A cybersquatted domain name that resolves to no website at all looks, at first glance, like the least dangerous kind. There is no counterfeit storefront, no pay-per-click farm, no copycat login page; only a dead end. UDRP panels have long known better than to equate inactivity with harmlessness, and the passive-holding doctrine has been settled almost since the Policy’s earliest days. But there is a category of evidence, sitting in plain sight in the Domain Name System itself, that deserves more systematic attention than it receives in UDRP practice: the mail exchange, or MX, record.

Over recent months, sitting as a panelist for Forum (formerly the National Arbitration Forum), I have decided a series of cases in which the disputed domain name hosted no meaningful web content, or none at all, but had been configured with active MX records. In each, the complainant’s trademark had been typosquatted or wholly incorporated. In none was a fraudulent e-mail yet in evidence. This article states the analytical approach those decisions have developed, its doctrinal footing, and, just as importantly, its limits.

What an MX record is, and what configuring one signifies

An MX record is the DNS entry that tells the world’s mail servers where to deliver e-mail addressed to a domain. A domain without MX records cannot receive e-mail; a domain with active MX records is a working mailbox, whether or not any website exists. The configuration is queryable by anyone, in seconds, with standard tools; it is objective, technical, and difficult to explain away.

Consider what that configuration means on a domain like <mcdermotlaw.com>, a single-letter excision from a global law firm’s actual e-mail domain, or <tgphillips66.com>, a compound typosquat of an energy company’s official address. The registrant of such a string has no plausible use for inbound or outbound e-mail that does not trade on the resemblance. E-mail sent from such a domain arrives wearing the complainant’s name; e-mail misaddressed to it by a customer or counterparty is quietly intercepted. The web can be left dark precisely because the web was never the point.

Two words of caution at the outset. First, some registrars and parking services attach default mail-handling records to newly registered domains, so the inference is at its strongest where the configuration is affirmative rather than an artifact of registration defaults, and where it appears on a domain whose string admits no innocent explanation. Second, and more fundamentally, an MX record is capability, not conduct. What follows from that distinction is the heart of the matter.

The doctrine in practice

In Phillips 66 Company v. TD Philips, FA 2208398 (Forum Apr. 1, 2026), the domain <tgphillips66.com> did double duty: it redirected visitors to the complainant’s own website while carrying active MX records. The redirect made the domain appear affiliated with the mark owner to anyone who checked it in a browser, the ideal camouflage for an e-mail operation conducted in the mark owner’s name. The combination of a famous mark, redirection to the complainant’s own site, and active e-mail configuration supported transfer.

In McDermott Will & Schulte LLP v. [Redacted], FA 2219414 (Forum June 3, 2026), the domain was parked on a “Launching Soon” page but configured for e-mail. Because the firm conducts its attorneys’ e-mail at the near-identical official domain, the decision found the configuration presented “a serious risk that Respondent may intercept e-mails misaddressed to Complainant or use the Disputed Domain Name to impersonate Complainant’s attorneys in fraudulent communications,” a risk aggravated by the prospect that misdirected communications could carry privileged material.

The fullest statement came in Elanco Animal Health GmbH v. lu jian feng, FA 2226855 (Forum July 15, 2026), where six of seven counterfeit-storefront domains targeting the SERESTO mark carried active MX records: “No fraudulent e-mail is in evidence; the MX configuration of these typosquatted domain names nonetheless evidences the establishment of e-mail infrastructure and the attendant risk of phishing or other e-mail fraud perpetrated in Complainant’s name.”

The doctrinal footing is orthodox. WIPO Overview 3.1, paragraph 3.4, recognizes that use of a domain name for purposes other than hosting content, e-mail fraud prominent among them, constitutes bad faith, and paragraph 2.13.1 confirms that per se illegitimate activity can never confer rights or legitimate interests. Nor is the inference novel elsewhere: as the Czech Arbitration Court panel put it in Pepsico, Inc. v. Allen Othman, CAC Case No. 102380 (Apr. 25, 2019), “[t]hese preparatory steps (configuring ‘MX’ or mail exchange records) have [been] considered in relation to ‘use’ for the purposes of the Policy by other Panels.” The preparatory act is itself a form of use; the Policy does not require the mark owner to wait for the first victim.

The limits: risk, not act; corroboration, not conviction

A doctrine that converts DNS configuration into misconduct would deserve the skepticism it invited. The approach these decisions take is deliberately narrower, and three limiting principles do the work.

First, the finding is one of risk, never of act. Where no fraudulent e-mail is in evidence, the decision states that the MX configuration evidences the establishment of e-mail infrastructure and the attendant risk of fraud; it does not name the respondent a phisher, and it does not speculate about harms the record does not show. The vocabulary matters. A finding of phishing is reserved for cases where phishing is proved.

Second, the inference is corroborative, never load-bearing on its own. In each of the cases above, the MX evidence stood alongside independent indicia: typosquatting of a distinctive or famous mark, false WHOIS contact data, actual knowledge, passive holding, or an operating counterfeit storefront. An MX record on an otherwise unobjectionable domain proves nothing; an MX record on a single-letter typosquat of a law firm’s e-mail domain completes a picture the other evidence has already sketched.

Third, the inference must be declined where the record does not support it, and complainants should expect exactly that. In Cohesity, Inc. v. Jin Cheng Zhu, FA 2222167 (Forum June 10, 2026), the complainant argued that an inactive domain “may” be used for phishing. The decision refused the invitation: “That contention is speculative; the record contains no evidence of any fraudulent e-mail, targeted solicitation, or mail-exchange configuration, and the Panel makes no finding of phishing.” Transfer was ordered on other, proven grounds. A phishing allegation unaccompanied by a DNS lookup is rhetoric, not evidence.

When the phishing has happened

The MX doctrine addresses the anterior moment; it is not needed once fraud is in evidence, and it should not be confused with those cases. In Hormel Foods Corporation v. Kalu Onoh, FA 2216899 (Forum May 20, 2026), the record contained an actual March 31, 2026 e-mail from a procurement address at the disputed domain to a named supplier, falsely purporting to originate from the complainant’s procurement function. Conduct of that kind is named for what it is: phishing, and where directed at specific identified counterparties, spearphishing or business e-mail compromise. The evidentiary and rhetorical treatment of proved fraud is, and should remain, categorically different from the risk-based treatment of infrastructure alone.

What complainants should plead

The practice point is simple and almost free. Before filing, run the DNS lookup and exhibit the result. If the disputed domain carries MX records, say so, screenshot the query, and connect it to the domain’s string: why this domain, configured for e-mail, threatens this mark owner’s customers, suppliers, or personnel. If the domain carries no MX records, do not plead phishing on atmosphere alone; as Cohesity shows, panels can and should decline speculative findings, and an overreaching allegation weakens an otherwise sound complaint.

For panels, the discipline runs the other way: state the risk as a risk, weigh it with the rest of the record, and reserve the word “phishing” for the cases that prove it. The Uniform Domain Name Dispute Resolution Policy has always had a preventive dimension; transferring a loaded but unfired domain name before the first fraudulent solicitation goes out is well within it. The legitimacy of that preventive function depends on panels resisting the temptation to describe what might happen as though it already had.