Check null MX when an email domain looks wrong

When a user reports an unfamiliar sender domain, run dig +short MX domain before researching the firm. A null MX (0 .), SPF v=spf1 -all, and parking nameservers mean the domain can't send or receive mail. So the domain was either misread or spoofed. Here a one-letter-off variant had Google Workspace MX and matched a real firm, which resolved the identity immediately. Ask the user to re-check the raw invite address, and treat the literal parked domain as suspicious.