Guides › Requirements

Stop spoofing of domains that don't send email

Domains you own but don't use for email (parked domains, old brands, typo domains) are easy to spoof unless you say they send nothing. Publish:

@          TXT  v=spf1 -all
_dmarc     TXT  v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s
*._domainkey TXT v=DKIM1; p=
@          MX   0 .

• v=spf1 -all: no server may send.
• DMARC reject: receivers drop spoofed mail.
• The empty DKIM wildcard says "no valid keys". It's optional, but some security scanners look for it.
• Null MX (0 ., RFC 7505): the domain accepts no mail.

Check each of your domains with the checker. Monitoring covers up to 10 domains.

Related