alt Hacker NewsIf you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used.
DNS SPF record: mydomain.io. TXT "v=spf1 -all"
DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"
That ought to stop anyone trying to use your domains as source.
Replies
Yes! IMHO every registrar should be turning this on by default. Every DNS should do this by default until the owner explicitly turns on email sending.
It would solve a lot of issues globally.
I use postfix and the recipient_access file to control email to my domains which use little email, so the domains are able to process standard email:
[email protected] OK [email protected] OK [email protected] OK [email protected] OK [email protected] OK [email protected] OK example.com REJECT example.com
Also consider (using your example domain):
to restrict SPF on all subdomains.