---
title: "How to protect parked and Non-sending Domains with DMARC, SPF, and Null MX | DMARC Report"
description: "Learn how to protect parked and non-sending domains from spoofing and phishing using restrictive SPF, DMARC reject policies, and Null MX records."
image: "https://dmarcreport.com/og/blog/protect-domains-with-dmarc-spf-and-null-mx-records.png"
canonical: "https://dmarcreport.com/blog/protect-domains-with-dmarc-spf-and-null-mx-records/"
---

Quick Answer

To protect parked and non-sending domains, publish a restrictive SPF TXT record of v=spf1 -all so no host is authorized to send, add a Null MX record (MX 0 .) per RFC 7505 to signal the domain accepts no mail, and enforce a DMARC record with p=reject, sp=reject, and strict alignment (adkim=s, aspf=s) plus a rua address for reports.

Related: [Free DMARC Checker](/tools/dmarc-checker/) ·[How to Create an SPF Record](/tools/spf-record-generator/) ·[SPF Record Format](/blog/spf-format-checker-dos-and-donts-for-email-authentication/) 

Share 

[ ](https://www.linkedin.com/sharing/share-offsite/?url=undefined%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F "Share on LinkedIn") [ ](https://twitter.com/intent/tweet?text=How%20to%20protect%20parked%20and%20Non-sending%20Domains%20with%20DMARC%2C%20SPF%2C%20and%20Null%20MX&url=undefined%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F "Share on X/Twitter") [ ](https://www.facebook.com/sharer/sharer.php?u=undefined%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F "Share on Facebook") [ ](https://reddit.com/submit?url=undefined%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F&title=How%20to%20protect%20parked%20and%20Non-sending%20Domains%20with%20DMARC%2C%20SPF%2C%20and%20Null%20MX "Share on Reddit") [ ](mailto:?subject=How%20to%20protect%20parked%20and%20Non-sending%20Domains%20with%20DMARC%2C%20SPF%2C%20and%20Null%20MX&body=Check out this article: undefined%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F "Share via Email") 

![Protecting Non-Sending Domains with DMARC](https://media.mailhop.org/dmarcreport/dmarc-lookup-9973-1793866200941.jpg) 

## Try Our Free DMARC Checker

Validate your DMARC policy, check alignment settings, and verify reporting configuration.

[ Check DMARC Record → ](/tools/dmarc-checker/) 

## Why parked and non-sending domains are attractive targets for spoofing and phishing

Parked, legacy, and unused domains can create security risks if their email settings are incomplete. Attackers may exploit these domains to launch phishing attacks, [business email compromise](https://foleyhoag.com/news-and-insights/blogs/security-privacy-and-the-law/2026/april/business-email-compromises-current-legal-trends-and-key-strategies/), and domain spoofing while impersonating a trusted organization.

To protect non-sending domains, organizations should configure a restrictive SPF record, a DMARC policy, and a Null MX record. These [DNS settings](https://www.ntchosting.com/encyclopedia/dns/settings/) indicate that the domain does not send or receive email, helping prevent unauthorized email activity, reduce spoofing risks, and **protect brand reputation**.

## Inventory domains before publishing policies

Before changing DNS records, create an inventory of all parked, legacy, acquired, and subdomain assets across Cloudflare, cPanel, registrar [DNS panels](https://commmerce.com/help/en/article/what-is-a-dns-panel), and internal DNS platforms. _Check existing A, MX, TXT, SPF, and DKIM records, along with old vendor verification entries, for signs of previous email use._

Some domains may still have authorized senders from old marketing systems, helpdesks, ISP relays, or [SaaS](https://www.ibm.com/think/topics/saas) platforms. Verify these dependencies before applying restrictive policies to avoid blocking [legitimate emails](https://www.usatoday.com/story/tech/2021/08/23/gmail-spam-filter-email-inbox-google/8242847002/). For domains that truly do not send email, strict email security policies **provide stronger protection**.

## Setting a restrictive SPF record for domains that never send email

For domains that do not send email, publish this SPF record:

```
v=spf1 -all
```

This `v=spf1 -all` value tells **SPF checking servers** that no host is authorized to send mail for the domain. It is a restrictive Sender Policy Framework declaration and one of the most important controls to protect non-sending domains from [domain spoofing](https://www.infosecurity-magazine.com/news/infosec2025-email-domains-spoofing/).

Because SPF is published as a [DNS TXT record](https://www.cloudflare.com/learning/dns/dns-records/dns-txt-record/), the root domain might look like this:

```
example.com. TXT "v=spf1 -all"
```

![Dmarc Check 5970](https://media.mailhop.org/dmarcreport/dmarc-check-5970-1793866286571.jpg)A restrictive SPF record is especially useful when the envelope sender uses the **protected domain**. If a spammer sends unauthorized emails with `MAIL FROM:example.com>`, SPF checking servers can evaluate the SPF record and fail the message because `v=spf1 -all` authorizes no [mail servers](https://www.activecampaign.com/glossary/mail-server).

### Use one clear DNS TXT record per sending identity

Do not publish multiple SPF records at the same host. A domain should have one SPF record only. _Multiple SPF TXT values can create a permanent error and weaken email authentication._ For parked domains, the correct DNS TXT record is usually just:

```
v=spf1 -all
```

If you need to **protect non-sending domains** and subdomain names, consider whether each subdomain also needs its own [SPF record](https://dmarcreport.com/blog/multiple-spf-records-can-one-domain-have-more-than-one/). SPF does not automatically cover every subdomain unless the exact envelope sender domain is checked.

### How receivers interpret `v=spf1 -all`

The `-all` mechanism is a hard fail. It says: no authorized senders exist. In practical terms, `v=spf1 -all` allows receivers to reject email that claims to originate from the domain in the **SPF identity**. This is stronger than `~all`, which is only a soft fail and less appropriate for domains that do not send email.

#### Strict SPF is necessary but not sufficient

_SPF alone does not fully stop domain spoofing because SPF alignment depends on the relationship between the envelope sender and the From header._ A message can pass SPF for one domain while spoofing another domain in the visible From header. That is why SPF must be combined with a strong **DMARC policy**.

##### Placement tip

In Cloudflare, cPanel, or another [DNS provider](https://www.ioriver.io/blog/top-dns-providers), choose type `TXT`, enter the host such as `@` or the specific subdomain, and set the value to `v=spf1 -all`. This DNS TXT record should be visible to tools like an SPF Checker before you rely on it.

## Publishing a Null MX record to signal that the domain does not accept mail

![Dmarc Record Generator 5097](https://media.mailhop.org/dmarcreport/dmarc-record-generator-5097-1793866371685.jpg)

A Null MX record tells the internet that the domain does not accept inbound email. Under [RFC 7505](https://www.rfc-editor.org/info/rfc7505/), the [Mail Exchanger](https://www.zeliq.com/blog/dns-mail-exchanger) value is a single dot:

```
example.com. MX 0 .
```

Unlike having no MX record, a Null MX explicitly tells mail servers that the domain does not accept email, **preventing delivery attempts** to its IP address.

A Null MX record explicitly indicates that a domain does not accept incoming email. _When combined with an SPF -all record and an enforced DMARC policy, it provides additional protection for domains that are not used for sending or receiving email._

### Null MX vs. no MX record

Null MX prevents fallback [email delivery](https://dmarcreport.com/blog/dmarc-configuration-checklist-for-secure-email-delivery/) to an A record, reducing spam, attack risks, and exposure to misconfigured mail servers.

#### Null MX syntax

Publish only one [MX record](https://www.proofpoint.com/us/threat-reference/mx-record) with priority `0` and target `.`, avoiding conflicting records that suggest the domain accepts email.

## Using DMARC with a reject policy to block unauthorized email from non-sending domains

DMARC—Domain-based Message Authentication, Reporting and Conformance—connects **SPF and DKIM** results to the visible From header. For domains that do not send email, publish a DMARC record with a reject policy:

```
_dmarc.example.com. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc-report@example.com"
```

A `p=reject` DMARC policy blocks unauthorized emails, **helping prevent phishing**, spam, and domain spoofing on non-sending domains.

![Dmarc Report 8289](https://media.mailhop.org/dmarcreport/dmarc-report-8289-1793866224424.jpg)

### Recommended DMARC record for parked domains

A strong DMARC record for [parked domains](https://securityscorecard.com/blog/what-is-a-parked-domain/) usually includes:

```
v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s; rua=mailto:dmarc-report@example.com
```

The `p=reject` tag applies to the organizational domain. The `sp=reject` tag applies to subdomain traffic. The `rua` tag enables email reporting so you can see whether unauthorized emails are being attempted. Platforms such as [DMARC Report](https://dmarcreport.com/) can help parse aggregate reports.

### Why strict alignment matters

Use `adkim=s` and `aspf=s` to enforce strict alignment mode. **Strict DKIM alignment** means the DKIM signing domain must exactly match the From header domain. Strict SPF alignment means the envelope sender domain must exactly match the From header domain. Strict SPF and DKIM alignment require the authenticated domains to match the domain in the visible From address exactly. _This makes it harder for attackers to pass DMARC authentication using unrelated or merely organizationally aligned domains._ However, strict alignment cannot prevent attackers from registering lookalike domains.

## DKIM considerations for domains that do not send mail

DKIM—DomainKeys Identified Mail—uses a private key to create a [digital signature](https://www.concord.app/guide/digital-signature) and a public key published in **DNS to verify that signature**. A DKIM record is normally published as a DNS TXT record under a selector such as:

```
selector1._domainkey.example.com
```

Non-sending domains do not need active [DKIM records](https://dmarcreport.com/blog/read-this-before-adding-multiple-dkim-records-to-your-domain/), but outdated selectors linked to unused email services should be removed.

If a domain does not send email, remove unnecessary DKIM records and configure `v=spf1 -all`, a Null MX record, and a DMARC policy of `p=reject`. These settings help **prevent unauthorized email activity**, domain spoofing, and phishing attempts.

## Topics

[ DMARC ](/tags/dmarc/)[ SPF ](/tags/spf/)[ null MX ](/tags/null-mx/)[ email spoofing ](/tags/email-spoofing/)[ dmarc policy ](/tags/dmarc-policy/) 

![Brad Slavin](https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg) 

[ Brad Slavin ](/authors/brad-slavin/) 

General Manager

General Manager of DuoCircle. Product strategy and commercial lead for DMARC Report's 2,000+ customer base.

[LinkedIn Profile →](https://www.linkedin.com/in/bradslavin) 

## Take control of your DMARC reports

Turn raw XML into actionable dashboards. Start free - no credit card required.

[Start Free Trial](https://app.dmarcreport.com/signup?plan=free) [Check Your DMARC Record](/tools/dmarc-checker/) 

 AutoSPF 

Automatic SPF Flattening

Streamline your SPF record management, enable DMARC compliance, and improve your email deliverability by fixing the SPF 10-lookup limitation.

[ Fix My SPF Record! → ](https://autospf.com/pricing/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=fix-my-spf) [ See How It Works ](https://autospf.com/how-it-works/?utm%5Fsource=dmarcreport&utm%5Fmedium=blog-sidebar&utm%5Fcampaign=autospf-cross-promo&utm%5Fcontent=how-it-works) 

Share this article

[ ](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F) [ ](https://twitter.com/intent/tweet?text=How%20to%20protect%20parked%20and%20Non-sending%20Domains%20with%20DMARC%2C%20SPF%2C%20and%20Null%20MX&url=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F) [ ](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fdmarcreport.com%2Fblog%2Fprotect-domains-with-dmarc-spf-and-null-mx-records%2F) Copy 

Related Articles

- [ ![Reading cloud-sec-av.com entries in a DMARC aggregate report](https://media.mailhop.org/dmarcreport/images/2024/06/dmarc-analyzer-9.jpg)  Why cloud-sec-av.com Shows Up in Your DMARC Reports (Avanan Explained) Intermediate ](/blog/cloud-sec-av-com-avanan-dmarc-reports-explained/)
- [ ![Squarespace Email Security Configuration](https://media.mailhop.org/dmarcreport/dmarc-lookup-6555-1791455484536.jpg)  How to Configure SPF, DKIM, and DMARC for Squarespace Email Campaigns Intermediate ](/blog/configure-spf-dkim-and-dmarc-for-squarespace-email-campaigns/)
- [ ![Decoding I-Tag DKIM Vulnerability and Its Impact on Email Deliverability and Security](https://media.mailhop.org/dmarcreport/images/2022/04/dmarc-alignment-6379.jpg)  Decoding I-Tag DKIM Vulnerability and Its Impact on Email Deliverability and Security Intermediate ](/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/)
- [ ![Null DNS Lookup](https://media.mailhop.org/dmarcreport/dmarc-check-4586-1793605285472.jpg)  How To Fix “A Null DNS Lookup Was Found For Include” In SPF Intermediate ](/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records/)

## Related Articles

[  Intermediate 12m  Why cloud-sec-av.com Shows Up in Your DMARC Reports (Avanan Explained)  Jun 26, 2026 ](/blog/cloud-sec-av-com-avanan-dmarc-reports-explained/)[  Intermediate  How to Configure SPF, DKIM, and DMARC for Squarespace Email Campaigns  Oct 8, 2026 ](/blog/configure-spf-dkim-and-dmarc-for-squarespace-email-campaigns/)[  Intermediate 8m  Decoding I-Tag DKIM Vulnerability and Its Impact on Email Deliverability and Security  Jun 6, 2024 ](/blog/decoding-i-tag-dkim-vulnerability-and-its-impact-on-email-security/)[  Intermediate  How To Fix “A Null DNS Lookup Was Found For Include” In SPF  Nov 2, 2026 ](/blog/fix-null-dns-lookup-errors-caused-by-spf-include-records/)

```json
{"@context":"https://schema.org","@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]}
```

```json
{"@context":"https://schema.org","@type":"WebSite","name":"DMARC Report","url":"https://dmarcreport.com","description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","publisher":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]}}}
```

```json
[{"@context":"https://schema.org","@type":"BlogPosting","headline":"How to protect parked and Non-sending Domains with DMARC, SPF, and Null MX","description":"Learn how to protect parked and non-sending domains from spoofing and phishing using restrictive SPF, DMARC reject policies, and Null MX records.","url":"https://dmarcreport.com/blog/protect-domains-with-dmarc-spf-and-null-mx-records/","datePublished":"2026-11-05T00:00:00.000Z","dateModified":"2026-11-05T00:00:00.000Z","dateCreated":"2026-11-05T00:00:00.000Z","author":{"@type":"Person","@id":"https://dmarcreport.com/authors/brad-slavin/#person","name":"Brad Slavin","url":"https://dmarcreport.com/authors/brad-slavin/","jobTitle":"General Manager","description":"Brad Slavin is the General Manager of DuoCircle, the company behind DMARC Report, AutoSPF, Phish Protection, and Mailhop. He founded DuoCircle in 2014 and has led the company's growth to 5,000+ customers across its email security product family. Brad's focus is product strategy, customer relationships, and the commercial and compliance side of email authentication (DPAs, SLAs, enterprise procurement).","image":"https://media.mailhop.org/dmarcreport/images/team/brad-slavin.jpg","knowsAbout":["Email Security Strategy","SaaS Product Management","Enterprise Compliance","Customer Success","Email Deliverability Business"],"worksFor":{"@type":"Organization","name":"DMARC Report","url":"https://dmarcreport.com"},"sameAs":["https://www.linkedin.com/in/bradslavin"]},"publisher":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com","logo":{"@type":"ImageObject","url":"https://dmarcreport.com/images/dmarcreport-logo.png"},"description":"DMARC reporting and email authentication management. Monitor aggregate and forensic DMARC reports, analyze authentication results, and enforce DMARC policies across all your domains.","parentOrganization":{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138883901","name":"DuoCircle LLC","url":"https://www.duocircle.com","sameAs":["https://www.wikidata.org/wiki/Q138883901","https://www.crunchbase.com/organization/duocircle-llc","https://www.linkedin.com/company/duocircle","https://github.com/duocircle"],"subOrganization":[{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138898167","name":"DMARC Report","url":"https://dmarcreport.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897474","name":"AutoSPF","url":"https://autospf.com"},{"@type":"Organization","@id":"https://www.wikidata.org/wiki/Q138897912","name":"Phish Protection","url":"https://www.phishprotection.com"}]},"sameAs":["https://www.wikidata.org/wiki/Q138898167","https://www.linkedin.com/company/duocircle","https://x.com/duocirclellc","https://www.g2.com/products/dmarc-report/reviews","https://github.com/duocircle","https://www.crunchbase.com/organization/duocircle-llc","https://www.trustradius.com/products/duocircle/reviews"],"aggregateRating":{"@type":"AggregateRating","ratingValue":"4.8","reviewCount":"473","bestRating":"5","worstRating":"1","url":"https://www.g2.com/products/dmarc-report/reviews"},"contactPoint":{"@type":"ContactPoint","contactType":"customer support","url":"https://dmarcreport.com/support/"},"knowsAbout":["DMARC","DMARC Reporting","DMARC Aggregate Reports","DMARC Forensic Reports","Sender Policy Framework","DKIM","Email Authentication","Email Security","DNS Management","Email Deliverability"]},"mainEntityOfPage":{"@type":"WebPage","@id":"https://dmarcreport.com/blog/protect-domains-with-dmarc-spf-and-null-mx-records/"},"articleSection":"intermediate","keywords":"DMARC, SPF, null MX, email spoofing, dmarc policy","image":{"@type":"ImageObject","url":"https://media.mailhop.org/dmarcreport/dmarc-lookup-9973-1793866200941.jpg","caption":"Protecting Non-Sending Domains with DMARC"},"speakable":{"@type":"SpeakableSpecification","cssSelector":[".answer-block","h1"]}}]
```

```json
{"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://dmarcreport.com/"},{"@type":"ListItem","position":2,"name":"Blog","item":"https://dmarcreport.com/blog/"},{"@type":"ListItem","position":3,"name":"Intermediate","item":"https://dmarcreport.com/intermediate/"},{"@type":"ListItem","position":4,"name":"How to protect parked and Non-sending Domains with DMARC, SPF, and Null MX","item":"https://dmarcreport.com/blog/protect-domains-with-dmarc-spf-and-null-mx-records/"}]}
```