Lapsed DMARC Domain Sent Reports From 86 Domains Across 20+ Organizations to a New Registrant
Summary
An investigation found 86 domains across 20+ organizations had directed DMARC reports to an abandoned endpoint. After registering it, SH Consulting received reports until July 2026; some included recipient-domain data that can reveal business relationships.
Key points
- The investigation found 86 domains pointing to gca-emailauth[.]org; Global Cyber Alliance training materials had recommended the reporting endpoint.
- SH Consulting registered the lapsed domain in November 2025 and received reports until removing its mail and authorization records on July 30, 2026; the domain was then transferred to Global Cyber Alliance.
- Reports included source IPs, authentication results and sender information. Some also contained recipient domains in the optional envelope_to field, potentially revealing business relationships; reports did not contain message bodies or subject lines.
- As of an August 5, 2026 verification sweep, 65 domains still published the endpoint. Fifty-six affected domains belonged to The Toro Company, 54 of them using a shared DMARC record.
- Reports for Great Prairie AEA showed 2,563 messages failing both SPF and DKIM across 122 hostnames and 1,422 source IPs. The article cautions that failing mail was not all malicious.
- The article retracts an earlier interpretation of the largest Toro failure stream as phishing: evidence instead pointed to mail from a misconfigured WordPress-hosted marketing microsite.
- The recommended response is to audit every DMARC rua destination and any CNAME delegation, and redirect reports to an address under the organization’s control rather than simply removing reporting.
Article Details
- Attack Vectors
- An expired DMARC reporting domain can be registered by a new party, which can receive aggregate reports still directed to it by other organizations' DNS records.
- Wildcard external destination verification can allow an attacker to direct large volumes of authenticated DMARC reports to a mailbox.
- Reports showed suspected spoofing of affected domains, including randomized subdomains and defensively registered lookalike domains. The article cautions that not all authentication failures were malicious.
- Defensive Notes
- Review every address in each DMARC rua tag and verify who controls its destination domain.
- Follow CNAME delegations and separately check domains that publish their own records.
- Redirect reporting to a controlled mailbox rather than removing rua and losing monitoring visibility.
- Review shared and parked-domain policies, including those governing production systems, and periodically recheck destination ownership and registration.
- Avoid wildcard external destination verification on a main domain; use specific controlled hostnames.
- Use reserved domains in configuration examples, or maintain real example endpoints as production dependencies.
People
Countries
Industries
Educationroughly $4.5 billion in revenue, a public university, a public residential STEM high school, a regional education agency serving 35,000 children, a public school district, a county developmental disabilities board, aFinancial Services35,000 children, a public school district, a county developmental disabilities board, a Saudi financial services firm, and two United States county governments.Governmentvolume-weighted account sizes, a named customer list spanning multiple countries, and municipal and government recipients. Unlike a leaked credential, this cannot be rotated. Once the correspondent map is out, it