Using the DMARC reject policy for non email sending domains: A guide

In this article, we will discuss how attackers weaponize parked domains and how you can safeguard them from being abused in phishing and spoofing attacks.

What are parked or inactive domains?

A business can have more than one domain, but they don’t have to use them all to send or receive emails. You might buy a domain for future use, to protect your brand identity, so that no one else buys it, or to ensure it doesn’t fall into the wrong hands. These unused domains are called “parked or inactive domains.” In other words, they are webmaster-friendly aliases that can help streamline and promote your online presence.

So, yes, you can have multiple domains, but not all of them will be used for everyday operations or sending marketing emails. 

Attackers spot these inactive domains and shoot their shot because they know that these domains are unmonitored and, most importantly, aren’t properly authenticated. 

How does DMARC secure your parked domains?

For most businesses, it only makes sense to actively protect their email-sending domains because that’s where the real communication happens, but attackers conspire differently. They look for overlooked entry points and target domains that often lack security measures.
If your parked or dormant domain lacks DMARC authentication, even the Internet Service Providers (ISPs) don’t treat the emails coming from these domains with much scrutiny. This means, even if there’s a phishing email that claims to come from one of your inactive domains, it’d still be delivered to the recipient’s inbox.

This is why you need strong security measures to block or flag such emails before they reach the recipient’s inbox. DMARC is one of the best ways to do this. Although you can enforce DMARC with different policy levels (quarantine or reject), for emails like these, it’s best if you choose p=reject. After all, your parked domain is inactive, which means there is no issue about legitimate emails being blocked. So, by setting the DMARC policy to p=reject, you tell the mail servers to block any email that fails authentication for that domain.

How to protect your inactive domains with “p=reject” policy?

As we established earlier, with parked domains, you don’t have to worry about your legitimate emails not making the cut (because there are none). That’s why it’s recommended that you set your DMARC policy to p=reject. This policy instructs receiving mail servers to block any email that claims to come from your inactive domain. Since the domain doesn’t send emails at all, every message coming from the domain is likely fake, so this policy stops it before it ever lands in someone’s inbox. 

Setting p=reject is a simple and effective way to protect your unused domains from being exploited. It prevents attackers from using them to send phishing emails or spam, helping you keep your brand reputation intact, even for domains you’re not actively using.

How else can you protect your parked domains?

While the p=reject policy is one of the best ways to protect your non-email sending domains from email-based attacks, DMARC works even better when combined with other measures. 

Let’s look at how you can protect your parked domains with a few additional steps that work alongside your p=reject policy.

Publish a restrictive SPF record

For a domain that doesn’t send any email, you can make this clear to receiving mail servers by adding a restrictive SPF record. You can do this by publishing the following in your DNS:

inactivedomain.com TXT v=spf1 -all

By implementing this, you tell the mail servers that no email is authorized to come from your domain, and if they do receive one, it should be rejected or flagged right away.

Disable old DKIM keys

If you have ever had DKIM enabled for your parked domains, attackers could try to reuse those old selectors to make forged emails look legitimate. To prevent attackers from reusing old selectors and making forged emails appear legitimate, publish a DKIM record with an empty key in your DNS, with (*) as your selector and an empty “p” mechanism. By doing this, you make it clear to receiving mail servers that no DKIM keys are valid for the domain, so any DKIM signature associated with it should be rejected.

Monitor your email activity with DMARC reports

Your domain might be inactive, but that doesn’t mean attackers won’t try to use it. That is why it is important to keep an eye on what’s happening with your non-email sending domain by enabling DMARC reports. These reports show you if someone is trying to send emails that pretend to be from your domain, where those emails are coming from, and whether they passed or failed authentication checks.

By reviewing these reports regularly, you can spot spoofing attempts early and take action if needed. Even if you have set the DMARC policy at “p=reject”, monitoring your email activity can give you valuable insights into how often your parked domains are targeted and help you stay one step ahead of potential threats.

Your parked domains deserve the same level of email security as your active ones. If you ignore them, attackers can use them to send fake emails and harm your brand. Need help securing these domains? Reach out to us today!