DNSVerdictAll toolsGuidesHow it works

Null MX (RFC 7505): publish it for domains with no mail

Published · Updated

A null MX is a single MX record with preference 0 and a lone dot as the target. It tells every sender that the domain accepts no email, so they get a permanent failure at once instead of retrying for days. Use it on domains that never receive mail, such as a parked domain or a domain used only for a website or for sending through a subdomain.

example.com.  3600  IN  MX  0 .

RFC 7505 §3 defines it as an MX with “preference number 0 and a zero-length label”, and adds that “A domain that advertises a null MX MUST NOT advertise any other MX RR.” Check what a domain publishes with the MX lookup.

Why not leave MX empty

Without any MX record, RFC 5321 §5.1 tells senders to fall back to the domain’s A or AAAA record as an implicit MX. A domain with a website therefore looks like a mail server, and senders try to connect to the web host’s address on port 25, wait, and retry. A null MX replaces that guesswork with an explicit statement. RFC 7505 says it causes “all mail delivery attempts to a domain to fail immediately”.

What senders see

SituationReplyMeaning
Someone mails an address at your null-MX domain556 5.1.10Recipient address has null MX. See 5.1.10 bounce
Mail is sent from an address at a null-MX domain5.7.27Sender address has null MX. See 5.7.27 bounce

RFC 7505 §4.1 says an SMTP server that sees a null MX for a recipient domain “SHOULD use a 556 reply code” with enhanced status 5.1.10, and registers 5.7.27 for senders. Not every mail server implements the sender-side check.

The sender-side rejection is the one that surprises people. RFC 7505 §4.2 says systems “SHOULD NOT publish a null MX record” for domains they use in envelope or From addresses, and that those which do risk having mail rejected. A null MX on a domain that sends mail also removes the place where bounces and replies would arrive.

Which domains should use it

Do not put it on a domain whose users send mail. If you only need to stop receiving but still send, ask whether bounces (sent to the envelope sender) must still arrive; if so, keep a working MX.

Lock down the rest: SPF and DMARC

A domain that sends nothing should say so, otherwise attackers can forge it. RFC 7505 §4.2 notes that operators of domains that do not send mail can publish an SPF -all policy. Add DMARC with a reject policy:

example.com.         3600  IN  MX   0 .
example.com.         3600  IN  TXT  "v=spf1 -all"
_dmarc.example.com.  3600  IN  TXT  "v=DMARC1; p=reject; adkim=s; aspf=s"

Trade-off: p=reject instructs receivers to refuse mail that fails DMARC. On a domain that truly sends nothing, that is the desired outcome. On a domain where you have not inventoried all senders, it will block legitimate mail from forgotten systems. Start with p=none and a rua address if you are unsure, read the reports, then tighten. A non-sending subdomain is also covered by the parent’s DMARC policy unless it has its own, or the parent sets sp=. See How to set up a DMARC record and How to create an SPF record.

Publish and verify

  1. Remove all existing MX records at the name. A null MX must be the only one.
  2. Add MX 0 .. In some DNS panels, enter . as the target with priority 0. If the panel rejects a dot, check the host’s documentation, since a few do not accept the root name.
  3. Look it up with the MX lookup and confirm a single record.
  4. Wait for the previous TTL to pass before expecting every sender to see it.

FAQ

Is a null MX the same as having no MX? No. No MX triggers the implicit-MX fallback to A/AAAA. A null MX stops delivery explicitly.

Will a null MX stop spoofing of my domain? No. It affects inbound mail only. Spoofing is handled by SPF -all and DMARC p=reject.

Can I use MX 10 . or MX 0 localhost? No. The null form is preference 0 with the root name. Other values are not null MX and may be treated as a bad target.

Sources

Tools used

MX LookupDNS Lookup