https://www.gov.uk/guidance/protect-domains-that-dont-send-email Skip to main content Cookies on GOV.UK We use some essential cookies to make this website work. We'd like to set additional cookies to understand how you use GOV.UK, remember your settings and improve government services. We also use cookies set by other sites to help us deliver content from their services. Accept additional cookies Reject additional cookies View cookies You can change your cookie settings at any time. Hide this message GOV.UK Navigation menu Menu * Topics Topics Find information and services + Benefits + Births, death, marriages and care + Business and self-employed + Childcare and parenting + Citizenship and living in the UK + Coronavirus (COVID-19) + Crime, justice and the law + Disabled people + Driving and transport + Education and learning + Employing people + Environment and countryside + Housing and local services + Money and tax + Passports, travel and living abroad + Visas and immigration + Working, jobs and pensions * Government activity Government activity Search for a department and find out what the government is doing + Departments Departments, agencies and public bodies + News News stories, speeches, letters and notices + Guidance and regulation Detailed guidance, regulations and rules + Research and statistics Reports, analysis and official statistics + Policy papers and consultations Consultations and strategy + Transparency Data, Freedom of Information releases and corporate reports ----------------------------------------------------------------- + How government works + Get involved Search GOV.UK x Search Search GOV.UK Search GOV.UK [ ] Search Popular on GOV.UK * Invasion of Ukraine * Coronavirus (COVID-19) * Find a job * Personal tax account: sign in * Universal Credit account: sign in 1. Home Guidance Protect domains that do not send email Make sure that domains that do not send email cannot be used for spoofing. From: Central Digital and Data Office Published 4 October 2016 Last updated 1 March 2021 -- See all updates Get emails about this page Contents 1. Create an SPF record 2. Create a DMARC record 3. Create an empty DKIM record 4. Create a null MX record 5. Protect subdomains that send emails 6. Read more about protecting domains Print this page Read this guidance if you manage government IT and you want to protect domains which do not send email from spoofing attacks. Criminals can use unprotected domains for email spoofing and phishing, making it easier to commit fraud and damage trust in your organisation. This guidance is for domains which: * never send email like defensively registered domains or legacy domains * previously sent email but do not any more, such as gsi-family domains that are now cloud-based Read our guide to securing government email to protect domains that do send email. You only need access to your domain name system (DNS) records to make the changes in this guide. To protect your domain you need to create: * an SPF record that says you do not have any sending servers * a DMARC record to reject any email from your domain * an empty DKIM key record * a null MX record You can make bulk changes at once and alter the settings if you later decide to start sending email from this domain. Make these changes to your domain name system (DNS) records. Create an SPF record: type: TXT host or name: @ (if required) value: v=spf1 -all If you check your record using nslookup or dig you should get a result like this: yourdomain.gov.uk. TXT "v=spf1 -all" @ TXT "v=spf1 -all" yoursubdomain.yourdomain.gov.uk. TXT "v=spf1 -all" Create a DMARC record: type: TXT host or name: _dmarc value: v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s;fo=1;rua= mailto:dmarc-rua@dmarc.service.gov.uk,mailto:dmarc@yourdomain.gov.uk Replace dmarc@yourdomain.gov.uk with the email address that you want reports to be sent to. If you check your record using nslookup or dig you should get a result like this: _dmarc TXT "v=DMARC1;p=reject;sp=reject;adkim=s;aspf=s;fo=1;rua= mailto:dmarc-rua@dmarc.service.gov.uk,mailto:dmarc@yourdomain.gov.uk" Create an empty DKIM record: type: TXT host or name: *._domainkey value: v=DKIM1; p= As this is a wildcard record you cannot check it other than to look in your DNS host admin panel. Revoke all existing DKIM selectors in both TXT and CNAME records. This record will make email servers more likely to reject email from your domain. Create a null MX record: type: MX host or name: leave this field empty priority: 0 value: . Note that some DNS providers do not support a null MX record, so do not worry if you cannot create this record. Once you have made these changes you can check your domain is configured correctly in the NCSC Mail Check service. Protect subdomains that send emails You may have a domain that does not send email and a subdomain within that does send email. For example, gov.uk does not send email but cabinetoffice.gov.uk does send email. If you want to protect subdomains that send email, you must: * use sp=none instead of sp=reject * include SPF and DMARC records and other anti-spoofing configurations on all subdomains by following the set up government email services securely guidance Read more about protecting domains You can find out more about protecting domains by reading the: * email security standards * securing government email guidance Published 4 October 2016 Last updated 1 March 2021 + show all updates 1. 1 March 2021 Updated structure to clarify how to create a null MX record and removed references to requesting changes as these are no longer needed. 2. 18 February 2019 Updated to give more detailed advice on configuring domains. 3. 4 October 2016 First published. Get emails about this page Contents Print this page Related content Collection * Secure email guidance Is this page useful? * Maybe * Yes this page is useful * No this page is not useful Thank you for your feedback Report a problem with this page Close Help us improve GOV.UK Don't include personal or financial information like your National Insurance number or credit card details. This field is for robots only. Please leave blank [ ] [ ] [ ] What were you doing? [ ] [ ] [ ] What went wrong? [ ] Send Close Help us improve GOV.UK To help us improve GOV.UK, we'd like to know more about your visit today. We'll send you a link to a feedback form. It will take only 2 minutes to fill in. Don't worry we won't send you spam or share your email address with anyone. Email address [ ] Send me the survey Services and information * Benefits * Births, deaths, marriages and care * Business and self-employed * Childcare and parenting * Citizenship and living in the UK * Crime, justice and the law * Disabled people * Driving and transport * Education and learning * Employing people * Environment and countryside * Housing and local services * Money and tax * Passports, travel and living abroad * Visas and immigration * Working, jobs and pensions Departments and policy * How government works * Departments * Worldwide * Services * Guidance and regulation * News and communications * Research and statistics * Policy papers and consultations * Transparency and freedom of information releases --------------------------------------------------------------------- Support links * Help * Privacy * Cookies * Accessibility statement * Contact * Terms and conditions * Rhestr o Wasanaethau Cymraeg * Government Digital Service All content is available under the Open Government Licence v3.0, except where otherwise stated (c) Crown copyright