3

I have a few domains out there that are never used for email. If you look at the domains, you'll know the company. This makes me wonder, should I set up DMARC, DKIM, and SPF for these domains even though there's no MX record?

2 Answers 2

4

If these domains are related to your company or brand, you want to prevent bad actors to be able to abuse these domains.

For SPF you may publish the following records in DNS:

@ IN TXT "v=spf1 -all";

* IN TXT "v=spf1 -all";

*.[hostname] IN TXT "v=spf1 -all"

where [hostname] stands for any host records that already exist in the domain zone.

For DMARC you may publish the following record in DNS:

_dmarc IN TXT "v=DMARC1;p=reject"

Additionally, if you want to know if those domains are actively being abused you may want to set up a reporting email address in the rua tag in the DMARC record. Don't forget to set up the reporting record for the domain your collecting aggregate reports for in DNS for the target email domain, as explained here.

1
  • Reading about these protocols, this is kind of what I was thinking, so thank you for confirming my bias, ha! Jul 28, 2023 at 15:19
0

As long as you aren't using the domain for emails, those DNS records will never be checked by remote servers, so the answer is "no"

1
  • Unless someone is spoofing those domains to trick recipients into something. This is exactly why you should publish restrictive SPF and DMARC records, to disallow anyone from sending on behalf of those domains.
    – Reinto
    Jul 27, 2023 at 18:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.