How to stop fake email from a domain you do not use
Every domain you own can appear in the "From" line of an email, including the ones you bought for a project that never launched. Unless the domain tells mail servers otherwise, most of them deliver those messages. Scammers like unused domains because nobody is watching them.
A domain that sends no email should say so. It takes three DNS records and about five minutes.
The three records
| Type | Name | Value | What it says |
|---|---|---|---|
| TXT | @ (the domain itself) | v=spf1 -all | No server is allowed to send mail for this domain. |
| TXT | _dmarc | v=DMARC1; p=reject; | Reject any message that fails that test. |
| MX | @ | . with priority 0 | This domain receives no mail (a "null MX", RFC 7505). |
The DMARC record does the real work: it is what tells Gmail, Outlook and the rest to throw fakes away. The SPF record gives them the reason. The null MX is optional, but it stops other servers from trying to deliver mail to the domain and makes the intent plain.
If the domain already has an SPF record (it starts with v=spf1), change it rather than adding a second one. Two SPF records on one domain count as an error.
Where to add them
Add the records where your DNS is hosted. That is often, but not always, the company you bought the domain from. Warnwell shows the DNS host for each domain you check.
- Cloudflare: select the domain, then DNS, Records, Add record. Some DNS hosts do not accept "." as an MX target; if yours refuses it, skip the null MX and keep the other two.
- GoDaddy: My Products, then DNS next to the domain, then Add New Record.
- Namecheap: Domain List, Manage, Advanced DNS, Add New Record.
Only for domains that send no mail
Do not add v=spf1 -all to a domain you send email from: your own mail would be rejected. A domain you send from needs an SPF record listing your mail provider, DKIM set up at that provider, and a DMARC record you raise step by step. See why DMARC p=none does not protect you.
Not sure whether a domain sends mail? If its MX records point to a mail provider, people may be receiving mail there, and something may send from it too. Warnwell tells you which domains have mail set up.
Check it worked
DNS changes usually show within minutes, and at most within a day. Check the domain again on Warnwell: the email lamp turns green and says "Locked down: takes no mail, fakes rejected".
Updated 2026-10-16.