Sending domain and authentication Required

Lock down domains that never send mail

Give every domain and subdomain that sends no mail a null MX, an SPF record of v=spf1 -all and a DMARC record with p=reject.

By Erik Bergstedt, Agent Wranglers. Updated 20 October 2026.

How to do it

Attackers spoof parked and web-only domains because nobody watches them. A null MX (RFC 7505) says the domain accepts no mail. SPF -all says no server may send for it. DMARC p=reject tells receivers to refuse anything that claims it. M3AAWG advises the same set for parked domains. Remove the null MX before the domain starts to receive mail.

Example

parked.example.net.         3600  IN  MX   0 .
parked.example.net.         3600  IN  TXT  "v=spf1 -all"
_dmarc.parked.example.net.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.net"

How to check

For each domain you own that sends no mail, dig +short MX returns 0 ., the SPF record is v=spf1 -all and _dmarc shows p=reject.

For agents: if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains.