12

What is the appropriate way to set up a DNS record that says "this domain has no mail server"?

I assume I need a special MX record to do this, otherwise it will be assumed that the A record is the answer.

I ask this question because it seems like it would be better to stop the mail at the front line, so it does not become the responsibility of the webserver to reject mail for the domain in question.

6
  • 2
    I am tempted to say set something like MX 0 localhost. That would bounce it back to the sender.
    – Zoredache
    Oct 4, 2012 at 23:56
  • 3
    Don't run a mail server. Oct 5, 2012 at 0:06
  • 5
    @Zoredache Bad mail admin! RFC violation. Oct 5, 2012 at 0:06
  • 1
    The abuse@ address is optional. Only an administrative email address is required and that doesn't have to be on the same domain. Oct 5, 2012 at 3:52
  • 1
    The web server is never responsible for processing email. A web server would in fact only receive SMTP connection attempts if it was on the domain's A record address, there is no MX record and it listens on port 25. Even under those circumstances, because the web server doesn't speak SMTP those connection attempts would be silently ignored. Oct 5, 2012 at 3:57

4 Answers 4

11

Due to the fallback of directly contacting a host via its address records, a single "null MX" record of "MX 0 ." is the apparent preferred way to indicate that the host does not accept e-mail. This is similar to a "null SRV" record ("SRV 0 0 0 .") which specifically marks a service as not available (per the SRV-RR RFC 2782).

This has been standardized by RFC 7505 (as of December 2017 it is a proposed standard).

"MX 0 localhost." (or equivalent label pointing at ::1 and 127.0.0.1) is also acceptable but more appropriate for a host that must send mail to itself (e.g. cron job output) which does not accept external mail. Such hosts may have an operational mail server which is firewalled off from the Internet but other services are accessible.

Having no MX record and blocking the SMTP port does not stop people from wasting one's incoming bandwidth trying to contact a non-existent server. The single MX record methods above do prevent such traffic because address-type records are never tried when at least one MX record is present. This will probably not stop some spammers from trying to contact a host directly via its address records. However, as it does stop legitimate traffic from trying, you'll be able to identify spam sources with 100% certainty.

Using private addresses should not be used because one cannot tell where they'll end up. Using other reserved addresses (e.g. documentation address of 192.0.2.0/24) is also inappropriate except where trying to identify and trap spammers within one's own network when they try to connect.

3

I don't know what the "standard" way is, but here's one I've run across: set an MX record to a loopback address.

I suppose any private IP address (or otherwise "invalid" IP - 0.0.0.0) would do the trick. I personally think it's kind of a lousy thing to do, but it would do what you want. You could couple it with a hostname like thisdomaindoesntacceptemail.sostopsendingit as a service to the mail admin who'll end up with the ticket for "email being down" because your domain won't accept email. :)

However, why not just remove the MX record, and set your firewall rules on the A record to block SMTP and TLS (and any other mail ports)?

That would get the point across, and any admin who does a lookup will see no MX record, and refused connections on the fallback A record will remove any doubt about the intent of your configuration, should anyone even look more closely after seeing no MX record.

5
  • 4
    If you are evil you could TARPIT the SMTP ports. >:)
    – Zoredache
    Oct 5, 2012 at 0:08
  • 1
    @Zoredache Or for even more confusing evil, use someone else's SMTP server as your MX record. Oct 5, 2012 at 0:10
  • @Zoredache haha i will do that :))
    – golja
    Oct 5, 2012 at 0:31
  • 3
    To quote your own comment "Bad mail admin! RFC violation". Oct 5, 2012 at 3:59
  • @JohnGardeniers Be fair. I did say I thought it was a lousy thing to do, and suggested a better, RFC-compliant solution as well. But we're not here to stop people from blowing their feet off, if that's what they decide the want to do, after having a chance to make a fully informed decision. Oct 5, 2012 at 9:44
2

I think specifying non-existent DNS name as domain mail hub (MX) would suffice.

UPD.: And finally there is https://datatracker.ietf.org/doc/html/draft-delany-nullmx-00

UPD. 2: This eventually evolved to a IETF proposed standard now: RFC 7505: A "Null MX" No Service Resource Record for Domains That Accept No Mail

6
  • The RFCs permit falling back to the A record if no MX record exists. en.wikipedia.org/wiki/MX_record#History_of_fallback_to_A
    – Zoredache
    Oct 4, 2012 at 23:54
  • 1
    Yes, let's add another broken DNS setup to the Internet. Oct 5, 2012 at 3:58
  • @Zoredache, it says in absence of MX.
    – poige
    Oct 5, 2012 at 8:09
  • @JohnGardeniers, who cares? You? Why? Either you have better idea, or you have really horrifying visions of why mine would be too bad to ever think of. So, what's yours? Neither?
    – poige
    Oct 5, 2012 at 8:10
  • @poige Good thought with that draft, but unfortunately, it never went anywhere, so there's no "official" way to say this domain doesn't accept email. Oct 5, 2012 at 9:49
2

A simple TXT record will do this for you, set the SPF records to have a null value with a hard fail:

@ IN TXT "v=spf1 -all"
* IN TXT "v=spf1 -all"

That's how I ensure a domain can't be phished that I use to internal or non-mail services.

1
  • This covers whether the domain sends mail, not whether it can receive it.
    – Walf
    Apr 14, 2022 at 5:23

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .