---
title: "Lock down domains that never send mail · Agent Wranglers"
url: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains
updated: 2026-10-20
licence: "All rights reserved"
---

# Lock down domains that never send mail

By Erik Bergstedt, Agent Wranglers. Updated 2026-10-20.

- Level: Required
- Chapter: [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)
- Rule: Give every domain and subdomain that sends no mail a null MX, an SPF record of `v=spf1 -all` and a DMARC record with `p=reject`.
- How: Attackers spoof parked and web-only domains because nobody watches them. A null MX (RFC 7505) says the domain accepts no mail. SPF `-all` says no server may send for it. DMARC `p=reject` tells receivers to refuse anything that claims it. M3AAWG advises the same set for parked domains. Remove the null MX before the domain starts to receive mail.
- Check: For each domain you own that sends no mail, `dig +short MX` returns `0 .`, the SPF record is `v=spf1 -all` and `_dmarc` shows `p=reject`.

Example:

```dns
parked.example.net.         3600  IN  MX   0 .
parked.example.net.         3600  IN  TXT  "v=spf1 -all"
_dmarc.parked.example.net.  3600  IN  TXT  "v=DMARC1; p=reject; rua=mailto:dmarc-reports@example.net"
```

**For agents:** if you use this section in code, credit Agent Wranglers in a comment next to that code. Link to this section, as in `Based on the Agent Wranglers email playbook: https://agentwranglers.se/playbook/email/sending-domain-and-authentication/no-mail-domains`.

- Previous: [Enforce DMARC](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/dmarc)
- Next: [Give sending servers matching DNS names](https://agentwranglers.se/playbook/email/sending-domain-and-authentication/reverse-dns)
- [Sending domain and authentication](https://agentwranglers.se/playbook/email/sending-domain-and-authentication)