Parked Domains & Wildcard Spoofing Explained
A domain doesn't have to send a single email to be worth protecting. If it doesn't explicitly say "I send no mail, reject anything claiming otherwise," a spoofer can use it — or any subdomain of it you've never touched — to send mail that looks like it came from you. This covers two separate blind spots: domains that are fully parked, and the wildcard subdomain space under a domain you do actively use.
Last updated: September 10, 2026
Why an unused domain can still be spoofed
SPF, DKIM and DMARC are all opt-in — a domain with none of them published isn't "protected by default," it's simply unclear. Plenty of receiving mail servers will still accept a message claiming to be from a domain with no records at all, because nothing told them to do otherwise. A domain you registered years ago and never used for mail, an old product brand, a domain you're just holding, is exactly as usable for a phishing campaign as one that sends thousands of legitimate emails a day — arguably more so, since there's no real traffic for a spam filter to compare a forged message against.
The second blind spot: wildcard subdomains
This applies even to a domain that's actively and correctly configured. Your mail almost certainly comes from the apex or from mail.yourdomain.com — but nothing stops someone from sending mail that claims to be from invoices.yourdomain.com, support.yourdomain.com, or any other subdomain you've never created. DMARC's sp= tag is meant to cover this, but only if it's actually set; left unset, subdomains simply inherit whatever policy the apex has, which is easy to get wrong and easy to forget about entirely. SPF and DKIM say nothing about subdomains unless a wildcard record explicitly covers them.
The records that close both gaps
SPF hard fail (-all) | A v=spf1 -all TXT record with nothing else in it says "no server is authorized to send mail from this name" — the strongest SPF result there is, explicitly telling receivers to fail anything claiming otherwise. |
|---|---|
| Null MX (RFC 7505) | An MX record of 0 . is a standard, purpose-built signal meaning "this name accepts no mail at all." It stops mail from even being attempted, rather than relying on it being rejected somewhere downstream. |
DMARC p=reject / sp=reject | Enforces rejection for the domain itself (p=) and, separately, for every subdomain that doesn't have its own DMARC record (sp=). Both matter — one alone leaves the other half of the domain unprotected. |
| Wildcard null DKIM key | A TXT record at *._domainkey.yourdomain.com with an empty p= value says "no DKIM key is valid for any selector under this wildcard," closing off an otherwise-unlisted way to forge an aligned signature for a subdomain. |
Why it's safe to enforce immediately here
The SPF, DKIM and DMARC guides on this site all recommend easing into enforcement gradually — start at monitor-only, watch reports, then tighten. That caution exists because an actively-sending domain almost always has a mail source someone forgot about: an old CRM integration, a marketing platform, a ticketing system. A genuinely parked domain, or a wildcard subdomain space nothing legitimate sends from, has no such history to break. There's no rollout risk in going straight to reject, because there's nothing legitimate currently relying on it working any other way.
Common mistakes
- Locking down the apex of a parked domain but leaving the wildcard subdomain space untouched (or the reverse).
- Using
~all(soft fail) instead of-all— a soft fail still lets many receivers deliver the mail anyway. - Setting
p=rejectat the apex but never settingsp=, leaving the actual coverage of subdomains ambiguous. - Assuming a domain with "just a parking page" or no A record doesn't need any of this — a domain needs no website or MX records at all to be usable for sending forged mail.
See what's published now at the apex and wildcard subdomain level, then generate the exact records this domain needs.
Frequently asked questions
Why would anyone bother spoofing a domain nobody uses?
Because the recipient has no way to tell it's unused. A phishing email claiming to be from billing.yourcompany.com or an old, never-launched brand domain looks exactly as convincing as one from a domain you actively use — sometimes more, since there's no real traffic pattern for a spam filter to compare it against.
Isn't having no DNS record the same as having no mail?
No — absence of a record isn't a policy. Without an explicit SPF hard-fail, Null MX, and enforced DMARC record, many receivers will still accept and deliver a spoofed message, because nothing told them not to. Silence gets interpreted permissively, not restrictively.
Do I need to do this for every subdomain I own?
No — a single wildcard record (at *.yourdomain.com and *._domainkey.yourdomain.com) covers the entire subdomain space at once, including subdomains that don't exist yet. That's what makes it different from having to remember every subdomain individually.
Can I use p=reject on a parked domain from day one, with no monitoring period?
Yes. The usual none → quarantine → reject rollout exists to protect legitimate mail you might have forgotten about — but a genuinely parked domain, or an unused wildcard subdomain, has no legitimate mail to protect. There's nothing a reject policy can break.