How to Secure Parked Domains With Four DNS Records
Summary
The article recommends four DNS records to reduce email spoofing from parked domains: null MX, SPF with no permitted senders, DMARC p=reject, and wildcard DKIM revocation. It also covers portfolio inventory, deployment, and optional controls.
Key points
- Configure a null MX record to refuse inbound mail to a parked domain.
- Publish an SPF record with "v=spf1 -all" to authorize no senders.
- Set the DMARC policy to p=reject; the article says it also applies to subdomains by default when no sp tag is present.
- Publish a wildcard DKIM revocation record using "v=DKIM1; p=".
- If a DNS interface cannot accept all four records, the article recommends deploying as many as it allows; it notes Cloudflare requires priority 0 for the single-dot MX record.
- Inventory domains across registrar accounts and other records, classify active senders versus parked domains, and use provider APIs to deploy the records at scale.
- Consider CAA records as an additional control and add DMARC reporting only when reports will be monitored; p=reject reduces direct spoofing but does not guarantee full protection.
Article Details
- Defense Focus
- Reduce spoofing and impersonation from parked domains by applying protective DNS records and maintaining an accurate domain inventory.
- Detection Methods
- Inventory domains using registrar account lists, expense reports, certificate transparency logs, and acquisition paperwork.
- Treat domains with no legitimate mail sent in the last year as parked until verified otherwise.
- For high-value brands, review DMARC aggregate reports for sudden spikes that may indicate probing or abuse.
- Optionally operate a mail server honeypot and log attempted deliveries and message contents to observe phishing templates.
- Data Sources
- Registrar account domain lists
- Expense reports
- Certificate transparency logs
- Acquisition paperwork
- DNS records
- DMARC aggregate reports
- Honeypot mail logs and message contents
- Rule Types
- Null MX record with priority 0 and target .
- SPF TXT record with no permitted senders (-all)
- DMARC TXT record with p=reject
- Wildcard DKIM TXT revocation record (p=)
- CAA record authorizing no certificate authorities (0 issue ";")
- Platforms
- Cloudflare
- GoDaddy
- Route 53
- Defensive Actions
- Apply null MX, SPF -all, DMARC p=reject, and wildcard DKIM revocation to parked domains.
- Set the MX priority to 0 when configuring the single-dot null MX record in Cloudflare.
- Add CAA 0 issue ";" to pure parked domains to prevent certificate issuance by any CA.
- Use registrar or DNS-provider APIs to deploy records in bulk, and make the four email-protection records part of the new-domain registration workflow.
- Add a DMARC rua address for high-value brands only when reports will be reviewed and anomalies acted upon.
- Consider a null MX honeypot to capture and analyze attempted email delivery.
People
Alex K.Flagged that Cloudflare requires priority 0 for the single-dot MX record.Dylan BouterseAdvocated adding CAA records to the parked-domain checklist.Geir RasmussenRaised the domain-inventory problem in the discussion, noting that organizations may not know which domains they hold.Mark E. JeftovicSuggested using a mail server on a parked domain as a honeypot to capture attempted deliveries and phishing templates.Varun JainAdvocated adding CAA records to the parked-domain checklist.
Threat Actors
Vendors
CloudflareWe have access to 119 GoDaddy and 54 Cloudflare accounts — thousands of domains across our clients' portfolios. That access gives us something most security advice lacks: a real-world sample of how organizationsGoDaddyWe have access to 119 GoDaddy and 54 Cloudflare accounts — thousands of domains across our clients' portfolios. That access gives us something most security advice lacks: a real-world sample of how organizationsRoute 53of our original post, since the error message won't tell you why it's rejecting the record. In Route 53, the equivalent entry is . 0.