tmailrDeliverability
Null MX: telling the world your domain does not receive mail
11 July 2026 · 2 min read · TMailr
Plenty of domains never receive mail. Redirects, marketing sites, domains bought to protect a trademark. By default every one of them is still a mail destination, and saying so explicitly is a single DNS record most people have never published.
What happens without one
A sender with no MX record falls back to the A record, which is the rule. So mail addressed to anything@your-marketing-site.example gets delivered, or attempted, against your web server. Best case it is refused after a connection attempt. Common case it sits in the sender’s queue for days, retrying, before bouncing with a timeout that tells nobody anything useful.
It is also an invitation. A domain that appears to accept mail is worth trying, both for spam addressed to it and for backscatter using it as a forged sender.
The record
example.com. IN MX 0 .
Priority zero, and a single dot as the target. RFC 7505 defines this as a null MX: a statement that the domain accepts no mail at all. A sender that understands it fails immediately and permanently, with a clear reason, instead of queueing for a week.
Publish SPF too
A domain that never sends should say that as well, so its name cannot be used in forged mail without failing authentication:
example.com. IN TXT "v=spf1 -all" _dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:dmarc@example.com"
Three records together mean the domain neither sends nor receives, and anybody claiming otherwise fails on both legs. This is the cheapest protection available for the domains nobody is watching, which are exactly the ones that get abused.
The mistake to avoid
Do not publish a null MX on a domain that does receive mail, including one that only receives it occasionally. The failure is immediate and permanent, so mail is not delayed, it is rejected outright, and the sender is told the address does not exist.
Check before publishing: does anything use this domain for a from address, a reply-to, a password reset, or a supplier’s notification? The domain nobody uses for mail sometimes turns out to be the one that receives the invoices.
Watch for the MX you did not publish
Two things add mail records to a domain without being asked. A wildcard DNS record covering every subdomain will answer for the MX lookup too, so a domain you thought had no mail configuration quietly has one. And several registrars and parking services add their own MX by default, pointing at a catch-all nobody reads.
Both mean mail is being accepted somewhere on your behalf, by a system you are not watching, at a domain carrying your name. Check with a lookup rather than by reading the control panel: dig MX yourdomain.com tells you what the world sees, which is occasionally not what the interface shows.
Where it belongs
- Parked and defensive registrations, which are the clearest case.
- Marketing sites and campaign domains that only ever host a page.
- Subdomains used for assets or tracking, which should never receive mail.
- Any domain where you have just moved mail elsewhere and want the old name to stop pretending.
More on deliverability
