← All tools

Parked Domain & Wildcard Anti-Spoofing Generator

A domain doesn't have to send mail to be spoofed — anyone can forge a "From" address at a domain that's fully parked, and the same goes for any subdomain you've never used. Tell us how this domain is used, and this tool generates the records that shut both of those down.

📖 Guide: Why unused domains and subdomains get spoofed, and how to lock them down

Last updated: September 10, 2026

How to use this tool

1. Enter the domain, then say whether it's actively used to send mail (Primary) or fully parked/unused (Parked) — the records generated below depend on the answer.
2. Click "Check what's published now" (Step 1) to see the current state of the apex and the wildcard subdomain space.
3. Review the records generated in Step 2: a Primary domain only needs its wildcard subdomains locked down; a Parked domain needs both the apex and the wildcard locked down.
4. Publish each record at the host shown, through your DNS provider.
5. Re-run Step 1 after a little propagation time to confirm everything is now protected.

Sample records

For a Primary domain (already sends real mail from the apex) — only the wildcard subdomain space needs locking down:

For a Parked domain (sends no mail anywhere) — the same wildcard records, plus the apex itself:

It's needed because receivers that don't get a clear "this domain/subdomain sends no mail, reject anything claiming otherwise" signal will often deliver spoofed mail anyway — silence isn't a policy. A parked domain has no legitimate mail to protect, so unlike a live sending domain, it's safe to publish these at full enforcement immediately rather than easing in gradually.

Step 1: Check what's published now

Looks at the domain apex and the wildcard subdomain space (*.yourdomain.com) separately, since they're protected by different records.

Step 2: Generate the records for this domain