Protect a domain that doesn't send email
Spammers love parked domains: nothing tells receivers the domain never sends, so spoofed mail from it looks as plausible as anyone's — and it's your name on the phish. Three records close that door completely. This is the configuration the UK's National Cyber Security Centre recommends for domains that don't send email.
Only apply this to domains that truly send no mail — these records will block any legitimate sending outright.
SPF: nobody may send
TXT · Name: @ · Value: v=spf1 -all
Tells every receiver that no server anywhere is authorized to send mail as this domain.
Null MX: this domain takes no mail
MX · Name: @ · Value: 0 .
Priority 0 pointing at a single dot — the standard RFC 7505 signal that the domain receives no email. If your DNS provider's form rejects a bare dot, skip this record; the NCSC notes not all providers support it.
DMARC: reject anything that claims otherwise
TXT · Name: _dmarc · Value: v=DMARC1; p=reject
Instructs receivers to refuse mail that fails authentication — which, with the SPF record above, is all of it. Add rua=mailto:you@your-real-domain later if you want reports of spoofing attempts (reports to a different domain need that domain's authorization record).
Where to add these: your DNS provider's records page — the provider-specific steps in our SPF and DMARC guides apply to these records too (pick your provider on the guide page).
Let the checker do it for your domain
Run the free SPF checker on a no-mail domain and Fix It mode generates this exact bundle with your domain filled in — then rechecks once you've published.
Check a domain →