Domains you own but never send mail from are attractive to spoofers precisely because nobody watches them. With no SPF or DMARC records, receivers have nothing to reject forged mail with. Locking one down takes three DNS records and no maintenance.
1. Null MX: receive nothing
example.com. MX 0 .A single MX record pointing at "." (RFC 7505) tells senders the domain accepts no mail, so they fail immediately instead of queueing and retrying for days. Remove any other MX records.
2. SPF: nobody may send
example.com. TXT "v=spf1 -all"No server is authorised, so every message claiming the domain fails SPF.
3. DMARC: reject everything that fails
_dmarc.example.com. TXT "v=DMARC1; p=reject;"Because nothing legitimate is ever sent, there is no rollout: go straight to p=reject. Add a rua= address if you want to see how often someone tries. The policy also covers subdomains, unless you set sp= otherwise.
Optionally: revoke every DKIM selector
*._domainkey.example.com. TXT "v=DKIM1; p="An empty key revokes it, and the wildcard covers every selector, so no DKIM signature claiming the domain can ever verify. The reserved example.com domain is set up exactly this way.
Optionally: wildcard SPF
Subdomains are covered by the parent's DMARC record, but SPF is not inherited. A spoofer using billing.example.com gets no SPF result, which DMARC p=reject still rejects. If you want SPF to say so explicitly, a wildcard *.example.com TXT "v=spf1 -all" does it, as long as no other TXT records exist under that wildcard.
Check all of it at once with the email security report, which recognises a null MX and a revoked DKIM wildcard.