# Securing non-sending domains

It is very common for organizations to manage domains that never send email. Whether they are typo variations, defensive brand registrations, marketing microsites, or legacy assets, inactive domains are easy to overlook when it comes to security.

However, threat actors do not need access to your infrastructure to send emails using your domain names. If an unused domain lacks DMARC, DKIM, or SPF records, attackers can freely spoof it for phishing campaigns, business email compromise (BEC), and malware distribution, all while hiding behind your brand’s reputation.

To defend against this threat, you must explicitly tell receiving mail servers: "This domain never sends email, and anything claiming to come from it is fraudulent." Here is how to lock down your non-sending domains using SPF, DKIM, DMARC, and Null MX.

## Block all sending providers with SPF

Use the following TXT record at the root of your domain to disallow any sending provider to send on behalf of this domain.

Block Field

## Enforce rejection with DMARC

DMARC provides the enforcement instructions for receiving providers when SPF and DKIM fail (which they always should for non-sending domains).

For non-sending domains, you should immediately set the policy to reject for the root domain and all subdomains while adding a destination where receiving providers can send you DMARC reports on potential misuse.

Example DMARC record for `_dmarc.example.com`:

Block Field

## Revoke existing DKIM keys

If you are retiring a domain that once had active email services, revoke all known selectors explicitly rather than just deleting the DNS records.

For a DKIM selector `default` update the TXT record at `default._domainkey` with:

Block Field

The empty `p=` tag permanently revokes the public key, preventing any existing private keys from being misused.

## Explicitly accept no incoming email

If a domain does not send email, it likely shouldn't receive email either. Without an explicit record, mail servers attempting to deliver email may fall back to the domain's root `A` or `AAAA` record. With it, mail servers immediately stop trying and report back a non-delivery.

To declare that the domain **accepts no incoming mail**, publish an [RFC 7505 Null MX record](https://datatracker.ietf.org/doc/html/rfc7505). To do so, configure a single DNS `MX` record with priority `0` and value `.` at the root of your domain:

```plain
@  IN  MX  0  .
```