Expired DMARC Endpoint Sent Email Telemetry From 86 Organizations to Researcher
Summary
An email-security researcher says an expired DMARC reporting domain he registered received reports from 86 domains for eight months, exposing recipient, sending-infrastructure and routing data; 65 still pointed to it at his latest check.
Key points
- The researcher says he registered the expired gca-emailauth[.]org in November 2025 and began receiving DMARC aggregate reports from 86 domains across more than 20 organizations.
- The reports included sending IPs and authentication results; some also populated envelope_to with recipient domains, potentially exposing customer relationships, mail infrastructure and routing.
- The researcher says 56 affected domains belonged to The Toro Company and that 65 of the 86 domains still listed the endpoint in DNS at his latest verification.
- The article says myturf[.]com, a high-volume Toro platform, had a DMARC policy of p=none and included the expired endpoint as a reporting destination.
- For Great Prairie AEA, the researcher reports 2,563 messages failing SPF and DKIM across 122 sending hostnames and 1,422 source IPs; he interprets some streams as possible impersonation.
- The researcher says he notified affected organizations, handed the domain back to the Global Cyber Alliance, and recommends checking every rua destination and confirming its domain is still controlled.
Article Details
- Attack Vectors
- Organizations continued sending DMARC aggregate reports to a reporting domain after its registration expired and the researcher registered it, redirecting the reports to a mailbox they controlled.
- A secondary, stale DMARC reporting destination went unnoticed because reports were also arriving at a working processor.
- The reports exposed recipient relationships, sending infrastructure, and mail-routing information that could support targeted spearphishing.
- Defensive Notes
- Review every address in each DMARC rua record, including secondary destinations; verify who controls each destination domain and when that ownership was last checked.
- Update reporting records to point only to destinations the organization controls or has verified, and recheck that owned domains point to the intended destinations.
- Preserve DMARC reporting visibility when remediating a stale destination by replacing it with a controlled mailbox rather than simply deleting the reporting address.
- Review DMARC enforcement details, including pct, rather than relying on p=reject alone; the article reports that Great Prairie AEA's pct=10 limited enforcement to about one in ten failing messages.
People
Alex ShakhovConducted the research by registering the expired gca-emailauth.org domain, documenting the DMARC reports received, and notifying affected organizations.Robert ThomasHead of engineering at the Global Cyber Alliance; helped trace the reporting domain's history and shared the findings with permission.
Products
Countries
Kazakhstanfive independent providers. The heaviest failing streams resolved to national telecom networks across Kazakhstan, Kyrgyzstan and Uzbekistan, places an Iowa education agency has no conceivable business with. Not allKyrgyzstanproviders. The heaviest failing streams resolved to national telecom networks across Kazakhstan, Kyrgyzstan and Uzbekistan, places an Iowa education agency has no conceivable business with. Not all of that mailUnited StatesWe scanned 25,964 US government domains and found 43 whose SPF, MX, NS or DMARC records still point to expired, mistyped or repurposed domains. One typo lets 32,066 IP addresses send email as a Michigan county.UzbekistanThe heaviest failing streams resolved to national telecom networks across Kazakhstan, Kyrgyzstan and Uzbekistan, places an Iowa education agency has no conceivable business with. Not all of that mail is hostile.
Industries
Educationmanufacturer, a state university, two county governments, a Texas school district, and an Iowa education agency serving 35,000 students — arrived in a mailbox I set up in an afternoon. Sixty-five of thoseGovernmentbelonged to a single Fortune 1000 manufacturer, another 14 to a US university, and the rest to a mix of government and commercial domains.