A domain registered for a future project, or bought to protect a brand, is usually left entirely unconfigured. That is the one state that creates a problem.
The mail problem
A domain with no records can be used by anyone to send email claiming to come from it. Receiving systems have nothing to check the claim against, so it passes the checks that exist.
Unused domains are attractive for this precisely because they have no sending history to contradict the forgery.
Three records close it, and they take two minutes.
example.com. IN TXT "v=spf1 -all" example.com. IN MX 0 . _dmarc.example.com. IN TXT "v=DMARC1; p=reject;"
The first authorises nobody to send for the domain. The second. A null MX: states the domain accepts no mail at all. The third tells receivers to reject anything that fails.
Together they say: nothing legitimate ever comes from here. Understanding SPF, DKIM and DMARC walks through what each one does, and stopping your domain being used for spoofing explains the version for a domain you do use.
The web side: three choices
Leave it unresolved. No A record, so the domain simply does not answer. Honest, and it looks broken to anyone who tries it, which matters if the name is printed anywhere.
A holding page. One static page saying what the domain is for and how to make contact. Cheap, and it turns a dead end into something.
A redirect to an existing site. Usually right when the domain is a variant of a name you already use; a misspelling, a different extension, an old brand name.
For the third, remember the domain still needs an A record pointing somewhere that can serve the redirect. A redirect cannot happen if nothing answers the name. Domain forwarding and URL masking explains it, including why masking is worth avoiding.
Registrar parking pages
Most registrars will park a domain for free, and the page frequently carries advertising you did not choose.
To a visitor that advertising appears to be yours, which is a poor impression for a brand-protection domain and occasionally an embarrassing one.
Check what the parking page actually shows before relying on it. A one-page holding site on your own hosting costs nothing extra if you already have hosting.
Do not let it be indexed
A holding page or a duplicate of your main site on a second domain can be indexed and compete with the real site.
For a redirect this is handled automatically, since there is no page to index. For a holding page, a noindex instruction is worth adding. Writing a robots.txt walks through why blocking alone leaves it listed without a description.
Never serve a full copy of your site on an alternative domain. That is duplicate content across two names, and it is a self-inflicted problem. See addon domains, subdomains and duplicate content.
A certificate, if it resolves
If the domain answers at all over HTTPS, it needs a certificate covering it, including the www form. Without one, anyone typing the secure form sees a browser warning, which is worse than nothing.
This applies to redirects too: the redirect happens after the connection is established, so the certificate must be valid first. There is more on coverage in SSL for subdomains and addon domains.
Keep it in the inventory
A parked domain is the kind most easily forgotten and most easily lost to a renewal notice nobody read.
It belongs in the same list as everything else, with the same auto-renewal and the same contact address. There is more on keeping it in managing a portfolio of domains.
Verify the mail records are doing their job
The three records only help if they are published correctly, and a mistyped one is indistinguishable from none.
dig example.com TXT +short dig example.com MX +short dig _dmarc.example.com TXT +short
Expect exactly one SPF string, a single MX line reading 0 ., and a DMARC record with a rejecting policy. Anything else, particularly two SPF records, means the protection is not in effect.
The null MX is the one most often mistyped. It is a priority of zero followed by a single dot, and a record pointing at a hostname instead means the domain accepts mail after all. There is more on the syntax in understanding MX records.
Watch what the domain is being used for
A parked domain generates no legitimate traffic, which makes any traffic it does generate informative.
DMARC reporting is worth enabling here specifically: it tells you whether anybody is attempting to send as the domain, which on an unused name is a clear signal rather than noise to interpret.
_dmarc.example.com. IN TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"
Send those reports to an address on a domain you actually monitor, not to this one. And be aware they arrive in volume if the domain is being spoofed regularly, which is itself the finding.
Renewal is the whole risk
A parked domain does nothing, which is exactly why nobody notices when it lapses.
The consequences of losing one differ by why it was registered. A defensive registration lost to a competitor or a squatter is an expensive mistake. A misspelling of your main domain, once released, can be registered by somebody who wants your mistyped traffic, and it will still receive mail addressed to it.
Register these for several years rather than one, keep auto-renewal on, and put them in the same inventory as the domains that matter. Managing a portfolio of domains and renewals explains the record.
Review whether it is still needed
Parked domains accumulate and are rarely reconsidered.
Once a year, for each: what was it registered for, is that reason still current, and what would happen if somebody else had it.
Some will have outlived their purpose: a product name that was never launched, an extension bought when a different strategy was in play. Releasing those is reasonable, provided the domain never hosted anything and never received mail.
Where it did, the release is a decision instead of a saving: old links and old addresses continue to reach whoever holds it next. Buying an aftermarket domain deals with what the next owner inherits.