The domain that sends no mail still needs DMARC

A domain that sends no email sounds like a domain with nothing to protect. It is the opposite. Parked names, defensive registrations, old brands, the .net you bought so nobody else would — nothing legitimate ever leaves them, so nobody watches them, and that is precisely why they get used. Every message claiming such a domain is a forgery by definition; yet until you publish records saying so, receivers have no way to know, and the forgeries are delivered like anyone's mail.

The fix is three small DNS records, none of which can break anything — there is no mail of yours to break. That is what makes the non-sending case the easy one: the careful, staged rollout that sending domains need does not apply here.

1 · SPF that authorizes nobody

TXT  @  v=spf1 -all

This is the whole record: no mechanisms, then -all. It says "no host on earth is authorized to send mail as this domain" — a published denial. Publishing nothing is not the same thing: a missing record means "no policy", and receivers are left to judge each message on its own. With -all, every SPF check on the domain's name fails hard, everywhere, which is exactly right.

2 · DMARC at reject, with reporting

TXT  _dmarc  v=DMARC1; p=reject; rua=mailto:<your reporting address>

p=reject tells receivers to refuse anything that fails DMARC outright — and on this domain, everything fails, because nothing can authenticate as it. Sending domains are told to approach reject slowly, through monitoring and quarantine; that ladder exists to protect their own mail, and a non-sending domain has none. Reject on day one is the correct policy, not the brave one. Subdomains inherit it automatically.

The rua address is the half people skip, and it is the monitoring half: receivers send daily aggregate reports about every message that claimed the domain. On a non-sending domain those reports have a special property — every line in them is someone trying. No reports means nobody is spoofing you; the day one arrives, you know the name is being used, from where, and that receivers refused it.

3 · DKIM: nothing to publish, one optional lock

TXT  *._domainkey  v=DKIM1; p=

A domain that sends nothing signs nothing, so there are no DKIM keys to publish — absence is correct. The optional hardening above is a wildcard record with an empty p=, which explicitly revokes: it declares that no valid DKIM key exists at any selector under the domain, so a forged signature cannot even pretend one does. Belt and braces once p=reject is up; skip it if your DNS provider refuses wildcard TXT records.

If it receives nothing either: null MX

MX  @  0 .

Sending and receiving are separate claims — plenty of domains receive mail they never answer from. But if this domain truly takes no inbound mail at all, the null MX (RFC 7505) says so explicitly: senders get an immediate, clean failure instead of timing out against a name that was never going to answer. Only publish it when both halves are true.

Then watch it

The records are five minutes of work. The part that keeps mattering is the reporting address at the end of the DMARC record — someone has to read what arrives there, and on a parked portfolio that is exactly the mail nobody reads. That is the job Sojka does: add the domain, mark it as non-sending, and the app recommends this exact record set, checks that it stays published, and sends a push the day a report shows someone using the name. Non-sending domains do not count against the plan's domain limit — a watched portfolio is the point, not an upsell.

Check any of your domains free to see what it publishes today — or start with the companion guide, Why DMARC is worth having before anything goes wrong.