Email authentication for a domain you just bought

A domain is easiest to secure on the day you register it: no legacy senders to inventory, no traffic to break, no reputation to protect — and no spoofing history to live down. Every step that takes a mature domain weeks of careful staging takes a fresh one minutes. Here is the order.

First decision: will it send at all?

Many new domains never send mail — brand protection, a future project, the .com beside your .cz. For those, skip to the lockdown: an SPF that authorizes nothing, DMARC at reject, and no DKIM keys to publish. The whole recipe with its reasoning is in the non-sending guide. Locking a parked domain down on day one costs five minutes and removes it from the spoofing toolkit permanently.

For a sending domain: the day-one records

Publish SPF naming your actual senders — your mail host's include, plus any transactional service — and nothing else; a young record with two entries is a record you understand. Enable DKIM at every sender the day you connect it, signed with your domain, and make this a habit: every future tool gets its DKIM set up as part of connecting it, not retrofitted after the reports embarrass someone. Publish DMARC immediately with a reporting address — on a fresh domain there is no reason to be shy about starting at p=quarantine, since there are no unknown legacy senders to protect; you can hold at none for a week or two of reports if you want the reassurance first.

Round it out with the transport pair — MTA-STS and TLS-RPT — while you are in the DNS console anyway; both are copy-paste on a new domain. If the domain receives no mail either, a null MX makes that explicit.

Why day one matters more than it seems

Receivers score domains on history, and a domain that authenticates 100% of its mail from its very first message builds the right history from message one. There is also a less obvious reason: spoofers scan for young, unprotected domains precisely because nobody is watching them yet. A registered name with no DMARC is an open invitation during the exact window when you would never notice.

The habit to install alongside the records: watch what comes back. Add the domain to monitoring on day one, and the first report, the first unknown sender, the first drift in a record each arrive as a push instead of a surprise. The free check shows what the records look like right now.

Check your domain free — it reads your public DNS and grades what is there.