A domain that never sends mail is the easiest thing in email authentication to get completely right, and one of the most commonly left undone. There is no legitimate sender to break, so every control can be set to its strictest value.
The complete set
| Record | Value | Says |
|---|---|---|
example.com TXT | v=spf1 -all | No host is authorised to send. |
_dmarc.example.com TXT | v=DMARC1; p=reject; sp=reject; rua=mailto:… | Reject everything, and tell me about it. |
*._domainkey.example.com TXT | v=DKIM1; p= | No selector has a valid key. |
example.com MX | 0 . | This domain accepts no mail either. |
The wildcard DKIM revocation is the one usually omitted. Without it, any selector under the domain answers NXDOMAIN, which is an absence rather than a denial. With it, any signature claiming any selector is definitively invalid.
The null MX
0 . is the null MX: a positive statement that the domain accepts no mail. It causes senders to fail immediately with a permanent error rather than retrying for days, and it stops the domain being used as a backscatter target.
example.com. IN MX 0 .
priority 0, target "." — the root, which cannot be a mail host.
Not an omission. A statement.Why this is worth doing
- Parked and defensive domains are the preferred spoofing target. They carry the brand and nobody is watching them.
- There is no deliverability risk. The usual reason to hesitate before
-allandp=reject— breaking a sender you forgot about — does not apply where there are no senders. - It is the same four records every time, which makes it automatable across an estate of any size.
- Keep
rua. A parked domain that starts receiving spoofing reports is telling you it has been noticed, which is worth knowing.
Confirm it truly sends nothing first
“Parked” sometimes means “parked, except for the contact form that ops set up in 2019”. Publish p=none with rua for a fortnight before the strict set, and read what arrives. Two weeks of evidence costs nothing next to silently killing a form nobody remembers.