Lock down a parked domain

A domain that sends no mail (a parked domain, an old brand, a domain that only hosts a website) is still worth protecting. Without records, anyone can send as it, and nobody is watching its mail to notice. Locking it down tells every receiver to refuse mail claiming to be from it.

Lock it down

1. Add the domain on Domains, or open its setup wizard with Set up.
2. At Does the domain send email?, choose No, it’s parked. If the domain has no mail servers and no SPF senders, the wizard has already said it looks parked.
3. Choose Lock it down.

The wizard publishes two records, hosted where your plan allows it and self-managed otherwise:

• DMARC at p=reject for the domain, its subdomains and subdomains that don’t exist, with strict alignment, still reporting to us so you can see who tries.
• SPF v=spf1 -all: no server may send as the domain.

The publish step shows them, plus two more you add yourself.

The two records you add

Name	Type	Value	Why
example.net	MX	0 .	Null MX (RFC 7505): the domain accepts no mail
*._domainkey.example.net	TXT	v=DKIM1; p=	Revokes every DKIM selector

They stay listed under Parked domain on the domain’s DNS records tab.

What you see afterwards

The adviser puts the domain straight into Maintain: Fully enforcing. Its reports show only mail that isn’t yours, all rejected. That’s the lockdown doing its job.

If the adviser sees a domain that has never passed DMARC in a month of reports and has no recognised sender, the Next step panel suggests it: No legitimate mail has been seen from this domain in a month of reports. If it doesn’t send mail, lock it down.

If the domain starts sending mail later, run the setup wizard again and answer Yes, it sends mail, and remove the null MX and the DKIM revocation.

Next

Read a domain’s DMARC data.