Locking down domains that never send email

Optional: an empty DKIM policy#

There is no standard way to say "no DKIM keys exist" for a whole domain, since keys live at individual selectors. Some guides suggest publishing a wildcard revocation:

*._domainkey.parked-example.com. TXT "v=DKIM1; p="

This makes any selector an attacker might name resolve to a revoked key. It is harmless and some operators like it, but it adds little beyond what DMARC p=reject already achieves, so treat it as optional.

The full set#

Domains that host a website but send no mail#

The same records work for a domain that serves a website but never sends email, such as a marketing site on a separate domain. The MX, SPF and DMARC records do not interfere with A, AAAA or CNAME records for the web server.

Be careful with one case: if the domain might need to send transactional mail later (a contact form, for example), start with the lockdown and loosen it deliberately when you add a sender, rather than leaving it open "just in case."

Rolling it out across a portfolio#

If you own dozens of domains, manage them as a group:

1. Inventory every domain from your registrar accounts, including domains bought by marketing or legal.
2. Classify each as sending, receiving only, or parked.
3. Apply the parked template to every parked domain, ideally through infrastructure as code or a script against your DNS provider's API.
4. Point all rua addresses to one mailbox or reporting service, with authorization records in place.
5. Review quarterly. New domains get registered, and occasionally a parked domain is quietly put into use.

A quick check script:

for d in parked-example.com example-old.com examp1e.com; do
  echo "== $d"
  dig +short MX "$d"
  dig +short TXT "$d" | grep -i spf1
  dig +short TXT "_dmarc.$d"
done

Every parked domain should show 0 ., "v=spf1 -all" and a p=reject policy.

What happens when a parked domain becomes active#

Domains change roles. A defensive registration becomes a product name, or an old brand is revived for a campaign. When that happens, reverse the lockdown in a deliberate order: add the new sender's SPF include and DKIM keys first, verify that test messages pass authentication, temporarily lower DMARC to p=none or p=quarantine while you watch reports, and only then remove the null MX if the domain also needs to receive mail. Doing it in the opposite order leaves a window where the domain is neither protected nor working.

Checklist#

• Null MX (MX 0 .) as the only MX record.
• v=spf1 -all as the only SPF record.
• DMARC with p=reject and an aggregate report address.
• Authorization record at the receiving domain if reports go elsewhere.
• Portfolio-wide inventory and quarterly review.

Key takeaways#

• Unused domains are attractive for spoofing because they genuinely belong to you.
• A null MX, a deny-all SPF record and a reject DMARC policy declare that a domain neither sends nor receives mail.
• Aggregate reports for parked domains act as an early warning for spoofing attempts.
• Treat your domain portfolio as a group, with templates and regular reviews.