A parked domain is one you have registered but are not using for a website or email. It typically shows a placeholder page from your registrar, often with ads. The domain exists, the DNS resolves, and nothing meaningful is behind it — which is fine when it is deliberate and a problem when it is forgotten.
Parking is usually described as a neutral holding state, which undersells it in both directions. Done deliberately it is sensible portfolio management. Done by accident, across a dozen domains nobody has audited in three years, it is part of your attack surface.
Table of contents
- What parking actually means
- Parked versus redirected versus addon
- Legitimate reasons to park
- The security problem with forgotten domains
- Parked domains and SEO
- Auditing what you own
- How this fits the rest of the stack
- FAQ
What parking actually means
Registration and hosting are separate things. Registering a domain gives you the name in the registry; it does not give you anywhere to point it. A parked domain is one where the second step never happened, or was undone.
Mechanically, the registrar sets the nameservers to their own and serves a placeholder from a shared IP. In many cases that placeholder carries advertising, and the registrar keeps the revenue unless you have opted into a monetisation programme.
That last detail is worth knowing: a parked domain often shows ads that you did not choose and are not paid for, on a page that carries your brand name. For a company domain that is a small but real reputational issue.
# What is this domain doing?
dig example.com A +short
dig example.com NS +short
dig example.com MX +short
# Parked domains typically show registrar nameservers,
# an A record on a shared registrar IP, and no MX records.Parked versus redirected versus addon
These three get used interchangeably by hosting control panels and they are not the same thing.
- Parked — resolves to a placeholder. No content of yours, no redirect.
- Redirected (forwarded) — returns a 301 or 302 to another domain. Visitors and search engines end up at the destination.
- Alias / addon domain — serves the same site as your primary domain, at the same paths, without redirecting.
- Unregistered — you do not own it. Not parked; available.
For defensive registrations, redirect rather than park. If you own example.net to protect example.com, a 301 to the real site is more useful than a placeholder: visitors reach you, and any links to the defensive domain pass their value along.
The alias option is the one to avoid without care. Serving identical content on two domains without canonical tags creates duplicate content, and search engines pick which one to index rather than you.
; Defensive domain: redirect it
example.net -> 301 -> https://example.com
; Or if you must serve it, be explicit about canonical
<link rel="canonical" href="https://example.com/page" />Legitimate reasons to park
- Brand protection. Registering common misspellings and adjacent TLDs so nobody else can pass themselves off as you.
- Future projects. A name secured before the product exists.
- Post-migration. After a rebrand, the old domain still receives traffic and links for years.
- Investment. Buying names to resell — a genuine market, and the source of most parking-with-ads pages.
- Holding through renewal cycles while a decision is pending.
For the first and third cases, parking is the wrong tool and a redirect is the right one. For the second and fifth, parking is fine but the domain should still be inventoried.
The cost of the domain is trivial and the cost of losing it is not. For a rebranded company, letting the old domain lapse means someone else can register it and receive email intended for you — including password resets from services still configured with old addresses.
The security problem with forgotten domains
This is the part that turns an administrative footnote into a real concern. Idle domains and their DNS records accumulate, and several of the failure modes are exploitable.
- Dangling DNS / subdomain takeover. A CNAME pointing at a cloud resource you deleted. Anyone who claims that resource name now serves content on your subdomain, with your certificate story intact. This is one of the most common real-world findings in an external audit.
- Email spoofing. A parked domain with no SPF or DMARC record can be used to send mail claiming to be from you. Receiving servers have no policy to consult.
- Expiry sniping. Lapsed domains with residual traffic and backlinks are bought automatically within minutes of dropping.
- Certificate issuance. Whoever controls DNS for a domain can obtain a valid TLS certificate for it.
Publish a null sending policy on every domain you own and do not send mail from. It takes two records and removes the spoofing option entirely:
; This domain sends no email
example.net. TXT "v=spf1 -all"
_dmarc.example.net. TXT "v=DMARC1; p=reject; rua=mailto:[email protected]"
; And no mail should be delivered to it
example.net. MX 0 .
; Nobody may issue certificates except your CA
example.net. CAA 0 issue ";"The MX 0 . null record and the CAA with an empty issue value are underused. They explicitly say no mail here and no certificates for this name, which is exactly the state a parked domain should be in.
Parked domains and SEO
A parked domain has no SEO value. It has no content, so there is nothing to rank. Long-parked domains with ad pages are frequently classified as low quality, which is a small negative signal rather than a neutral one.
The more consequential question is what happens to a domain that did have value. When you migrate, the old domain’s accumulated links are an asset that decays if you park it and transfers if you redirect it.
- 301 redirect the old domain to the new one, mapping URLs page to page rather than dumping everything on the homepage.
- Keep the redirects in place for years, not months. There is no meaningful cost to leaving them.
- Avoid redirect chains. Old → intermediate → new loses more than old → new, and chains accumulate quietly through successive migrations.
- Update the highest-value inbound links at the source where you can. A redirect preserves most of the value; a corrected link preserves all of it.
The mistake that costs the most is redirecting every old URL to the new homepage. Search engines treat a mass redirect to one page as a soft 404 and the page-level signals are discarded. Map the URLs.
Redirects are edge configuration, not application logic — the redirects documentation covers defining them per path rather than in code.
Auditing what you own
Most organisations cannot produce a complete list of their domains, which is the root of every problem above. The audit is not difficult, it is just nobody’s job.
# For each domain you know about
for d in example.com example.net example.org; do
echo "=== $d"
dig +short NS $d
dig +short A $d
dig +short MX $d
dig +short TXT $d | grep -i spf
done
# Certificate transparency logs reveal names you forgot
# crt.sh?q=%25.example.com lists every cert ever issued
# Expiry dates, before they surprise you
whois example.com | grep -i 'expiry\|expiration'Certificate transparency is the highest-yield step. Every publicly-trusted certificate is logged, so querying for your organisation’s names surfaces subdomains and domains that nobody documented.
Then the housekeeping: auto-renew on everything, registrar-lock on everything, a shared account rather than a departed employee’s personal one, and a calendar reminder to review the list annually. Boring, and it is the difference between owning your names and hoping you still do.
How this fits the rest of the stack
Parking is a holding state, not a strategy. Redirect defensive and retired domains rather than parking them, publish null SPF, DMARC, MX, and CAA records on anything you own but do not use, and audit the list once a year with certificate transparency as your starting point. If you are consolidating domains onto one platform and want to see what custom domains and bandwidth cost, the RunxBuild hosting calculator shows the line items.
Useful related references:
- What Is a .link Domain, and When Does It Fit a Project?
- Multi-Domain SSL: SAN Certificates, Wildcards, and What to Use
- Math Domain Error Explained: Meaning and How to Debug
- Custom domains and certificates on RunxBuild
FAQ
What does it mean when a domain is parked?
It is registered but not connected to a website or email service. It usually resolves to a registrar placeholder page, often with advertising the registrar sells rather than you.
Is a parked domain the same as a redirected domain?
No. A parked domain shows a placeholder; a redirected domain returns a 301 or 302 sending visitors to another domain. For defensive registrations, redirecting is almost always the better choice.
Do parked domains help SEO?
No. There is no content to rank, and long-parked ad pages are often treated as low quality. If the domain previously had value, redirect it rather than parking it so its link equity transfers.
Are parked domains a security risk?
They can be. Dangling DNS records enable subdomain takeover, and a domain without SPF and DMARC can be used to spoof email from your brand. Publish null SPF, DMARC, MX, and CAA records on every domain you own but do not use.
How do I find domains and subdomains I have forgotten about?
Query certificate transparency logs for your organisation’s names — every publicly-trusted certificate is logged, so this surfaces hosts nobody documented. Follow up with dig and whois on each result.