Best Practice: Secure Protection Domains

Modifié le Mer, 22 Juill. à 12:22 H

How can I protect a domain that does not send emails?

You own domains for identity protection, name reservation for later use, against typosquatting or web redirection.

But these domains are not used to send emails: Protect them!

Exemple :

dummy.com hosts a website and is used for emailng.

dummy.net, dummy.org, dum-my.com redirect to the dummy.com website but are not used for emailing.

Astuces :

Protect all domains against email spoofing with DMARC!

The protection is the SPF, DKIM, and DMARC configuration, and MX to make it clear to antispam users that no email is legitimate and must be destroyed and not delivered to the mailbox:

Create a empty or "protective" SPF record - mandatory: no IP address is allowed to send an email

@[.domain.com] TXT "v=spf1 -all"

Create a protection DMARC record - mandatory: no email should be accepted in the inbox and should be rejected (destroyed)

_dmarc[.domain.com] TXT "v=DMARC1; p=reject; adkim=s; aspf=s; psd=n;"

With the use of a RUA collection platform like Merox, it can be interesting to have visibility on potential shadowIT emails or phishing attempts with an address for RUA reports:

_dmarc[.domain.com] TXT "v=DMARC1; p=reject; rua=mailto:[dmarc.rua@emailsecurity.merox.io]; adkim=s; aspf=s; psd=n;"

Create an empty DKIM record - recommended: force a dkim=fail to antispams

*._domainkey[.domain.com] TXT "v=DKIM1; p="

Create a null MX record - recommended: no email should be receive on the domain

[domain.com] MX 0 "."

For all subdomains (making sure no other MX is already declared):

*[.domain.com] MX 0 "."

This statement strongly limits the load on email relays, which keep millions of emails sent blindly by attackers in a queue for several days.

Not setting an MX (Mail eXchange = email reception server) is not enough to indicate that no legitimate receipt is planned, and some relays will try to address this on servers set to the A or AAAA entries if they exist.

source RFC7505 Null MX

Note

You can check your DNS configuration with our free checker: https://check.merox.io

Exemple with this protective domain iamaramdom.website