Parked Domain: What It Is and How to Secure It From Spoofing

A parked domain is a domain name that is registered but not in active use for a website or email. It resolves to a placeholder page, an ad landing page, or nothing at all. Because a parked domain sends no legitimate mail, it should be locked down so nobody else can send mail in its name. The fastest way to do that is a hard SPF record (v=spf1 -all), a DMARC policy of p=reject, and a null MX record that tells the world the domain neither sends nor receives email.

This guide explains what a parked domain is, why people park domains, why unprotected parked domains get spoofed, and the exact DNS records that lock one down.

What is a parked domain?

A parked domain is a registered domain that has no live website and no active email service behind it. You own it and it appears in your registrar account, but it is idle. Registrars often point a freshly registered domain at a default parking page until you decide what to do with it.

Parking is a state, not a permanent status. A domain can sit parked for years and later become a real website, a redirect, or a mailbox. The point that matters for security is that a parked domain still has a DNS zone, and DNS is what attackers abuse.

Why do people park domains?

People park domains for four main reasons: brand protection, typosquatting defense, holding a name for future use, and monetization. In almost every case the domain is not meant to send email, which is exactly what makes it a spoofing target.

• Brand protection, where a company registers close variants of its main domain so competitors and impersonators cannot grab them.
• Typosquatting defense, buying common misspellings of the brand name to keep them out of malicious hands.
• Future use, holding a domain for a product or campaign that has not launched yet.
• Monetization, pointing the domain at an advertising or auction page that earns revenue from stray traffic or a future sale.

Why is a parked domain a spoofing target?

A parked domain is a spoofing target because it usually has no email authentication published, so a receiving mail server has no instruction telling it to reject forged mail. An attacker can send messages that appear to come from the parked domain, and those messages pass basic checks because nothing says they should not.

This is a real risk even for domains you never send from. Spammers and phishers specifically look for registered domains with weak or missing DNS policy, because forging an unprotected domain draws less suspicion than an obviously fake one. Understanding how SPF, DKIM, and DMARC work together is the first step to closing that gap. A parked domain with no authentication is an open name that anyone can borrow.

Should a parked domain send email?

No. A parked domain should send no mail and, in most cases, receive none either. Because there is no legitimate sending activity to break, you can apply the strictest possible policy with no risk of blocking real messages. This is the opposite of a live sending domain, where an overly strict policy can cause deliverability problems. For a parked domain, strict is safe.

The goal is to publish DNS records that state, in the clearest terms a mail server understands, that this domain sends and receives no email. Three records do the heavy lifting: SPF, DMARC, and a null MX.

What SPF record should a parked domain use?

A parked domain should use the SPF record v=spf1 -all, published as a TXT record at the root of the domain. This authorizes zero sending servers and ends in a hard fail, so any message claiming to come from the domain fails SPF.

SPF (Sender Policy Framework) is a TXT record that lists which servers are allowed to send mail for a domain. For a parked domain, that list is empty. The -all at the end is a hardfail qualifier: it tells receivers that no server is authorized to send for this domain. The SPF record syntax pairs mechanisms that authorize individual sending servers with a final qualifier that governs every other sender, and a parked domain has no servers to authorize, so only that qualifier does any work. The -all qualifier hard-fails every unauthorized sender, which is the key difference between softfail and hardfail: the softer ~all only marks those senders as suspicious instead of rejecting them.

What DMARC record should a parked domain use?

A parked domain should use the DMARC record v=DMARC1; p=reject;, published as a TXT record at _dmarc.yourdomain.com. It tells receiving servers to refuse any mail that fails authentication, and a non-sending domain has nothing legitimate to lose from the strictest policy.

SPF on its own does not force a receiver to act. DMARC (Domain-based Message Authentication, Reporting and Conformance) is the policy layer that tells receivers what to do when a message fails authentication. The p=reject policy instructs receiving servers to refuse any mail that claims to be from the domain, since nothing legitimate should ever be sent from it. You can add a rua reporting address to receive aggregate reports and confirm that spoofing attempts are being blocked. DMARC is defined by the DMARC standard, and applying its strictest policy to a non-sending domain carries no downside.

DKIM revocation and the null MX record

Two more records complete the lockdown: an empty DKIM record that revokes any old signing key, and a null MX record that declares the domain receives no mail. Neither is optional if the domain ever sent mail in the past.

DKIM (DomainKeys Identified Mail) signs outgoing mail with a private key and publishes the matching public key in DNS. A parked domain signs nothing, so it needs no active key. If a domain previously sent mail and is now being parked, publishing an empty DKIM record revokes the old key so signatures made with it no longer validate. An empty public key value effectively retires the selector.

A null MX record is the clearest signal that a domain receives no mail. Defined in RFC 7505, it is a single MX record with a priority of 0 and a target of . (a lone dot):

yourdomain.com. IN MX 0 .

A sending server that looks up the domain sees the null MX and knows there is no mailbox to deliver to, so it stops immediately instead of retrying. Combined with SPF and DMARC, the null MX rounds out a domain that plainly states it neither sends nor receives email.

The parked domain records at a glance

A locked-down parked domain publishes four DNS records: a hardfail SPF record, a DMARC reject policy, an empty DKIM key, and a null MX. The table below shows each record, its value, and what it does.

Record	Value	Purpose
SPF (TXT)	v=spf1 -all	No server may send for the domain
DMARC (TXT)	v=DMARC1; p=reject;	Reject all mail that fails checks
DKIM (TXT)	empty public key	Revoke any old signing key
Null MX	0 .	Domain receives no mail

How do you unpark a domain and add email service?

To unpark a domain for real mail, reverse the lockdown in order: add a real MX record and remove the null MX, update SPF to authorize your actual sending sources, publish a live DKIM key from your provider, then relax DMARC to p=none for monitoring before tightening it back to p=reject once your mail passes cleanly.

Add the real MX record pointing to your mailbox provider and remove the null MX. Replace v=spf1 -all with an SPF record that lists your legitimate sending sources. Publish the DKIM key your provider gives you. Move DMARC to p=none while you confirm authentication is aligned, then return it to p=reject once your legitimate mail passes cleanly.

Verification also matters once a domain starts sending. Cleaning the list you send to keeps bounces low and protects the sender reputation you are building on the newly active domain.

FAQs

What is a parked domain in simple terms?

A parked domain is a domain name you have registered but are not using for a live website or email. It usually shows a placeholder or advertising page and can be turned into a real site later.

Can a parked domain send email?

It should not. A parked domain has no legitimate sending purpose, so the safe configuration is a hard SPF record and a DMARC reject policy that block any mail claiming to come from it.

How do I protect a parked domain from spoofing?

Publish an SPF record of v=spf1 -all, a DMARC record of v=DMARC1; p=reject;, revoke any old DKIM key, and add a null MX record. Together these tell receivers the domain sends and receives no mail.

What is a null MX record?

A null MX record, defined in RFC 7505, is a single MX record with priority 0 and a target of a single dot. It signals that the domain accepts no email, so sending servers stop trying to deliver.

Does a parked domain need DMARC if it never sends mail?

Yes. Domains that never send are common spoofing targets precisely because they often lack policy. A DMARC record with p=reject tells receivers to discard forged mail and protects your brand from impersonation.

Before your next campaign from any newly activated domain, run your list through BounceCheck to remove invalid addresses and keep your bounce rate low.