What if you do receive email for your domain but never for your subdomains, and therefore have necessary and non-"null" MX, etc., set up on the domain? Is there any point in having "null" records for the subdomains, and if so, is there any non-verbose way to do this?

e.g., receiving emails at [email protected], but never anything @sub1.example.com, @sub2.example.com, etc.

Use wildcard reject SPF for nameserver entries, for example:

  example.net TXT "v=spf1 include:spf.yourmailprovider.example -all"
  *.example.net TXT "v=spf1 -all"

and use strict DMARC policies. Unfortunately due to how DNS was defined, wildcard entries are not used whenever a subdomain is defined - even if its an A entry, so if you use an active subdomain (www is used most of the time) you unfortunately need to add them manually*. Also depending on your specific provider you may not be able to add them (unfortunately that's on them).

* Except on, rather surprisingly, Microsoft's DNS servers (you can tick a box to force an wildcard entry to show up even if there are records already defined).

Thanks, I do have several subdomain A records, but not a ton. I should get around to explicitly adding at least the SPF rejects for them.

I do hope that an SPF2 will allow defining subdomains. Until then, this is the best defence.