MediumPolicy · usually medium
Non-sending domain is not protected against forgery
This domain appears not to send mail, but publishes no policy preventing others from doing so.
Check your own domain
What causes this
A domain that sends no mail should say so explicitly. Without a restrictive SPF record and a DMARC reject policy, an attacker can send mail claiming to be from it and receivers have no basis on which to refuse. Unused and parked domains are attractive precisely because nobody is watching them.
What it breaks
The domain can be used in phishing without any published policy standing in the way.
How to fix it
Publish an explicit no-mail policy.
- Publish a null MX record so senders know the domain receives no mail.
- Publish an SPF record of exactly 'v=spf1 -all'.
- Publish a DMARC record with p=reject at _dmarc.
Example record
TXT · _dmarc
v=DMARC1; p=reject; rua=mailto:dmarc@yourdomain.com
Related problems
- BIMI record published without DMARC enforcementBIMI requires a DMARC policy of quarantine or reject. The record will be ignored.
- External reporting address is not authorisedReports are directed to another domain that has not published the required authorisation record.
- DMARC record requests no aggregate reportsThere is no rua address, so you receive no data about who sends as your domain.
- DMARC policy is set to noneThe policy monitors but does not act — failing mail is still delivered.
- Subdomain policy is weaker than the domain policysp= is set to a laxer value than p=, leaving subdomains less protected.