Most domains an organisation owns send no mail at all: defensive registrations, retired brands, redirects to the main site. They are also the easiest thing in the entire estate to secure, and the most commonly skipped.
Why they matter
A domain with no SPF record returns none, which is an absence of evidence rather than a denial. Nothing stops anyone sending as it, and because nobody monitors a dormant domain, nobody finds out. They are attractive precisely because they are forgotten — the name still carries recognition and nobody is watching it.
The complete record set
; authorises nobody parked.example. TXT "v=spf1 -all" ; rejects everything claiming this domain _dmarc.parked.example. TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com" ; revokes any DKIM signature claiming this domain, at any selector *._domainkey.parked.example. TXT "v=DKIM1; p=" ; and no MX record at all
-all, not~all. This is the one place the strong qualifier is unambiguous and free. There is no legitimate sender to break.- The DKIM wildcard is the part people miss. Without it, a selector under the domain could still carry a valid signature. An empty
p=at the wildcard revokes any selector that is not explicitly published. - Keep
ruapointed somewhere you read. A dormant domain suddenly generating report volume is a signal worth receiving.
No MX does not mean it cannot receive
A domain with no MX but an A record is still a valid destination — senders fall back to the address records. If a parked domain points at a web server, that server is reachable on port 25 as far as the internet is concerned. Removing the MX is not the same as being unreachable.
A note on defensive registrations
A defensive domain that lapses is worse than one never registered: it carries whatever recognition your use of it created, and it is now someone else’s. Auto-renew and a payment method that will not expire are part of the control, not an accounting detail.