show you who is spoofing the domain. If you add one, point it at a mailbox on a domain that receives mail, and authorize that domain if it differs.

### Will a Null MX break my website?

No. A Null MX only affects email. Your A, AAAA and CNAME records for the website stay as they are. RFC 7505 says a domain with a Null MX must not publish any other MX record, so remove old MX records when you add it.

### Do parked domains need p=none first?

Only briefly. A staged rollout exists to protect legitimate mail, and a parked domain shouldn't have any. CISA still strongly encourages starting with p=none and a reporting address to confirm nothing authorized sends as the domain. Once reports show nothing legitimate, move to p=reject.

## Sources

- [RFC 7505: A "Null MX" No Service Resource Record for Domains That Accept No Mail](https://www.rfc-editor.org/rfc/rfc7505.html)
- [M3AAWG Protecting Parked Domains Best Common Practices (updated June 2022)](https://www.m3aawg.org/sites/default/files/doc_files/m3aawg_parked_domains_bcp-2022-06.pdf)
- [UK NCSC: Protecting parked domains for the UK public sector](https://www.ncsc.gov.uk/blog-post/protecting-parked-domains)
- [CISA: BOD 18-01, Enhance Email and Web Security](https://www.cisa.gov/news-events/directives/bod-18-01-enhance-email-and-web-security)
- [Microsoft Learn: Set up SPF (Scenario: Parked domains)](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-spf-configure)
- [Microsoft Learn: Set up DMARC (DMARC TXT records for parked domains)](https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dmarc-configure)
- [RFC 9989: DMARC](https://www.rfc-editor.org/rfc/rfc9989.html)
- [RFC 6376: DKIM Signatures, section 3.6.1](https://www.rfc-editor.org/rfc/rfc6376.html#section-3.6.1)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [SPF Record Generator](https://iblockspam.com/tools/spf-generator): Build a valid SPF record from your mail providers, with a DNS lookup count.
- [DMARC Record Generator](https://iblockspam.com/tools/dmarc-generator): Build a DMARC record with the right policy, reporting and alignment settings.

---

Source: iBlockSpam, https://iblockspam.com/blog/protect-parked-domains-from-spoofing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt