1

While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?

How do spam or phishing filters treat emails from domains without MX records? If they are checking DNS for SPF/DKIM/DMARC, certainly they also check for MX and score the incoming email appropriately. Do they?

This matters in terms of the level of email spoofing protection that we might need to consider for non-email-sending domains. Do we need to add in a bunch of SPF records for parked domains, for example?

Improve this question
3
  • This is an interesting question, but it's not clear to me why messages sent from a domain without an MX record setup should be any more likely or less likely to be treated as spam. For instance, there are many 'do not reply' type of messages (such as emergency alerts) that could legitimately be sent from a domain without an MX record setup. Notwithstanding, even if domain does not have an MX record, it can still be capable of receiving mail - in this case the MX lookup simply falls back to the A record.
    – mti2935
    Commented Nov 10, 2019 at 23:09
  • @mti2935 the threat model suggested by many is that parked domains are a rich source for spoofing. They are legitimate domains that have likely existed for a while and owned by the legitimate company. Without SPF records, it is trivial to send emails spoofed from these domains and enjoy the inherited trust/reputation. This means that all of a company's parked domains (which could be in the hundreds/thousands) need to have SPF records. My question is about the actual probability of a threat materialising from not having SPF records.
    – schroeder ♦
    Commented Nov 11, 2019 at 10:08
  • OK, that makes sense now. Thanks for clarifying. Interesting question, I'm not sure there is a good solution.
    – mti2935
    Commented Nov 11, 2019 at 10:47

1 Answer 1

Reset to default
3

I tested with a simple email spoofer and Office 365 (Forefront), and the spoofed email gets scored as suspicious (score of 5/9). The headers are inscrutable so it is difficult to see just how much the lack of MX record contributed to the score.

The same test to Gmail, a couple of times, and it never even got delivered.

Both of these tests should be repeated with much more rigor, however.

SpamAssassin has a rule NO_DNS_FOR_FROM for domains without a MX or A record. (Thanks @pornin)

So, it seems that a lack of MX records does factor into the spam score. Perhaps we do not need to add SPF to all our unused domains since spam filters appear to account for this problem.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .