Setting up DKIM, SPF, and DMARC Records for Domains that You Won't Use for Email

Question

I have a few domains out there that are never used for email. If you look at the domains, you'll know the company. This makes me wonder, should I set up DMARC, DKIM, and SPF for these domains even though there's no MX record?

Answer 1

If these domains are related to your company or brand, you want to prevent bad actors to be able to abuse these domains.

For SPF you may publish the following records in DNS:

@ IN TXT "v=spf1 -all";

* IN TXT "v=spf1 -all";

*.[hostname] IN TXT "v=spf1 -all"

where [hostname] stands for any host records that already exist in the domain zone.

For DMARC you may publish the following record in DNS:

_dmarc IN TXT "v=DMARC1;p=reject"

Additionally, if you want to know if those domains are actively being abused you may want to set up a reporting email address in the rua tag in the DMARC record. Don't forget to set up the reporting record for the domain your collecting aggregate reports for in DNS for the target email domain, as explained here.

Answer 2

As long as you aren't using the domain for emails, those DNS records will never be checked by remote servers, so the answer is "no"