DMARC Documentation Example Sends Reports From 22 Organizations to Researcher-Controlled Domain
Summary
A researcher says reports from 22 organizations reached a domain used in Cloudflare and other DMARC guides. Cloudflare corrected its documentation, but copied guides and production DNS records remain unchanged.
Key points
- The author registered third-party-example[.]com after finding it in Cloudflare DMARC documentation as a reporting destination; the author says reports from 22 production organizations have arrived there.
- DMARC aggregate reports can reveal sending IPs, email vendors, traffic volumes and authentication failures; some reports may also expose destination domains.
- The author found the same example in at least eight documentation sources. Cloudflare updated its localized documentation, but third-party copies and deployed DNS records remain.
- The article characterizes the reports as operational metadata, not a legal breach, but says the information could help attackers prepare targeted phishing.
- The article advises checking DMARC TXT records’ rua and ruf destinations. Its example query is `dig +short TXT _dmarc.example[.]com`.
- The article recommends using reserved example domains, such as example[.]com, or the reserved .example TLD in documentation.
Article Details
- Attack Vectors
- Production DMARC records copied from documentation used a reporting address at the registerable domain third-party-example.com without replacing the placeholder, causing aggregate reports to be delivered to the domain's registrant.
- The reports exposed operational email metadata, including sending IP addresses, email-service-provider usage, authentication failures, and spoofing activity.
- Defensive Notes
- Use IANA-reserved domains in documentation examples, such as example.com or the reserved .example TLD, so copied configurations fail closed.
- Check DMARC rua= and ruf= destinations across all organizational domains and confirm each destination is controlled by the organization or an authorized reporting provider.
- Replace unreserved placeholder destinations in production DNS records; documentation corrections do not update configurations already deployed.
- Review copied DMARC examples on third-party documentation sites, since downstream copies may remain unchanged after the original source is corrected.
People
Al IversonThe article reports that he scanned public DMARC configurations for solarmora.com and found it in records for more than three hundred production domains.Alex ShakhovRegistered third-party-example.com after finding it in Cloudflare's DMARC documentation and reported receiving production DMARC aggregate reports there.Terence EdenThe article reports that he noticed a registerable domain in Google's G Suite documentation and bought it.
Vendors
CloudflareI Registered the Domain in Cloudflare's DMARC Documentation. Eight Other Sites Copied It.GoogleA real DMARC aggregate report from Google, delivered to the example address from Cloudflare's documentation. The reporting domain has been redacted.What the Reports RevealMicrosoftmail servers live in, whether they're being actively spoofed, and from which networks at what volume. Microsoft's reports also include envelope destination domains — revealing partner relationships, clients, andYahooThe reports come from Google, Microsoft, Yahoo, and other major receivers — the same providers that send legitimate DMARC reports to legitimate reporting endpoints worldwide. For each affected organization, we now have