[TheChaplain]

If you have any domains that does not use email, it may be a good idea to set up some DNS records to prevent it being used.

DNS SPF record: mydomain.io. TXT "v=spf1 -all"

DNS DMARC: _dmarc.mydomain.io. TXT "v=DMARC1; p=reject; sp=reject; adkim=s; aspf=s"

That ought to stop anyone trying to use your domains as source.

[brightball]

Yes! IMHO every registrar should be turning this on by default. Every DNS should do this by default until the owner explicitly turns on email sending.

It would solve a lot of issues globally.

[teddyh]

Also consider (using your example domain):

  *.mydomain.io. TXT "v=spf1 -all"

to restrict SPF on all subdomains.

[auscompgeek]

Specifying sp=reject in a DMARC policy would have a similar effect right?

[mike-cardwell]

Also, if your domain doesn't receive mail, set up a null mx record:

  @ IN MX 0 .

https://datatracker.ietf.org/doc/rfc7505/

[newsoftheday]

I use postfix and the recipient_access file to control email to my domains which use little email, so the domains are able to process standard email:

[e-mail] OK [e-mail] OK [e-mail] OK [e-mail] OK [e-mail] OK [e-mail] OK example.com REJECT example.com