Buying a pre-owned domain: the email legacy that comes with it

Residual traffic, visible from the first p=none

The first move after the transfer, before any sending project: publishing an observation DMARC record.

_dmarc.example.com.  IN TXT  "v=DMARC1; p=none; rua=mailto:reports@example.com"

At p=none, nothing is blocked, but receivers start sending aggregate reports — and those reports tell the domain's present: who, anywhere in the world, is emitting messages that claim this name. On a purchased domain, the inventory almost always surprises. Automations of the previous owner still run somewhere — a forgotten CRM, a monitoring system that notifies, a SaaS never cancelled. Third parties spoof the name, sometimes for years on end. Legitimate-looking flows carry on that nobody ever switched off.

This listening period is the only reliable inventory of residual traffic. A few weeks of reports are enough to sort three categories: what must be cut (the previous occupant's leftovers), what must be taken over (a service worth keeping), and what is plain impersonation. Nothing requires waiting to start the listening — the record can be published on transfer day, costs nothing, and affects no existing flow.

The methodical reset

The takeover follows a precise order, and the order matters. First the full inventory of the inherited zone, then the purge: removal of SPF include mechanisms pointing at the previous owner's vendors, withdrawal of published DKIM keys — there is no reason to leave online a key whose private half sits in unknown hands —, cleanup of MX entries and of subdomains pointing at abandoned services. Every record kept must have a written justification; doubt is settled by deletion.

Then comes the minimal rebuild: an SPF reduced to what will actually send — and as long as nothing sends, the strictest form, v=spf1 -all —, the observation DMARC described above, and several weeks of listening before the first message goes out. It is the same discipline as during an email provider migration: observe first, send second. The complete order of operations, from inventory to final hardening, is the one laid out in the 2026 checklist — a purchased domain simply runs it from square one, with an extra purge step. One period detail for the records to be written: the current standard is DMARCbis, where test mode is expressed with the t= tag — the old pct tag is gone — and where non-existent subdomains are covered with np.

Bought never to send: the immediate lockdown

Many purchases are defensive: the typo one keystroke away from the brand, the former company name, the .net doubling the .com. A domain that will never send deserves no transition period — it gets locked down on transfer day. The kit fits in three records: an empty SPF (v=spf1 -all), a null MX (0 ., RFC 7505) announcing that no mail is accepted, and a DMARC reject policy:

_dmarc.example.com.  IN TXT  "v=DMARC1; p=reject; np=reject; rua=mailto:reports@example.com"

The rua address stays in place: even locked down, the domain reports who tries to impersonate it, and that signal has value — it is often where the reason the defensive purchase was a good idea shows up in black and white. The full treatment of this case, entire fleet of dormant domains included, is detailed in protecting parked domains.

The warm-up, when the domain must send

A domain meant to send does not start at full volume, least of all with a past. Filters judge on the evidence: a name with no recent history — or with a bad one — suddenly pushing out tens of thousands of messages ticks every spammer box there is. The warm-up builds a fresh reputation through regularity: low volumes at first, a progressive ramp over several weeks, engaged recipients first (the contacts who open and reply), and irreproachable authentication from the very first message — SPF and DKIM aligned, DMARC published.

Registering the domain in Google Postmaster Tools provides, on the Gmail side, a reputation reading throughout the ramp-up; the mechanics of that judgment, and how not to collide with them, are laid out in the Gmail deliverability guide. With a heavy past — an old blocklist entry, a spam episode in the history — the warm-up will be slower, and that has to be accepted: forcing volume onto a damaged reputation damages it further. In extreme cases, the honest conclusion of the pre-purchase audit is to walk away — another name will cost less than rehabilitating this one.

The traps that remain

Drop-catching first. Expired domains are snapped up within seconds by specialized services, and spammers are fond of names with a clean history: a second-hand domain may have spent months in their hands between two legitimate owners, just long enough to exploit its reputation and its backlinks for spam or shady redirects. DNS history and web archives often reveal that episode; its invoice, however, is settled in reputation.

Historical addresses next. Third parties keep writing to the previous owner's addresses — invoices, password resets, private correspondence — and some services still expect those addresses as login or recovery identifiers. A new owner who activates reception will therefore receive mail meant for someone else, with the legal and ethical questions that come attached; absent any plan to receive, the null MX cuts the problem off at the root.

Suppression lists last. Sending platforms keep the memory of complaints and unsubscribes associated with a domain: a name that generated complaints at an ESP may see its new messages filtered by that same ESP, independently of public reputation. That liability only surfaces in use — one more reason to start small and watch the reports at every step.

In summary

A purchased domain arrives with its memory: a sender reputation good or bad, possible blocklist entries, a spoofing history and forgotten DNS records. The pre-purchase audit — public DNS history, web archives, blocklists — informs the buying decision; the methodical reset — zone purge, minimal SPF, DMARC at p=none, listening period — secures the takeover. The defensive domain gets locked down on day one (v=spf1 -all, null MX, p=reject); the domain meant to send warms up progressively, under watch. And the classic traps — drop-catching, historical addresses still expected by third parties, suppression lists — are dodged all the more easily for being known before signing.

The reflex costs nothing: running the coveted — or freshly acquired — domain through a free DMARC analysis shows in seconds the real state of its zone, inherited SPF, missing or malformed DMARC and dubious records included. From there, opening an account makes it possible to collect reports from the first p=none, build the inventory of residual traffic, and run the reset all the way to p=reject.