Parked domains are your unguarded flank — three records fix it
The spare .com, the old brand, the misspelling you bought defensively — every domain you own but never send from is a free spoofing vector unless you say otherwise in DNS. Attackers actively prefer parked domains: real owner, real trademark, zero protection.
Three records per parked domain
SPF: v=spf1 -all — "no server anywhere may send as this domain." The shortest security policy in existence. DMARC: v=DMARC1; p=reject; sp=reject; rua=mailto:dmarc@your-main-domain.dk on _dmarc — reject outright, cover all subdomains, and route reports to your main mailbox so attempted abuse becomes visible. Null MX (RFC 7505): an MX record with priority 0 and target "." — declares the domain receives no mail, so senders fail fast instead of retrying for days. There is even an empty-DKIM convention (*._domainkey publishing p=) for completeness.
Set it, then watch it
Parked domains change when nobody is looking: a registrar migration drops records, a colleague "temporarily" points the domain at a campaign, an attacker with registrar access quietly weakens the policy. Since the records should NEVER change, any change is a signal — which makes parked domains ideal for cheap, high-signal monitoring.
This is exactly what MonitorBase's parked-domain mode does: no full audits, just record-presence and record-change checks (is SPF still -all? is p= still reject? did MX appear?), with an alert on ANY change. Parked domains are unlimited on every paid plan precisely because agencies and brand owners tend to hold dozens — protect the whole portfolio, not just the domain that sends.
Free tools that help
- DMARC Record Wizard: Answer a few questions and get a copy-ready DMARC record with DNS instructions.