Protect domains that do not send email
Yes! I've been begging for this for years. It's IMO the biggest enabler of phishing out there.Every time I give a talk on DMARC, SPF and DKIM people seem generally unaware that any IP address can send email claiming it's from  your domain until you have explicitly turned it off.By default all domains should come with a strict reject policy on email until you intentionally turn it on. I usually go through this example with my fictional pirate themed gym, Slimmer Ye Timbers.Go turn off email for all of your currently unused domains. If you don't, odds are high that phish are using them.Just go set an SPF and a DMARC entry. You can look at slimmeryetimbers.com for an example._dmarc.slimmeryetimbers.com. 5 IN TXT "v=DMARC1; p=reject; aspf=s; adkim=s;"slimmeryetimbers.com. 5 IN TXT "v=spf1 -all"Looks like the article goes even further, but I'm not sure the extra steps they are taking are necessary.