How to protect a new .co.uk domain before you set up email

1. Buying the name is only the first step

You might buy your preferred .co.uk address while your business plan is still taking shape, or keep a second name to protect your brand. Neither choice requires an immediate mailbox subscription. It does create a small piece of administration: decide what that name should and should not do while you hold it.

Email spoofing means using a misleading sender identity. An attacker does not necessarily need your mailbox password to put your domain in a message. Publishing a mail policy gives receiving systems information they can evaluate. It reduces a particular impersonation risk; it does not prevent every fraudulent message or protect a different, lookalike spelling.

2. Check whether the domain really is unused for mail

Ask whoever manages your website, accounts and marketing. A domain can send booking reminders, contact-form notifications or invoices even when no employee has an inbox on it. An address that forwards elsewhere is still receiving mail. A newsletter using a sending subdomain also needs its own review.

For a hypothetical business preparing a launch, write a short inventory: website not published; no contact form; no mailbox; no forwarding; no sending services; no delegated sending subdomains. If any answer is uncertain, pause and investigate. An empty inbox is not evidence that no service is using the name.

3. Separate sending permission from incoming delivery

SPF describes authorised sending infrastructure for the domain identity checked during delivery. The non-sending TXT value v=spf1 -all authorises none. Keep a single SPF policy at that name; adding another alongside an existing sender policy creates a conflict rather than a combined configuration.

DMARC evaluates alignment with the visible From domain using SPF or DKIM. A policy such as v=DMARC1; p=reject communicates a preference for handling failures. Receiver decisions and indirect delivery paths still matter. Strict non-sending policies belong only on names confirmed not to send; subdomains and existing signing keys need deliberate review.

On a small screen, swipe sideways to read the full table.

4. No incoming email? Understand null MX

Simply removing all MX records is not the same as explicitly declining mail. Under the mail-delivery rules, a sender can fall back to the domain’s A or AAAA address when no MX exists. RFC 7505 defines null MX to say that the name does not accept mail: MX priority 0 with a target consisting of a single dot.

A null MX must not sit beside ordinary MX records for the same name. It does not create a mailbox, an autoresponse or forwarding. Use it only when nobody should receive mail there. DNS interfaces differ in support for the dot target; ask your DNS host if it cannot represent null MX correctly, rather than inventing a mail-server hostname.

5. Make a small, reviewable DNS change

First save the current zone and confirm where its nameservers point. NameUK’s domain dashboard provides DNS record controls when NameUK managed DNS is active. With external nameservers, edit records at that DNS host. Registering with one provider does not make every DNS editor authoritative.

Keep website A, AAAA and CNAME records and unrelated verification records intact. For a previously used domain, have its administrator review obsolete DKIM selectors and inherited subdomain policy too. Check the published records after caches refresh, and retain a dated note of the intended no-mail state. The government’s non-sending-domain guidance provides a fuller reference; its government-specific reporting addresses are not values to copy into a business setup.

6. Revisit the policy before your first real email

Treat email launch as a separate change. Create the receiving service, replace null MX with its genuine delivery records, authorise all intended senders in one SPF policy and publish the provider’s DKIM records. Review DMARC for the new mail flows before sending. Test incoming mail, replies and automated notifications using addresses you control.

Keep your domain-account recovery address on a working mailbox throughout. Do not switch it to an address on the dormant domain before receiving mail works. Give the launch checklist to your web designer or email administrator so a months-old no-mail policy is not forgotten.

7. Budget for holding the name, then choose email separately

The domain still needs renewal even while it has no website or mailbox. Record its expiry, account owner and review date alongside the DNS note. Decide whether each defensive registration is useful enough to keep; mail authentication does not extend its registration term.

NameUK is a suitable option if you want a standalone .co.uk registration, visible ongoing prices and managed DNS controls while choosing email later. This is our own recommendation, not an independent market ranking. Compare the current domain prices below with any future mailbox subscription, and check availability before planning around a particular name.