Zum Inhalt

Parked and Inactive Domains: Are SPF, DKIM, and DMARC Still Necessary?

Parked and inactive domains are easy to forget, yet attackers can still abuse them for phishing, domain spoofing, and brand impersonation. If a domain has no email authentication records at all, nothing stops someone else from sending mail that looks like it comes from you. Here i explain what SPF, DMARC, MX, and DKIM records you should publish for a parked domain, and why each one closes a specific gap attackers would otherwise use.

SPF

Publish an SPF record with -all to explicitly state that no system is authorized to send email on behalf of this parked domain.

1
2
3
4
Name: [contoso].com or @
Type: TXT
Value: v=spf1 -all
#TTL: 1 Hour (3600s)
  • Apply the same record to a wildcard subdomain entry (*) so subdomains you have not created yet inherit the same "no sender is authorized" policy.

A CNAME record cannot coexist with any other record at the same name (RFC 1912, 2.4). If a wildcard CNAME already exists on the zone, most DNS servers will reject the wildcard TXT record, so you need to publish the SPF record on the specific subdomain instead.

DMARC

Configure DMARC with p=reject to instruct receiving mail systems to reject spoofed messages that claim to originate from the domain.

1
2
3
4
Name: _dmarc.[contoso].com
Type: TXT
Value: v=DMARC1; p=reject;
#TTL: 1 Hour (3600s)

Add a rua reporting address (for example rua=mailto:dmarc-rua@contoso.com) if you want visibility into who is still trying to send mail using the parked domain.

Use Case: Subdomains You Still Care About

p=reject on the parked domain protects the domain itself, but not necessarily its subdomains. The sp (subdomain policy) tag decides whether subdomains inherit that enforcement.

1
v=DMARC1; p=reject; sp=none; rua=mailto:dmarc@contoso.com;

sp=none overrides the inherited behavior. Even though contoso.com is protected with p=reject, a subdomain such as admin.contoso.com is no longer subject to reject or quarantine by default, unless it publishes its own DMARC record.

  • A spoofed message such as ceo@admin.contoso.com can still be accepted by some receiving systems, since sp=none leaves the subdomain unprotected.
  • An SPF record on contoso.com does not automatically cover admin.contoso.com. Any subdomain used for sending mail needs its own valid SPF configuration.

If you have no subdomains you plan to use, leave sp unset (it then inherits p=reject) rather than setting sp=none, so the reject policy applies to every subdomain by default.

Use Case: Don't Leave a Parked Domain on p=none

1
v=DMARC1; p=none; rua=mailto:dmarc@contoso.com;

p=none tells receiving systems to report on DMARC results only, not to quarantine or reject spoofed mail. It is meant as a temporary monitoring step while you roll out and validate SPF, DKIM, and DMARC, not as an end state.

  • For a parked domain, there is no legitimate mail flow to validate, so there is nothing to gain by staying on p=none, and every day spent there is a day the domain is left open to spoofing.
  • A parked domain with p=none can end up worse off than one with no DMARC record at all, since it advertises that mail authentication is being watched without actually blocking anything.

Move parked domains straight to p=reject.

MX "Null MX record" (Optional)

Use a Null MX record (RFC 7505) to signal that the domain does not accept email and to reduce unnecessary mail delivery attempts.

1
2
3
4
5
Name: [contoso].com or @
Type: MX
Priority: 0
Value: . (single dot)
#TTL: 1 Hour (3600s)

DKIM (Optional)

While not strictly required for parked domains, an empty wildcard DKIM record can help prevent future abuse of DKIM selectors that were never actually configured.

1
2
3
4
Name: *._domainkey.[contoso].com
Type: TXT
Value: v=DKIM1; p=
#TTL: 1 Hour (3600s)

Summary

A parked or inactive domain still needs SPF, DMARC, and a Null MX record. DKIM is optional but adds a extra layer of protection. Without these, the domain remains an open door for phishing and spoofing even though nobody is actively using it for mail.

I would recommend to treat parked domain hardening as a standard step whenever you retire a domain, acquire one you do not plan to use for mail or specifically to protect your self to not getting phished.

References:

Kommentare