Eden Park’s DMARC Reports Went to an Expired Domain, Revealing About 600 Business Counterparties
Summary
SH Consulting says Eden Park’s DMARC reports went to an expired domain it registered, providing access to aggregate reports and a map of roughly 600 counterparties. Eden Park removed the reference and asked for the reports to be deleted.
Key points
- Eden Park’s DMARC record directed aggregate and forensic reports to spamcontrol[.]co[.]nz, an expired domain later registered by SH Consulting.
- SH Consulting says it received about a year of aggregate reports; a 30-day window contained 12,615 report records. It received no forensic reports.
- Some reports included recipient-side envelope data, which the consultants used to identify roughly 600 organizations exchanging email with Eden Park.
- The DMARC policy used p=none and sp=none, which do not instruct receiving systems to quarantine or reject messages that fail DMARC.
- Eden Park removed the expired-domain reference after the consultants’ August 20, 2026 LinkedIn post, and later asked them to delete the reports; SH Consulting says it did so on August 26.
- The article recommends checking that DMARC rua and ruf destinations are registered, controlled by the organization or a current vendor, and have working mailboxes.
Article Details
- Attack Vectors
- An expired domain in Eden Park's DMARC reporting addresses allowed whoever registered it to receive aggregate email-authentication reports. SH Consulting registered spamcontrol.co.nz and received reports intended for Eden Park.
- Eden Park's DMARC policy used p=none and sp=none, so it did not instruct receivers to quarantine or reject messages that failed DMARC. The article describes spoofing as a risk, not as a confirmed attack.
- Defensive Notes
- Check every domain in DMARC rua= and ruf= addresses to confirm it remains registered, is owned by the organization or a current vendor, and has a working mailbox.
- Review DMARC policy settings: p=none does not instruct receivers to enforce quarantine or rejection for failing messages.
- Review dormant domains and update or remove DNS references to reporting destinations when vendors or services are retired.
People
Vendors
Tools
digThe record, queried with dig, as it stood on August 20, 2026. Both reporting addresses pointed at the expired domain.p=none and sp=none indicate there is no DMARC enforcement. A message can fail DMARC as @edenpark.co.nzWayback Machineshow quarantine, smtp and smtp2 subdomains, which suggests a hosted email filtering service. The Wayback Machine has nine snapshots of a live site starting May 22, 2010 and ending August 10, 2018.