While SPF/DKIM/DMARC are standard, foundational tools to help protect an email-sending domain from spoofing, what about domains that do not send emails?

How do spam or phishing filters treat emails from domains without MX records? If they are checking DNS for SPF/DKIM/DMARC, certainly they also check for MX and score the incoming email appropriately. Do they?

This matters in terms of the level of email spoofing protection that we might need to consider for non-email-sending domains. Do we need to add in a bunch of SPF records for parked domains, for example?


I tested with a simple email spoofer and Office 365 (Forefront), and the spoofed email gets scored as suspicious (score of 5/9). The headers are inscrutable so it is difficult to see just how much the lack of MX record contributed to the score.

The same test to Gmail, a couple of times, and it never even got delivered.

Both of these tests should be repeated with much more rigor, however.

SpamAssassin has a rule NO_DNS_FOR_FROM for domains without a MX or A record. (Thanks @pornin)

So, it seems that a lack of MX records does factor into the spam score. Perhaps we do not need to add SPF to all our unused domains since spam filters appear to account for this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.