Unused Domains Still Get Spoofed: Multi-Domain Hygiene Most Teams Skip
Most email authentication projects start with the domain on the website and the domain staff use for day-to-day mail. That is necessary. It is rarely complete.
Attackers do not only forge the logo domain. They use the names you forgot you still own: old campaign microsites, expired product brands, regional variants, misspelled defensive registrations, and “we might use this later” purchases sitting on a registrar auto-renew.
If those names can receive or claim mail without a policy, you left doors open on purpose — usually by neglect, not design.
Why unused domains are a fraud problem
A domain does not need active marketing to be useful to an attacker:
- customers still recognise the string
- suppliers may have it in old address books
- free webmail users may not know which legal entity is current
- a fluent AI-written message from
accounts@legacybrand.co.zacan still move money
Exact-domain spoofing on a forgotten name is still your brand equity. DMARC on the primary site does not protect a second zone you never configured.
This sits beside lookalike attacks: lookalikes are domains you do not own; unused domains are ones you do own and under-protect.
A simple inventory that actually gets finished
Do not start with a six-month data programme. Start with a list you can finish in one workshop.
Pull names from:
- registrar accounts (every login, not only the “main” one)
- DNS hosts and CDN accounts
- certificate inventory and old SaaS “custom domain” settings
- marketing’s past campaign list
- legal / brand’s trademark and entity list
- M&A leftovers (acquired brands still resolving)
For each name, mark one primary role:
| Role | Meaning | Default mail posture |
|---|---|---|
| Active corporate | Staff + customers expect it | Full SPF/DKIM/DMARC journey toward enforcement |
| Active sending | Campaigns, product, billing | Authenticate every platform; monitor then enforce |
| Parked / brand only | Should not send | Explicit “no send” SPF + DMARC reject (when safe) |
| Redirect only | Web 301 to primary | Same as parked for mail unless you truly send |
| Decommission | Drop or sell | Remove mail services; do not leave open relays or vague records |
If nobody can name an owner, the domain is already a risk. Unused-domain inventory is step 1 of the enterprise-wide DMARC deployment checklist.
What “no mail here” should look like
For domains that must not send:
- Do not leave random historical SPF includes for tools you retired
- Publish a tight SPF that authorises nothing useful to an attacker (common pattern: a record that fails all senders — implemented carefully so you do not break a forgotten legitimate flow)
- Publish DMARC so receivers have a policy — monitoring first if you are unsure anything still sends, then enforcement once reports are quiet
- Turn off or lock loose MX / open webmail products you no longer use
- Document who can approve bringing the name back to life
The goal is not clever DNS art. The goal is no silent legitimate senders and no easy forge path on a name the public still trusts.
Use DMARC setup, SPF setup, and how to read aggregate reports when a “dead” domain suddenly shows volume — that volume is either a forgotten system or abuse.
Subdomains and the “we only secured the apex” mistake
Securing example.co.za while leaving mail., news., billing., and old product hosts unmanaged is a partial programme. Attackers and misconfigured tools love the names marketing printed on PDFs five years ago.
Decide deliberately:
- which subdomains are allowed to appear in From
- which are web-only
- whether organizational DMARC policy and subdomain policy match your risk
The enforcement path applies per domain you care about — not only the homepage apex.
Who should own multi-domain hygiene
| Concern | Typical owner |
|---|---|
| Registrar renewals and DNS access | IT / infra |
| Brand list and legal entities | Legal / marketing |
| Which names may send mail | Security + IT + marketing |
| Payment fraud playbooks using any brand string | Finance + security |
| Quarterly review that the list is still true | Named ops owner |
Without a named owner, the list rots in a spreadsheet after the first workshop.
For multi-domain estates that need a programme rather than a one-off DNS ticket, start from the teams overview or contact path — the content problem is the same either way: inventory, policy, monitoring, enforcement.
A quarterly 45-minute review
- Diff registrar exports vs last quarter’s list
- Spot-check public SPF/DMARC on every name marked parked
- Skim reports for volume on domains that should be silent
- Retire tools still authorised on domains that should not send
- Confirm finance still verifies bank changes out of band for all brand strings, not only the primary domain
Small rhythm beats a heroic cleanup after an incident.
Final takeaway
Your attack surface for brand email is every domain and subdomain people still believe is you — not only the one on the letterhead this year. Unused names are not free. They are unmonitored trust.
Next step: list every domain your company can still renew. Run a free domain check on the ones you assume are quiet. If a parked name has no DMARC — or still authorises retired senders — treat that as an open task, not a curiosity.