Can a look-alike domain send and receive email?

What is an MX record?

If an empty list of MXs is returned, the address is treated as if it was associated with an implicit MX RR, with a preference of 0, pointing to that host.

An MX record names the server that receives mail for a domain. Anyone can look up a domain's MX records in public DNS.

RFC 5321, the mail standard, says that when a domain lists no MX records, senders treat its address record as an implicit mail server. So a look-alike with a website but no MX record can still receive mail if a server at that address accepts it.

Why does mail on a look-alike matter?

To indicate that a domain does not accept email, it advertises a single MX RR (see Section 3.3.9 of [RFC1035]) with an RDATA section consisting of preference number 0 and a zero-length label, written in master files as ".", as the exchange domain, to denote that there exists no mail exchanger for a domain.

A look-alike with mail set up can write to your clients and receive their replies, including attachments and payment questions. A look-alike with no mail is mainly a website risk.

How do I mark my own spare domains as sending no mail?

This document defines a null MX that will cause all mail delivery attempts to a domain to fail immediately, without requiring domains to create SMTP listeners dedicated to preventing delivery attempts.

RFC 7505, published in June 2015, defines a null MX record that makes every delivery attempt to a domain fail at once. A null MX is a single MX record with preference 0 and the exchange written as a single dot.

What should I do?

1. Look up the MX records of any look-alike of your name you find.
2. If it has MX records, warn staff and key clients about that exact address.
3. Publish a null MX record on every domain you own that does not use email.
4. Add SPF and DMARC records that reject all mail on those same domains.