7

My organization owns Internet domains that we no longer strongly use. Web requests typically simply redirect to our main corporate website, and except possibly as described below, there is no legitimate reason for anyone to send mail to addresses at these domains.

I want advice about how to handle email for these domains. I found RFC 7505, which describes using "Null MX" to indicate in DNS MX records that a domain accepts no mail. How does this reconcile with RFC 2142 (1997), which standardizes contact addresses such as abuse@domain, and other, older-school addresses like hostmaster@domain? What is the "good citizen" best practice? Have any Internet luminaries published recommendations?

Community
  • 1
Christopher Ursich
  • 73
  • 5

2 Answers2

6

As is noted already in the question, there is a conflict between the desire of not accepting incoming email and the idea of being able to contact the domain owner via email by convention-based email addresses.

There is just no way around those two goals being in direct conflict, you will have to decide if you are going to accept email or not.

If you decide that you are not going to use this domain for email at all, I think this would be a good citizen approach:

domain.example. IN SOA name.of.nameserver.example. hostmaster.primarydomain.example. 2019040100 3600 1800 3600000 7200 
domain.example. IN MX 0 .
domain.example. IN TXT "v=spf1 -all"
  • A NULL MX to indicate that you will not accept delivery of mail to this domain (avoids delivery attempts based on address records (A/AAAA)).
  • An SPF policy that indicates that no one should expect to receive any mail from this domain (makes the domain more hostile to spammers).
  • Ensuring that the SOA RNAME (second value in SOA) is actually a valid email address at domain that still accepts email (eg hostmaster.primarydomain.example. if hostmaster@primarydomain.example is a good address).
    (No suggested changes for the other SOA values, they are only present in order to show a valid record in my example.)
Community
  • 1
Håkan Lindqvist
  • 35,011
  • 5
  • 69
  • 94
  • 4
    This is an excellent answer. I would only add a `_dmarc.domain.example. IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s;"` to prevent using this domain in the `From:` headers, too. – Esa Jokinen Apr 01 '20 at 05:09
  • Thank you all for these excellent answers. Eduardo, you prompted me to carefully read RFC 2142, which I had not done in years. From that I reached the same 3 conclusions that @Håkan described so clearly, including the SOA RNAME, which I think is the key aspect of the solution. I will definitely add Esa's DMARC recommendation to my procedure also. – Christopher Ursich Apr 01 '20 at 11:45
0

RFC2142 states:

If a host is not configured to accept mail directly, but it implements a service for which this specification defines a mailbox name, that host must have an MX RR set (see [RFC974]) [...]

So, that would be a good citizen policy.

Eduardo Trápani
  • 1,210
  • 8
  • 12