An unused brokerage domain can be impersonated in email without anyone accessing a mailbox. Security for a parked domain starts with two separate checks: whether anything still sends mail using it and whether the business still needs to receive mail there. M3AAWG’s June 2022 guidance addresses both.

Here, “parked” means retained without email service. The domain may still host a website, a situation the guidance also covers. A retired team name, property campaign or former brokerage brand deserves review even if its website redirects elsewhere.

Establish what still uses the domain

For brokerage operations, closing employee mailboxes is only part of retiring a domain. Start with an inventory: M3AAWG’s February 2022 domain-management guidance recommends documenting domains and management responsibilities, and protecting administrative access.

Ask the administrator for a dated record covering four areas:

• Control: The registered owner, registrar, DNS provider, renewal responsibility and people or vendors permitted to change settings. Identify relevant subdomains, including names administered by outside vendors.
• Sending: CRM campaigns, website forms, transaction platforms and marketing services. Request configuration records, sending logs and sample message headers showing the visible From address, envelope return address and signing domain. Record the period reviewed and any infrequent campaigns it misses.
• Receiving: Mailboxes, aliases, forwarding routes, reply addresses and account-recovery addresses. Request documented tests of routes the business still needs.
• Responsibility: A business owner who approves retirement, an administrator who implements it, and a named person responsible for reports and future changes.

Reconcile vendor cancellation notices with these records. For each service among the technology used in real estate operations, establish which domain it actually uses to send mail.

Hypothetical example: A retired team’s website redirects to the brokerage’s new site, but an old property form still sends acknowledgments using the retired domain. Meanwhile, messages addressed to the old team are forwarded to current agents. Move and test the form’s sending identity before declaring the domain non-sending. Keep the incoming route until the brokerage approves ending it. Sending and receiving can have different retirement dates.

Separate sender authentication from incoming mail

The settings should follow those separate decisions. M3AAWG’s parked-domain guidance recommends deny-all SPF and a DMARC rejection policy for non-sending domains. Declaring that a domain accepts no incoming mail requires a different control.

These controls are published in DNS, the domain’s public directory of technical records:

DKIM, or DomainKeys Identified Mail, uses a digital signature and a published public key to associate a message with a signing domain. Its specification explains how keys are removed or revoked. M3AAWG’s parked-domain guidance calls for no published DKIM keys, so include obsolete vendor signing arrangements in the retirement review.

Deleting ordinary MX records is insufficient. Without MX, delivery can fall back to address records used for a website. Under RFC 7505, null MX explicitly closes that route and must not coexist with ordinary MX records for the same name.

Subdomains need their own review. SPF does not automatically extend from a parent domain to its children. DMARC policy lookup works differently; an authenticated subdomain can satisfy relaxed alignment for its parent. Ask the administrator to document effective coverage and any remaining vendor authority.

Read authentication reports as observations

DMARC aggregate reports summarize connecting server addresses, message counts, authentication results and reported handling. The aggregate-reporting specification excludes message content. These records alone cannot establish what a purported closing email said, whether a buyer acted on it or whether money was lost.

Request the reporting period, participating receivers, unexplained sending sources and the administrator’s investigation of each exception. Reporting is voluntary, so silence cannot prove inactivity. A failure alone is not proof of an attack: legitimate forwarding and message modification can disrupt authentication.

Reporting also needs a working destination. If the domain cannot receive mail, use an address elsewhere with the required external-reporting authorization. M3AAWG’s guidance explains this arrangement. Assign someone to review the reports.

Keep control after retirement

Even correctly configured authentication has limits. DMARC does not cover lookalike domains or misleading display names, and passing does not establish that a message is safe. A compromised legitimate account or signing system may still produce authenticated mail; the DKIM specification explicitly recognizes the risk of compromised signing keys.

Keep registrar and DNS access protected after retirement. M3AAWG’s domain-management guidance recommends measures including two-factor authentication and protection against accidental registration expiry.

Before accepting the administrator’s handoff, request the approved domain inventory, before-and-after DNS records, retained-mail test results and a named approver for reactivation. A future marketing campaign should trigger a fresh sending review before the old domain appears in its From address.