email-toolbox-wiki/parked-domain-how-to.md

58 lines
3.1 KiB
Markdown
Raw Permalink Normal View History

2020-05-27 15:27:44 +02:00
<img align="right" src="images/logo-internetnl-en.svg">
2020-05-27 15:29:18 +02:00
# Parked domain how-to
2020-05-27 15:27:44 +02:00
This how-to is created by the Dutch Internet Standards Platform (the organization behind [internet.nl](https://internet.nl)) and is meant to provide practical information and guidance on explicitly configuring a parked domain not to use e-mail.
# Table of contents
2020-05-27 11:21:20 +02:00
- [What is a parked domain?](#what-is-a-parked-domain-)
2020-05-27 11:25:54 +02:00
- [Domain without e-mail](#domain-without-e-mail)
* [Null MX](#null-mx)
* [DMARC](#dmarc)
* [DKIM](#dkim)
* [SPF](#spf)
- [Domain without a website](#domain-without-a-website)
2020-05-27 11:21:20 +02:00
<small><i><a href='http://ecotrust-canada.github.io/markdown-toc/'>Table of contents generated with markdown-toc</a></i></small>
2020-05-27 11:12:03 +02:00
# What is a parked domain?
[Domain parking](https://en.wikipedia.org/wiki/Domain_parking) is the registration of an Internet domain name without that domain being associated with any services such as e-mail or a website.
2020-05-27 11:25:54 +02:00
# Domain without e-mail
2020-05-27 11:12:03 +02:00
If a domain is not using e-mail it is recommended to use the following settings.
2020-05-27 11:25:54 +02:00
## Null MX
2019-09-23 14:50:06 +02:00
Explicitly configure an 'empty' MX record according to [RFC7505 ](https://tools.ietf.org/html/rfc7505).
2020-07-17 15:08:21 +02:00
`example.nl. IN MX 0 .`
2019-09-23 14:50:06 +02:00
2020-05-27 11:25:54 +02:00
## DMARC
2020-05-27 11:12:03 +02:00
Set DMARC policy to reject mails, but allow reporting to take place. This helps detecting activity related to your domain.
2019-09-23 14:50:06 +02:00
2020-07-17 14:37:49 +02:00
`_dmarc.example.nl. IN TXT "v=DMARC1; p=reject; rua=mailto:rua@example.nl; ruf=mailto:ruf@example.nl"`
2019-09-23 14:50:06 +02:00
If the domain itself does not receive email (such as when the domain has been configured with NULL MX), then the RUA and RUF must point to another domain that does receive emails, such as:
2023-02-23 15:20:28 +01:00
`_dmarc.example.nl. TXT "v=DMARC1; p=reject; rua=mailto:rua@example.net; ruf=mailto:ruf@example.net"`
On the other domain (that does receive e-mail), add an authorization record for the parked domain:
2023-02-23 15:20:28 +01:00
`example.nl._report._dmarc.example.net IN TXT "v=DMARC1;"`
2020-05-27 11:25:54 +02:00
## DKIM
2020-05-27 11:36:18 +02:00
When using a wildcard selector to set an empty public key, you indicate that all previously used keys are revoked and must be considered unreliable. You can also use this to explicitly signal that a domain is not configured to use e-mail. However, [according to the RFC](https://tools.ietf.org/html/rfc6376#section-6.1.2) the absence of a selector / public key (e.g. as a result of deleting the entire DKIM resource record) is semantically equal to a resource record with an empty public key. This means that both approaches should be treated similar by the receiving mail server.
2020-07-17 14:37:49 +02:00
`*._domainkey.example.nl. IN TXT "v=DKIM1; p="`
2019-09-23 14:50:06 +02:00
2020-05-27 11:25:54 +02:00
## SPF
2020-05-27 11:21:20 +02:00
Set an an empty policy (not mentioning any ip-adresses or hostnames which are allowed to send mail) and a hard fail.
2019-09-23 14:50:06 +02:00
2020-07-17 14:37:49 +02:00
`example.nl. IN TXT "v=spf1 all"`
2020-05-27 11:12:03 +02:00
2020-05-27 11:25:54 +02:00
# Domain without a website
Apply the following settings to domains not using a website.
2019-09-23 14:50:06 +02:00
* Don't use an A or AAAA record for parked domains.
2020-05-27 11:12:03 +02:00
* Don't redirect from a parked domain to the used domain, since this encourages users to keep using the parked domain name. If a redirect is desirable, make sure to use the proper redirect order in order for HSTS headers to remain effective:
2019-09-23 14:50:06 +02:00
1. redirect from HTTP to HTTPS on the same (sub)domain.
2. when using HTTPS, redirect to another (sub)domain.