← Record Studio

Null MX

Parked and web-only domains are popular spoofing targets because nobody watches their mail flow. Four records shut this down completely: a Null MX (RFC 7505), an SPF record that fails every sender, a DMARC reject policy, and a wildcard DKIM record that revokes all signing keys.

Only for domains that do not send mail either. RFC 7505 §4.2: mail systems “SHOULD NOT publish a null MX record for domains that they use in RFC5321.MailFrom or RFC5322.From addresses. If a system nonetheless does so, it risks having its mail rejected.” If a contact form, shop or newsletter still sends from an address at this domain, these records are the wrong configuration: v=spf1 -all fails every one of your own messages, p=reject has receivers discard them, and the Null MX leaves the return address undeliverable. Keep the MX and publish a normal SPF/DKIM/DMARC setup instead. RFC 7505 requires that the Null MX is the only MX record – remove all other MX records for the domain. Two of the four records come from RFC 7505 itself: the Null MX, and the empty SPF policy — §4.2 says operators of domains that do not send mail “can publish Sender Policy Framework (SPF) ‘-all’ policies [RFC7208] to make an explicit declaration that the domains send no mail”. The DMARC p=reject record is not part of RFC 7505; it is industry best practice and appears in the M3AAWG parked-domains BCP. The wildcard DKIM revoke (v=DKIM1; p=) rests on RFC 6376 §3.6.1 instead, where an empty p= means the key is revoked – the M3AAWG BCP takes the other route and recommends publishing no DKIM record at all for a parked domain. Web, A and AAAA records are unaffected – the domain's website keeps working.

Runs entirely in your browser. Record Studio · Verify the result with the domain security check