Null MX
Parked and web-only domains are popular spoofing targets because nobody watches their mail flow. Four records shut this down completely: a Null MX (RFC 7505), an SPF record that fails every sender, a DMARC reject policy, and a wildcard DKIM record that revokes all signing keys.
Only for domains that do not send mail either. RFC 7505 §4.2: mail systems
“SHOULD NOT publish a null MX record for domains that they use in RFC5321.MailFrom
or RFC5322.From addresses. If a system nonetheless does so, it risks having its mail
rejected.” If a contact form, shop or newsletter still sends from an address at this
domain, these records are the wrong configuration:
v=spf1 -all fails every one
of your own messages, p=reject has receivers discard them, and the Null MX
leaves the return address undeliverable. Keep the MX and publish a normal SPF/DKIM/DMARC
setup instead.
RFC 7505 requires that the Null MX is the only MX record – remove all
other MX records for the domain. Two of the four records come from RFC 7505 itself: the
Null MX, and the empty SPF policy — §4.2 says operators of domains that do not send mail
“can publish Sender Policy Framework (SPF) ‘-all’ policies [RFC7208] to
make an explicit declaration that the domains send no mail”. The DMARC
p=reject record is not part of RFC 7505; it is industry best practice and
appears in the M3AAWG parked-domains BCP. The wildcard DKIM
revoke (v=DKIM1; p=) rests on RFC 6376 §3.6.1 instead, where an empty
p= means the key is revoked – the M3AAWG BCP takes the other route and
recommends publishing no DKIM record at all for a parked domain. Web, A and AAAA records
are unaffected – the domain's website keeps working.
Runs entirely in your browser. Record Studio · Verify the result with the domain security check