Lock down a domain that doesn't send email
A domain with no mailboxes that sends no email can be locked with two TXT records: v=spf1 -all on the domain itself and v=DMARC1; p=reject; at _dmarc. Receiving mail servers then reject any email claiming to come from it.
The records
@Valuev=spf1 -all_dmarcValuev=DMARC1; p=reject;@ means the domain itself. Some DNS hosts want the name field left empty.
If an SPF or DMARC record already exists, replace it instead of adding a second one.
Before you lock it
Make sure nothing sends email as the domain: web forms, a web shop, invoicing, newsletters or devices such as printers. If something does, follow the guide for your email provider instead.
Optional: null MX
To also say the domain accepts no email, add an MX record with priority 0 and the value “.” (a dot), as defined in RFC 7505. Not every DNS host supports it.
@Value0 .@ means the domain itself. Some DNS hosts want the name field left empty.
Common questions
Should I lock domains I don't use for email?
Yes. Scammers often pick unused domains and old brand names because nothing protects them. Locking costs nothing and has no effect when no email is sent.
What if I start using the domain for email later?
Replace the SPF record with your provider's, remove the null MX if you added one, and start DMARC again at p=none.