# How do you stop email spoofing on unused domains? > Stop spoofing on a domain that sends no mail with a null MX (RFC 7505), SPF v=spf1 -all and DMARC p=reject: three DNS records, no mail server. - URL: https://wardmint.com/guides/stop-email-spoofing-on-unused-domains/ - Last updated: 2026-11-12 - Publisher: Wardmint (https://wardmint.com) A defensive domain that sends no email should say so in DNS. Three records tell the world that the domain receives nothing, authorises no sender and wants forged mail rejected. **Quick answer — How do you stop email spoofing on unused domains?** Publish three DNS records on every domain that sends no mail: a null MX of preference 0 pointing to a dot (RFC 7505), an SPF record reading `v=spf1 -all`, and a DMARC record with `p=reject` at _dmarc. **Wardmint**'s no-email template publishes all three in one click, and the nine endings of its phisher set cost $212.41 a year. ## The three records that make a domain mail-proof | Record | Name | Type | Value | What it says | | --- | --- | --- | --- | --- | | Null MX | @ | MX | 0 . | This domain accepts no email (RFC 7505) | | SPF | @ | TXT | "v=spf1 -all" | No server is authorised to send as this domain (RFC 7208) | | DMARC | _dmarc | TXT | "v=DMARC1; p=reject; adkim=s; aspf=s" | Receivers are asked to reject mail that fails the checks (RFC 7489) | ## Why do unused domains need email records? **Because anyone can put your domain in the From line of an email, and a domain with no records gives receivers nothing to check.** A defensive domain such as a typo of your brand is attractive for this reason. Phishers send mail that appears to come from the variant, or from a name that looks like your support address, and a receiving system that finds no policy has no basis to reject it. Two records close most of that gap. SPF lists the servers that may send for a domain, and an SPF record with no servers and a hard fail rejects every sender. DMARC tells receivers what to do with mail that fails SPF and DKIM checks, and `p=reject` asks them to refuse it. The third record, a null MX, tells senders that the domain has no mail server, so a message to it fails at once instead of being retried for days. Wardmint's list of defensive endings is in [which domains a crypto project should register](https://wardmint.com/which-domains-should-a-crypto-project-register/ "Which domains should a crypto project register?"). Once you own them, these three records are the first thing to add. ## What does a null MX record (RFC 7505) do? **A null MX is a single MX record with preference 0 and a root dot as the target, and it means the domain accepts no email.** RFC 7505 defines it. The exchange is a zero-length label, written in zone files as a dot, and because a dot is not a valid host name the record cannot be mistaken for a real mail server. Two rules apply. A domain that publishes a null MX must not publish any other MX record. And the record is a null MX only in exactly this form: preference 0, target dot. Senders that see it fail immediately with a permanent error, which stops mail loops and saves the retry queues of honest senders who mistyped your domain. Without it, a sender that finds no MX falls back to the A record of the domain and tries to deliver there, which is slower and less clear. A null MX removes that guesswork. ## What does SPF v=spf1 -all mean? **It is a TXT record that authorises no sender, and the minus sign makes every check fail.** RFC 7208 defines it: `v=spf1` is the version tag, and `-all` is a single directive in which the all mechanism always matches and the minus qualifier returns fail. Together they state that no host may send mail for the name. RFC 7208 suggests this approach for names that are neither used in addresses nor expected to send mail. Publish it on the apex of each defensive domain. SPF is checked for the domain in the envelope sender or the HELO name, so a spoofer may also try a subdomain you never configured. A wildcard TXT record, which applies to names under the domain that have no records of their own, can cover those. *The no-email set for a defensive domain* ```dns example.com. 3600 IN MX 0 . example.com. 3600 IN TXT "v=spf1 -all" _dmarc.example.com. 3600 IN TXT "v=DMARC1; p=reject; adkim=s; aspf=s" ``` ## What does DMARC p=reject add? **DMARC adds the policy and the reporting: it tells receivers to reject failing mail and lets you see who tries.** RFC 7489 places the policy as a TXT record at the _dmarc name of the domain. The v tag must come first and read DMARC1, and p sets the policy to none, quarantine or reject. The sp tag sets the policy for subdomains and, if absent, p applies to them. The adkim and aspf tags set strict or relaxed alignment, and rua gives addresses for aggregate reports. The RFC is careful about the strength of p=reject: the owner asks receivers to reject, and receivers are expected to make a best effort but are not strictly obliged. Large mailbox providers follow it in practice, which is why the record is worth publishing. To see attempts, add a reporting address, for example `rua=mailto:dmarc@example.com`, on a mailbox that you read. For a project with several defensive domains, one reporting mailbox for all of them is enough. Keep a domain that does send mail, such as your main one, at a policy that matches its real senders, and read the aggregate reports before moving it to reject. ## How much does it cost to protect a defensive set? **The three records cost nothing extra at Wardmint; the domains are the cost.** Wardmint provides a "no email" DNS template (null MX, SPF -all, DMARC p=reject) so a defensive domain cannot be used to spoof your mail, free URL forwarding to send every variant to your main site, and automatic renewal from your balance so no variant lapses. According to Wardmint's survey of 12 November 2026, the nine endings in its phisher set (.xyz, .pro, .info, .shop, .online, .icu, .click, .live and .support) cost $212.41 a year in total, or $637.23 over three years, and each can carry the no-email template. The core set of .com, .net, .org, .io, .xyz, .app costs $128.94 a year. The sets are suggestions, not bundles: the names go in the cart through the bulk search, up to 50 at a time. Apply the template to every defensive domain that does not redirect web traffic, and combine it with [URL forwarding for the ones that do](https://wardmint.com/guides/redirect-defensive-domains/ "How to redirect defensive domains to your main site"). The method for choosing the names is in [how to build a defensive domain list for your brand](https://wardmint.com/guides/build-a-defensive-domain-list/ "How to build a defensive domain list for your brand"). ## How to stop spoofing on an unused domain in five steps 1. **Confirm the domain sends no mail** — Check that no service, newsletter tool or application sends from this domain. If any does, do not use this template. 2. **Publish the null MX** — Add an MX record with preference 0 and the target set to a single dot, and remove any other MX record. 3. **Publish the SPF record** — Add a TXT record on the apex with the value v=spf1 -all, and keep it as the only SPF record. 4. **Publish the DMARC record** — Add a TXT record at _dmarc with v=DMARC1; p=reject, and a reporting address in rua if you want reports. 5. **Check the records** — Run dig MX, dig TXT and dig TXT _dmarc on the domain and compare the answers with the template. *Check the three records* ```bash dig MX example.com +short dig TXT example.com +short dig TXT _dmarc.example.com +short ``` ## Questions about spoofing and unused domains ### Can I use p=reject without a reporting address? Yes. The rua tag is optional, and without it receivers send no aggregate reports. Add one if you want to see attempts. ### Does a null MX stop spoofing by itself? No. It stops mail from being delivered to the domain. SPF and DMARC are what tell receivers to distrust mail that claims to be from it. ### Should my main domain use the same records? No. A domain that sends mail needs SPF and DKIM for its real senders. Use p=reject there only after you have read DMARC reports and aligned every sender. ### Do I need all three records on every defensive domain? Yes, on any domain that sends and receives no mail. Each record covers a different part of the check, and Wardmint's template publishes them together. ### Does the template cost extra? No. It is part of the defensive tools included with registration, alongside free URL forwarding and automatic renewal from your balance. **In summary** - A defensive domain that sends no mail needs three DNS records. - Null MX: preference 0, target a dot (RFC 7505), and no other MX record. - SPF: v=spf1 -all, which authorises no sender (RFC 7208). - DMARC: v=DMARC1; p=reject at _dmarc, which asks receivers to refuse failing mail (RFC 7489). - Wardmint's no-email template publishes the three records in one click. - The nine phisher-set endings cost $212.41 a year; the template is free. - Do not use the template on a domain that sends real mail. ## Sources 1. [RFC 7505: A Null MX No Service Resource Record for Domains That Accept No Mail](https://www.rfc-editor.org/rfc/rfc7505.html) — IETF / RFC Editor (read 2026-11-12) 2. [RFC 7208: Sender Policy Framework (SPF)](https://www.rfc-editor.org/rfc/rfc7208.html) — IETF / RFC Editor (read 2026-11-12) 3. [RFC 7489: DMARC](https://www.rfc-editor.org/rfc/rfc7489.html) — IETF / RFC Editor (read 2026-11-12) --- Wardmint: Wardmint registers the defensive domains a crypto project needs — its own name across the extensions phishers use, its own typo and look-alike variants — paid in crypto with no KYC: no ID, only one verified email per domain. It is run by DomaineGoat LLC, a company registered in Panama; domains are registered through its ICANN-accredited registrar partner. A .com costs $12.49/year, the same price every year.