Blog · Dmarc
How to Harden Parked Domains Against Email Impersonation
Every domain you stop using is still a domain you own. And if it is not hardened, it is impersonation infrastructure waiting to be used against your clients, your business partners, or your own employees.
That is not a hypothetical. When domains expire or get parked, the records that were once there tend to disappear, and what gets left behind is a gap that attackers actively scan for. The moment a domain stops receiving legitimate mail, it becomes a blank canvas for whoever wants to send from it without authorization.
Hardening parked domains takes four DNS records and about five minutes per domain. Here is exactly what to set, and why each record matters.
Why Parked Domains Are Impersonation Infrastructure
Email authentication checks whether a message claiming to be from your domain is actually authorized. SPF checks the sending server. DKIM checks the message signature. DMARC checks both and whether they align with the domain in the From header.
None of these checks run if the receiving server cannot find the relevant DNS records. And parked domains often have no records at all, or records left over from a previous configuration that no longer makes sense.
An attacker who controls a parked domain can send messages that appear to come from your finance team, your IT department, or your CEO. None of the major email providers will stop it, because there is nothing in DNS that says those messages should be blocked.
The four records below close that gap completely.
The Four DNS Records You Need
1. Null MX Record
The null MX tells receiving servers that this domain does not accept mail. Period.
@ IN MX 0 .
The period at the end is the critical part. A blank MX field or a missing MX record means the domain is "accept mail by default" for many providers. The explicit null MX record removes all ambiguity.
2. SPF -all Record
The SPF record names which servers are allowed to send mail from your domain. The -all qualifier at the end means "reject everything else."
@ IN TXT "v=spf1 -all"
This prevents envelope sender forgery. Even if an attacker gets a mail server to send messages, the From address they can claim is unlimited. The SPF record with -all tells receivers that no servers are authorized, so any message that arrives claiming to be from this domain and arriving from an unauthorized server should be rejected.
3. DKIM Wildcard Record
DKIM signs outbound messages with a private key. The public key is published in DNS. When you stop using a DKIM key, you should revoke it. When you stop sending mail from a domain entirely, revoking every possible DKIM key is impractical. A wildcard record handles this.
*._domainkey IN TXT "v=DKIM1; p="
The empty p= value means "no valid public key." Any DKIM signature on mail claiming to come from this domain will fail validation, because there is no key to verify it against. The wildcard applies to every subdomain, including any selector prefix.
This is especially important for domains that had DKIM keys in the past. Forgotten DKIM keys are a real attack surface.
4. DMARC p=reject Record
DMARC ties SPF and DKIM together and checks that the domains in those mechanisms align with the From header. Setting p=reject tells receivers to discard any message that fails DMARC outright.
_dmarc IN TXT "v=DMARC1; p=reject"
You do not need to worry about aggregate reports or rua endpoints for a parked domain. The p=reject policy is the important part. If someone tries to send mail claiming to be from your parked domain and it fails SPF, DKIM, or alignment, the receiving server discards it.
How to Implement the Records
For a single domain, add these four records through your DNS provider. Most providers give you a straightforward interface for adding MX, TXT, and CNAME records.
For bulk deployment across a portfolio of domains, use your DNS provider's API or a script that makes API calls. If you manage DNS through Cloudflare, AWS Route 53, or any major provider, you can automate the records with a short script or Terraform configuration.
The order of operations does not matter. All four records must simply be present before the domain can be used to send legitimate authenticated mail, and all four records together prevent impersonation.
How to Verify the Records Are Working
After adding the records, confirm they are in place with a DNS lookup:
dig MX @ .
dig TXT @
dig _dmarc TXT
Use a third-party DNS check tool to confirm propagation, especially if your DNS provider uses any routing or caching layers that might delay propagation.
For the DMARC record specifically, you can send a test message from a external mail server to your parked domain address and check whether it bounces. If the null MX is set correctly, it should be rejected at the MX stage before the message is even accepted.
Monitoring Parked Domains at Scale
Once a parked domain is hardened, you need a way to confirm the hardening holds and to catch any attempts to impersonate it.
One practical way to monitor parked domain email security at scale is DMARCFlow, which aggregates DMARC reports across your entire domain portfolio. Even for parked domains where you do not expect legitimate mail, DMARC aggregate reports will show any authentication failures including attempts to send from the domain without authorization. That signal tells you whether the hardening is holding or whether something slipped through.
For MSPs managing hundreds of customer domains, this kind of automated monitoring is the only practical way to keep track of hardening status across the full portfolio. A domain that was properly hardened six months ago might have had records removed by a DNS change, a migration, or a customer who regained access and did not know what the records were for.
Summary
A parked domain that is not hardened is free impersonation infrastructure for anyone who finds it. The fix is four DNS records:
| Record | Type | Value | Purpose |
| Null MX | MX | 0 . | Reject all mail to this domain |
| SPF -all | TXT | v=spf1 -all | Reject all mail from unauthorized servers |
| DKIM wildcard | TXT | v=DKIM1; p= | Revoke all DKIM keys |
| DMARC reject | TXT | v=DMARC1; p=reject | Discard any message failing authentication |
These four records together make a parked domain useless for impersonation, regardless of what other records may have been left behind. The hardening takes minutes to deploy, and the protection is immediate once the records propagate.