Read this guidance if you manage government IT and you want to protect domains which do not send email from spoofing attacks.
Criminals can use unprotected domains for email spoofing and phishing, making it easier to commit fraud and damage trust in your organisation.
This guidance is for domains which:
- never send email like defensively registered domains or legacy domains
- previously sent email but do not any more, such as gsi-family domains that are now cloud-based
Read our guide to securing government email to protect domains that do send email.
You only need access to your domain name system (DNS) records to make the changes in this guide.
To protect your domain you need to create:
- an SPF record that says you do not have any sending servers
- a DMARC record to reject any email from your domain
- an empty DKIM key record
- a null MX record
You can make bulk changes at once and alter the settings if you later decide to start sending email from this domain.
Make these changes to your domain name system (DNS) records.
Create an SPF record:
type: TXT
host or name: @ (if required)
value: v=spf1 -all
If you check your record using nslookup or dig you should get a result like this:
yourdomain.gov.uk. TXT “v=spf1 -all”
@ TXT “v=spf1 -all”
yoursubdomain.yourdomain.gov.uk. TXT “v=spf1 -all”
Create a DMARC record:
type: TXT
host or name: _dmarc
value: v=DMARC1;p=reject;sp=
