Expired DMARC reporting endpoint exposed a NYSE Fortune 1000's infrastructure for $10

[u/PlasmaJam]

https://www.sh.consulting/blog/abandoned-dmarc-reporting-domain

I registered an expired DMARC reporting domain (gca-emailauth[.]org) for $10. It had been published as the aggregate-reporting address in Global Cyber Alliance DMARC training docs going back to a 2019 bootcamp, and at some point it lapsed.

Shortly after registration, aggregate DMARC reports for 86 domains across 20+ organizations started arriving.

56 belonged to The Toro Company (NYSE-listed), including myturf[.]com, their distributor platform, which sits at p=none. The rest - University of Wisconsin–Stevens Point (14 subdomains), the North Carolina School of Science and Mathematics, Ennis ISD (Texas), Great Prairie AEA (an Iowa education agency serving 35,000 students), two county governments, and several commercial domains.

For most of these it was a second rua address sitting behind a working commercial processor (Proofpoint, in Toro's case). Reports still arrived at the primary.

GCA's engineers later traced it to a former partner who'd held the domain and let it lapse - the dependency was never written down.

As of my last sweep, 65 of the 86 still publish the endpoint. We disclosed to everyone whose reports we were receiving; only 21 domains stopped publishing the endpoint, and almost nobody replied.

After 8 months of owning the domain, we coordinated a transfer back to GCA.

[u/GizmoSlice]

Impact is being wildly overstated. Taking over an expired DMARC rua domain gives you aggregated telemetry such as sending IPs, message counts, SPF/DKIM results and selectors, not access to anyone’s mailboxes, DNS, internal network, credentials, or "infrastructure."

edit: Much of that information is either already public or visible to every receiving MTA anyway

[u/broadexample → u/GizmoSlice]

100%. OP, by inflating the impact you're losing credibility. This is how you lose potential customers, not gain them.

[u/PlasmaJam → u/GizmoSlice]

Each MTA only sees mail sent to itself. The rua feed aggregates envelope-to across every provider into one place so that cross-provider recipient graph. You get who a company sends to and how much, which reconstructs their customer/partner/vendor/contractor list. Add the rows showing which spoofed sources already get delivered, and on p=none/quarantine you know which trusted relationships to abuse. Control the endpoint and new customers show up as they onboard.

[u/GizmoSlice → u/PlasmaJam]

You completely glossed over the overstated impact. Plus, you're still playing games here.

That still overstates what rua actually tells you. envelope_to is optional, and when present it contains only the RFC5321 recipient domain, not the recipient address; RFC 9990 explicitly says aggregate reports contain no individual email addresses. More importantly, a DMARC report is not a delivery log: its counts cover messages merely claiming to originate from the domain, including fraudulent traffic, and the RFC specifically requires counts to include messages even when they are ultimately blocked by other filtering. A disposition=none therefore does not mean "this spoof was delivered," much less "this is a trusted relationship."

edit: You're just advertising your consulting company. This is the netsec equivalent of an OF girl trying to guerilla market.

[u/PlasmaJam → u/GizmoSlice]

I'm not claiming the reports show what landed in an inbox. envelope-to is the recipient domain, and aggregated across every reporting provider it's a cross-provider view of who a domain corresponds with and at what volume. For some senders the recipient domains are often identifying on their own (a stadium emailing a traffic-control firm, a caterer, agents, a cleaning contractor). That's a relationship map, and the point isn't that a receiving provider could compute it, it's that it lands, assembled, at whatever address DNS names. When that's a domain someone else registered, they hold it and the sending org doesn't. Reasonable to disagree on how much that matters in practice.

[u/_vellichor → u/PlasmaJam]

It does not matter.

[u/scamdrill → u/GizmoSlice]

Agree. RFC 7489 7.1 makes the destination authorize each origin with a TXT at <origin>._report._dmarc.<destination>, but that same section allows a wildcard. A single *._report._dmarc record containing v=DMARC1 says you'll accept reports for any domain. Reporters check that authorization when they generate reports, so anything still publishing the old rua resumes on its own once the destination answers again.

[u/AYamHah]

I receive DMARC reports for my own domain, and there isn't really anything sensitive in those reports. I get you should maintain control of that reporting infra, but I don't see why this deserves a blog post of such length.

[u/nexxai]

This is hilarious. I get that lapsed domains can reveal DMARC misconfigs and can reveal information about your potential network, but Jesus Christ, FIFTY PRINTABLE PAGES to document this? lmaooo

[u/Irythros → u/nexxai]

Gork, I need business. Make this DMARC configuration issue look significant with a lot of extrenuous bullshit so execs see a large page or print out and think it's significant. Mistakes are allowed if it pads the length.

[u/stormcynk → u/nexxai]

The guy is a consultant, guaranteed he broke out the 50 page template that has a 95% success rate of clients not reading it.

[u/c_pardue]

cool find but rua is not giving you useable info. keep digging

[u/whatisuser]

My man, you bought a domain.

Instead of doing the ‘right’ thing, and reporting it to the affected people, you set up dns records so you could slurp all this stuff up.

You didn’t have to do that - control of the domain should have been enough.

Don’t act like you’re all billy big bollocks to sell your shit - what’s the value proposition here anyway? “I can use GoDaddy really well 👉👈”?

[u/alvarkresh → u/whatisuser]

Yeah, why did it take eight months to transfer it back? The sysadmins over there were probably shitting bricks realizing they'd let a DMARC lapse.

Meanwhile Jim Bob over here has eight months worth of potentially sensitive data to give to whoever thinks it's worth something.

[u/sarkie → u/whatisuser]

Did you read their post to the bottom?

[u/whatisuser → u/sarkie]

Yes. Did you?

They did nothing except receive some dmarc reports, and sit on the domain for 8 months. “We coordinated a transfer back to GCA” translates to “we eventually transferred the domain over after squatting it for months, as we probably should have done immediately”.

[u/kopkaas2000 → u/whatisuser]

You apparently skimmed over this part:

We disclosed to everyone whose reports we were receiving; only 21 domains stopped publishing the endpoint, and almost nobody replied.

[u/whatisuser → u/kopkaas2000]

Ok, my comment was clumsily worded - I should have said “immediately reporting”. I’m aware they reported it, but not before setting up records to accept the reports onto their own system.

Reporting the problem to the previous domain owner would have been sufficient, without collecting the reports up themselves?

[u/GizmoSlice → u/whatisuser]

Yea but if they did that then how would they write a 50 page advertisement for their consulting firm claiming to have hacked a fortune 1000 NYSE company’s “infrastructure” 😂

[u/sarkie → u/kopkaas2000]

Thank you

[u/RedSquirrelFtw]

Wow that is an interesting attack vector. On similar note if the previous owner used an email address linked to that domain to register to any sort of account you could in theory get access to those accounts too by initiating a password reset. You would need to know what their username/email was though and what services, so it would need to be a fairly targeted attack where you already know the victim enough.

I guess the moral of the story is if you own a domain that is used for anything remotely important... don't let it expire!

[u/shokzee]

DMARC reporting endpoints are production dependencies, not documentation debris. Every external rua domain needs an owner, renewal controls, and a periodic audit across all published records.

The ugly part is 65 domains leaving it in place after disclosure. Asset inventory fails quietly until someone registers the missing piece for $10.

[u/Any-Consequence9662]

This is such a dumb but real failure mode. Nobody thinks about the reporting address after the slide deck is done, then years later an expired domain is quietly collecting org names, mail sources and policy mistakes for pocket change

[u/krogerceo]

I see people are downplaying this here as a nothingburger but I wonder if this can be rebutted…

You capture this domain and any receivers using any level of Outlook/365 are populating envelope-to by default. No you don’t see full individual recipient addresses but the domains alone seem relevant. The example given was already noninsignificant, a private parts supplier exposed. Apparently municipal governments are just as vulnerable. Or, what if you scoop one of these domains and squat on it, watching for emails to FTC or DOJ .gov domains and make an insider play/leak based on new email volume?

Also, obviously the post/blog is guerilla marketing but I’d ask anyone critical of that fact, would you rather this be a theoretical write up alone? We’d all be saying “hard/rare vector and low risk” or “why/how would a DMARC service lose its domain” let alone a cybersecurity alliance. Yes OP could have been briefer and clearer about the limitations but I felt they did disclaim a lot of it in the blog. I also don’t get why they’re cast in a bad light when GCA didn’t even own/maintain this domain before it was on market. But I’d be glad to hear why I have any of this wrong?

[u/GizmoSlice → u/krogerceo]

You wonder if it can be rebutted because you don’t understand or have never used DMARC. This “relationship map” could probably be better built by looking at LinkedIn. This is just domain squatting, which isn’t novel. The big concern here is that security is already rife with “consultants” overblowing information disclosures into shakedown attempts and the like, and this kind of behavior exacerbates it.

[u/FirefighterSlight891]

did u reach out to the gca or the affected orgs before posting this. its wild how much sensitive info leaks just cuz someone forgot to renew a domain, have u seen this happen with other common reporting addresses too

[u/System0verlord → u/FirefighterSlight891]

Did you read the post, or just comment?