Securing non-sending domains
It is very common for organizations to manage domains that never send email. Whether they are typo variations, defensive brand registrations, marketing microsites, or legacy assets, inactive domains are easy to overlook when it comes to security.
However, threat actors do not need access to your infrastructure to send emails using your domain names. If an unused domain lacks DMARC, DKIM, or SPF records, attackers can freely spoof it for phishing campaigns, business email compromise (BEC), and malware distribution, all while hiding behind your brand’s reputation.
To defend against this threat, you must explicitly tell receiving mail servers: "This domain never sends email, and anything claiming to come from it is fraudulent." Here is how to lock down your non-sending domains using SPF, DKIM, DMARC, and Null MX.
Block all sending providers with SPF
Use the following TXT record at the root of your domain to disallow any sending provider to send on behalf of this domain.
v=spf1 ~all
Enforce rejection with DMARC
DMARC provides the enforcement instructions for receiving providers when SPF and DKIM fail (which they always should for non-sending domains).
For non-sending domains, you should immediately set the policy to reject for the root domain and all subdomains while adding a destination where receiving providers can send you DMARC reports on potential misuse.
Example DMARC record for _dmarc.example.com:
v=DMARC1; p=reject; rua=mailto:dmarc@example.com
Revoke existing DKIM keys
If you are retiring a domain that once had active email services, revoke all known selectors explicitly rather than just deleting the DNS records.
For a DKIM selector default update the TXT record at default._domainkey with:
v=DKIM1; p=
The empty p= tag permanently revokes the public key, preventing any existing private keys from being misused.
Explicitly accept no incoming email
If a domain does not send email, it likely shouldn't receive email either. Without an explicit record, mail servers attempting to deliver email may fall back to the domain's root A or AAAA record. With it, mail servers immediately stop trying and report back a non-delivery.
To declare that the domain accepts no incoming mail, publish an RFC 7505 Null MX record. To do so, configure a single DNS MX record with priority 0 and value . at the root of your domain:
@ IN MX 0 .