Protect domains that do not send email
Yes! I've been begging for this for years. It's IMO the biggest enabler of phishing out there.<p>Every time I give a talk on DMARC, SPF and DKIM people seem generally unaware that any IP address can send email claiming it's from  your domain until you have explicitly turned it off.<p>By default all domains should come with a strict reject policy on email until you intentionally turn it on. I usually go through this example with my fictional pirate themed gym, Slimmer Ye Timbers.<p>Go turn off email for all of your currently unused domains. If you don't, odds are high that phish are using them.<p>Just go set an SPF and a DMARC entry. You can look at slimmeryetimbers.com for an example.<p>_dmarc.slimmeryetimbers.com. 5 IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s;"<p>slimmeryetimbers.com. 5 IN TXT "v=spf1 -all"<p>Looks like the article goes even further, but I'm not sure the extra steps they are taking are necessary.