- Null MX, defined
- A null MX is a record of the form
0 .published by a domain to state explicitly that it accepts no mail at all, letting senders fail fast instead of retrying for days.
The record is defined in RFC 7505 and consists of priority zero with a single dot as the exchange. There is no host to connect to, and that is the entire message.
A conforming sender treats it as a permanent failure immediately. Without it, mail to a domain with no mail service sits in a retry queue for up to five days before anyone is told.
Publish it on domains you own defensively, on parked names, and on any domain that only serves a website. It stops backscatter and makes spoofing your unused domains less attractive.
It also removes ambiguity for verification. A null MX is an unambiguous, cheap, DNS-level answer that nothing can be delivered here.
How ZapBounce reports it
A null MX returns invalid immediately at the DNS stage, with the reason null_mx. No connection is attempted, because the domain has stated there is nothing to connect to.
Publishing one and watching it work
Say you own acme-rewards.example, which hosts a web page and has never had a mailbox. In your DNS zone, add one line: acme-rewards.example. IN MX 0 . and remove any other MX records. RFC 7505 is explicit that a null MX must be the only MX record at that name. Check it with dig +short MX acme-rewards.example, which should print 0 . and nothing else.
Now someone mistypes an address and mails help@acme-rewards.example. Their server looks up the MX, sees the null record, and fails the message on the spot. The standard even assigns a specific reply for this: 556 with enhanced status code 5.1.10, meaning the recipient's domain has a null MX. Whoever sent it gets a clear bounce in seconds.
Compare that with the same domain before the change. With no MX at all, the sending server falls back to the A record, tries to reach your web server on port 25, times out, and keeps retrying for days before giving up.
The same record also speaks for outgoing mail
RFC 7505 covers the other direction too. A domain that can't receive mail can't receive bounces either, so it makes a poor sender. Receiving servers are allowed to reject a message whose envelope sender is at a null MX domain, and the standard defines a status code for that as well, 5.7.27.
That makes the record one part of a three-part lockdown for names you own and don't send from. The null MX says no mail comes in. An SPF record of v=spf1 -all says no server may send as this domain. A DMARC record with p=reject tells receivers to refuse anything that tries.
Be careful with the scope before you publish. A null MX on acme.example doesn't affect mail.acme.example, since MX records apply to the exact name only. And check that nothing quietly relies on the domain for mail, such as a registrar contact address or an old alerting system, because those messages will start failing immediately.
Null MX: common questions
What does a null MX record look like?
A single MX record with priority 0 and a dot as the exchange, published where normal MX records would go.
Should a website-only domain publish one?
Yes. It stops retries, reduces backscatter, and makes the domain a less useful spoofing target.
Is no MX the same as a null MX?
No. An absent record allows an A-record fallback under the standard. A null MX is an explicit refusal.