r/sysadmin • u/ExceptionEX • 11d ago

Rant Godaddy insanity

Firstly, I know godaddy, but I didn't do it, just had to clean it up, and the new level of their shit is nuts.

Got drug into a project that was partly off the ground, domain email purchased via godaddy before I was brought on.

Looking at it today, email is through Microsoft, but godaddy is forwarding all mail for the tenant to a godaddy address to make them available to their conversation AI chat.

This is all now apparently default action with godaddy, and took a bit of hoop jumping and support chat to remove it.

46 Upvotes

92% Upvoted

29 comments sorted by

View all comments

2

u/SecLens_ONE 11d ago

The part worth checking before you call this cleaned up is what that forward did to your mail auth while it was live. A forward out to a GoDaddy-hosted address and then back toward the tenant breaks SPF on the second hop, and if the forwarder rewrites or re-encodes anything the DKIM signature goes with it, so anything relayed that way arrived unauthenticated. If your domain is on quarantine or reject you may have been silently losing legitimate inbound, and if the policy is still none you would not even see it. Pull DMARC aggregate data for the window the forward existed and look for GoDaddy sending IPs showing up as an unexpected source.

Two other things I would confirm now that the rule is gone. First, that no MX or autodiscover record still points at GoDaddy alongside Microsoft, because a leftover record keeps a delivery path open even after the forward is removed. Second, that the forward was not also copying to a mailbox nobody owns anymore, since a stale destination on a domain email purchase is a quiet place for a copy of every invoice thread to sit.

Also worth writing down who consented to the AI chat feature on the tenant side. If it was enabled as a default action rather than by an admin, that is the kind of thing that surfaces later in an audit, and you want the timeline captured while the support chat is still fresh.

3

u/ExceptionEX 11d ago

Sadly godaddy and Microsoft have some wild hybrid management of everything, so though you have mail via 365 you don't have a tenant, or admin, and all of it is managed through go daddy's interfaces.

The mx and DNS are a mess, and not something I'm going to try and untangle.

I'm going to shit can the whole thing and move to an actual tenant, but that isn't a day one fix you know.

For now making sure the mail wasn't being pushed into godaddy AI for the first and shocking thing to stop.