Lock down a domain without mail
Check whether a domain receives mail, then get the three DNS records that stop spoofing of a domain that sends none: null MX, SPF -all and DMARC reject.
Run the full email security check DMARC, SPF, DKIM, MX and MTA-STS in one free report.
How it works
Enter a domain and the tool runs the same mail check as the email security check: it reads the MX records, the SPF record and the DMARC policy that receivers apply. From that answer it builds the three records a domain without mail should have, and marks each one as in place, to add or to replace:
- Null MX (
MX 0 ., RFC 7505). A single MX record with preference 0 and the root.as host says that the domain accepts no mail. Without any MX record, senders fall back to the domain's own address and try to deliver to the web server. A null MX must stand alone, so any other MX records have to go. - SPF that allows nothing (
v=spf1 -all, RFC 7208 section 10.1.2). The record names no server, so every message fails SPF. It replaces any SPF record on the name; a name may only have one. - DMARC reject (
v=DMARC1; p=rejectat_dmarc, RFC 9989). DMARC protects the visibleFromaddress. With SPF-alland no DKIM keys no message can pass, andp=rejectasks receivers to reject them. The policy also covers subdomains, unless a weakerspornpis set.
The MX lookup comes first for a reason. If the domain has mail servers, someone may be using it for mail, and a null MX would bounce every message. The tool then shows the hosts it found and asks you to confirm before it shows the records. An SPF record that names senders is pointed out the same way, because the domain may send mail through them.
Each record has a copy button with the value to paste in your DNS provider's form, and the three are also given as zone file lines. Publish them together and check again: all three should show as in place. The guide to domains without mail explains each record in more depth, including an optional DKIM wildcard that revokes every key.
Common mistakes
- A null MX next to the old MX records. RFC 7505 says the null MX must be the only one.
- Two SPF records on the same name, for example an old one left beside
v=spf1 -all. Receivers then fail SPF with a permanent error. - Keeping
p=nonebecause it was the starting point. It asks receivers to do nothing, so it gives no protection. - Locking down a domain that one old system still sends from, such as a contact form or an invoice service. Check before you publish.
Frequently asked questions
Why lock down a domain that sends no mail?
Anyone can put any domain in the From address of a message. A parked or unused domain without records gives receivers nothing to check, so spoofed mail is judged on its content alone. With SPF -all and DMARC p=reject published, receivers that check DMARC can reject that mail.
What happens if the domain does receive mail?
The null MX tells every sender that the domain accepts no mail, so messages to it bounce at once. That is why the tool looks up the MX records first. If it finds mail servers, it says so and keeps the records behind a second step. Only publish them if you are sure no one uses an address at the domain.
Should I add sp=reject?
It is not needed. RFC 9989 applies the p policy to subdomains when sp is absent, and to names that do not exist when np is absent as well. Some people prefer to write sp=reject so the intent is visible in the record. The switch above the DMARC record adds it; both variants give the same protection.
Do subdomains need their own records?
For DMARC, no: receivers walk up to _dmarc.example.com and apply its policy. A null MX and SPF only apply to the exact name they are published on, so a subdomain that exists, such as www.example.com, needs its own MX 0 . and v=spf1 -all for the same statement. Enter the subdomain here to get its records.
Do I need a rua address for reports?
It is optional. With rua=mailto:... receivers send daily aggregate reports that show whether someone tries to send mail as the domain. The address must be on a domain that receives mail, because this one has a null MX. The DMARC record generator builds a record with rua.
Is the domain stored?
No. Results are kept in memory for up to ten minutes so repeated lookups are fast, and are then gone. The domain is not written to logs and no account is needed.