DMARC for Non-Sending Domains

Why non-sending domains are a target

Attackers know that parked domains and secondary domains are less monitored. A company that secures yourcompany.com thoroughly may overlook yourcompany.net, yourcompany.co, or legacy-brand.com — domains they own but don't actively use.

Without SPF and DMARC, those domains can be spoofed freely. An attacker sends phishing mail claiming to be from billing@yourcompany.net and there's nothing to stop it.

The minimal lockdown record set

For a domain that sends no email at all, you need three records:

SPF: deny all senders

yourdomain.com TXT "v=spf1 -all"

This says: no mail server is authorized to send for this domain. Any message claiming to be from this domain fails SPF.

DMARC: reject all failures

_dmarc.yourdomain.com TXT "v=DMARC1; p=reject; sp=reject; rua=mailto:reports@yourdomain.com"

p=reject for the main domain. sp=reject extends that policy to all subdomains. Any message claiming to be from this domain or any of its subdomains will be rejected.

DKIM: publish a null key (optional but thorough)

Some practitioners also add a wildcard DKIM null record to prevent any possible DKIM-based bypass:

*._domainkey.yourdomain.com TXT "v=DKIM1; p="

An empty p= value signals that the key has been revoked. This is an extra layer, not a requirement. SPF -all and DMARC p=reject are sufficient for most non-sending domains.

The rua address

You still need a valid rua address to receive aggregate reports, even for parked domains. This lets you see if anyone is attempting to spoof the domain — which itself can be useful threat intelligence. Point it to the same reporting service you use for your active domains.

If you don't have a reporting service, you can point it to any mailbox you monitor. The volume on a parked domain will typically be low.

Subdomains

If your DMARC record includes sp=reject, the subdomain policy is inherited by all subdomains that don't have their own DMARC records. For non-sending domains, this is almost always what you want.

If you have specific subdomains that do send legitimate email, they need their own SPF and DKIM configuration. Give them their own DMARC record if they require a different policy from the parent.

Domains worth auditing

When securing non-sending domains, start by listing everything you own:

• Country-code and alternate TLD variants of your primary domain
• Old brand names or product names you've trademarked
• Typosquat-prevention registrations
• Infrastructure domains used for technical purposes but not mail
• Acquired company domains you no longer actively use

For each, the fix is the same: v=spf1 -all and v=DMARC1; p=reject; sp=reject. It takes minutes per domain and removes a real attack surface.