Protecting names you do not send from.
THE PROBLEM
Anyone can send mail claiming to be from your domain.
If the domain publishes no SPF or DMARC, receivers have nothing to check against and the forgery may be accepted.
WHY IT MATTERS
Your business name on a fraudulent message damages you, even though your systems were not involved.
FOR A DOMAIN THAT SENDS NO MAIL
Publish an SPF record permitting nothing at all.
And a DMARC policy rejecting everything.
Together those tell receivers that no legitimate mail comes from this domain, so anything claiming to is forged.
FOR SUBDOMAINS
A DMARC policy can cover subdomains, which are otherwise a gap.
Someone forging mail from a subdomain you never use is a known pattern.
FOR YOUR MAIN DOMAIN
Different. It does send mail, so SPF must list the legitimate senders and DMARC should start in monitoring mode.
WHEN TO DO THIS
For every domain you own and do not send from: defensive registrations, old names, held domains.
It costs nothing and closes a real gap.
