How to protect parked domains from spoofing

Why unused domains get spoofed

When a mail server receives a message, it can only judge the sender's domain against what that domain publishes. A domain with no SPF and no DMARC record publishes nothing, so a forged email "from" it isn't failing any rule. It's just unverified, and the receiving server falls back on its general spam filtering.

That makes unused domains useful to a fraudster. An old trading name, the .com that sits beside the client's .co.uk, or a domain bought for a campaign two years ago all look legitimate to the client's customers and suppliers. An invoice from accounts@client-old-name.co.uk is more convincing than one from a free webmail address.

The good news is that protecting a domain that never sends email is the easiest job in email authentication. There are no senders to find and nothing to break.

The three records to publish

SPF. An SPF record with no mechanisms except -all authorises nobody. Under RFC 7208, every check against it is a hard fail.

v=spf1 -all

DMARC. A policy of reject asks receivers to refuse failing mail. With no SPF authorisation and no DKIM key, every message using the domain fails. Keep a rua address: the reports show you when someone tries.

v=DMARC1; p=reject; rua=mailto:dmarc@example.com

Under RFC 9989, the current DMARC standard, the p= policy also covers subdomains unless sp= or np= says otherwise. So this one record protects invoices.example.co.uk and any other name a spoofer invents. If the reports go to an address at a different domain, that domain has to publish an authorisation record for them to arrive; services that collect reports for you handle that.

Null MX. RFC 7505 defines a single MX record with priority 0 and a target of a lone dot. It tells senders not to try delivering mail to the domain, so mistakes bounce at once instead of queueing for days. It must be the only MX record. The RFC also notes that many receiving systems reject mail with an invalid return address, so forgeries that use the domain as their return address are more likely to be refused, and it suggests pairing a null MX with v=spf1 -all.

0 .

Some DNS control panels won't accept a dot as an MX target. If yours refuses, ask the provider, or leave the MX out: no MX at all is less tidy, but the SPF and DMARC records still do the protecting.

Copy and paste: a complete set

For a parked domain called example.co.uk, the whole job is these three records. Swap in your domain and your own report address.

example.co.uk          MX   0 .
example.co.uk          TXT  "v=spf1 -all"
_dmarc.example.co.uk   TXT  "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"

Our DMARC record generator has a "Never sends email" option that writes all three for you.

What about DKIM?

You don't need a DKIM record for this to work. DMARC needs either SPF or DKIM to pass and align; with SPF set to fail everything and no key published, nothing can pass.

Some guidance also suggests a wildcard record at *._domainkey with an empty p= tag. Under RFC 6376, an empty key means the key has been revoked, so any signature claiming the domain fails. It does no harm, but it adds little once DMARC is at reject, and some DNS hosts handle wildcard TXT records badly. Treat it as optional.

Domains that have a website but no email

A domain can be "parked" for email and still busy on the web: a redirect from the old brand to the new one, or a microsite. The three records are still right, with one check first. If the site has a contact form, find out what address it sends from. If it sends as noreply@ the same domain, the form's email will fail once DMARC is at reject. Either make the form send from the client's main domain, or treat this domain as a sending domain and follow the staged route from p=none to p=reject instead.

Finding every domain a client owns

Most clients own more domains than they can list off the top of their head. Ask, and then look for yourself:

1. The registrar accounts. Log in to each registrar the client uses and export the full domain list. It often turns up domains bought by a previous web designer or a director who has since left.
2. The obvious variants. The .co.uk and .com of the main name, the .uk on its own, and any common misspelling the client bought to stop someone else doing so.
3. Old names. Previous trading names, merged businesses, and product or campaign names.
4. Invoices. The client's accounts system will show renewal payments to registrars, which is the quickest way to find a domain nobody remembered.

While you're in the registrar accounts, note each expiry date. A parked domain that quietly lapses can be bought by someone else, and then it's their records, not yours. For .uk domains, our guide to .uk renewals and expiry sets out what happens after the date passes.

Checking it's done, and stays done

After publishing, run each domain through the DMARC checker and the full domain check. You're looking for one SPF record ending in -all, one DMARC record at p=reject, and a null MX or no MX at all.

Then keep an eye on them. Parked domains get forgotten, and the records get lost when someone moves the DNS to a new host or a registrar resets the zone. A check that runs every day and tells you when a record changes catches that the day it happens, not the day a client's supplier receives a convincing fake invoice.

If you look after many clients, our page for web agencies shows how parked domains sit alongside the main ones: each gets its own grade, and the client report card shows the client that every domain they own is covered, not just the one on their business cards.

Doing this for clients? Domain Health Hub checks every client domain each day and puts the results in a monthly report card with your logo. Start a free trial; no card needed.