A researcher says AccessPay’s DMARC reports went to an exposed reporting domain. They registered accessspay[.]com but enabled no mailboxes. AccessPay later removed the endpoint from its DMARC policy, which the researcher says leaves it without those reports.
Scammers may re-register expired domains to receive email and password-reset links for accounts tied to them. The article recommends renewing domains and closing unused accounts, and describes risks from dormant domains.
An exposed SendGrid API key was abused to send 2.3 million emails, driving a reported 500× bill spike and harming deliverability. The article also describes phishing through a compromised Purdue SendGrid account and recommends key controls and monitoring.
A practical guide recommends authenticating every legitimate sender, reviewing DMARC reports, and gradually moving through quarantine before p=reject. It also covers enforcement limits, forwarding issues, and related DNS protections.
SH Consulting reports that Exchange Online may deliver spoofed mail despite DMARC p=reject when messages arrive through trusted third-party gateways, exposing an oreject/compauth=none reason=451 pattern. It recommends inbound connector lockdown; RejectDirectSend covers只
A practical guide recommends authenticating every legitimate sender, monitoring DMARC reports, and gradually moving through quarantine to reject. It warns about misconfiguration, forwarded mail, and receivers that may not honor the policy.
A reported campaign routed links in emails impersonating encrypted Mimecast messages through Riddle Technologies infrastructure and a CAPTCHA to a fake Gmail login page. Forensic analysis indicated the spoofed domain had been active for at least 26 days.
The article says GoDaddy automatically adds DMARC records to domains, sending aggregate reports to a GoDaddy address and potentially quarantining legitimate mail. It advises owners to check the record, configure SPF or DKIM, and choose their policy.
An exposed SendGrid API key was abused to send 2.3 million emails, driving a company’s Twilio bill above 500× its usual level. The article also describes phishing sent through a compromised Purdue SendGrid account and recommends limiting, scoping, and rotating keys and,
The guide recommends auditing and authenticating legitimate senders, reviewing DMARC reports, and gradually moving from p=none through quarantine to p=reject. It also notes that forwarding can fail and some receivers may not honor reject policies.
A practical DMARC enforcement guide recommends authenticating every legitimate sender, reviewing aggregate reports, testing quarantine with a gradual rollout, and then moving to p=reject while accounting for forwarding and receiver limitations.
A security consultant says DMARC reports showed suspicious Google Calendar invites routed to Yahoo users, including 561 in one day. The affected company confirmed the invites were illegitimate; the post provides no technical evidence for the suspected exploit.
An email-security consultant describes uneven spoofing volumes and a case where an SPF record included look-alike sengrid[.]net, bringing in suspicious IPs and exceeding the 10-DNS-lookup limit. Malicious use is a concern, not established.
DMARC data for yyk[.]com, a short domain resembling YKK, showed more than 900 spoofed emails in under a month. The account also received bounce notifications containing some rejected messages; a separate SPF audit found a typo authorizing unrelated servers.
The article explains how DKIM, SPF and DMARC support email authentication, notes bypass tactics such as replay and SubdoMailing, and recommends rotating DKIM keys, monitoring SPF and enforcing a strict DMARC policy.
The article explains how root-domain SPF includes for shared ESP IP pools can let spoofed mail pass SPF and DMARC despite p=reject. It recommends auditing includes and moving ESP authentication to dedicated sending subdomains.
The article explains how Cloudflare may accept conflicting DMARC CNAME and TXT records written during ESP onboarding, causing receivers to ignore the policy, and offers steps to detect, fix, and monitor the issue.
A misaligned IPv4 CIDR in an SPF record can produce inconsistent receiver results and cause legitimate mail to fail under DMARC p=reject. The article recommends checking network boundaries, lookup limits, mechanisms, aggregate reports and test sends.
SH Consulting reports that Microsoft 365 may deliver messages despite DMARC p=reject when mail arrives through trusted third-party gateways, and recommends restricting inbound connectors; RejectDirectSend blocks only the Direct Send path.
RFC 9989 replaces prior DMARC specifications without breaking existing records. It adds the np tag for nonexistent subdomains, replaces PSL-based discovery with a DNS tree walk, and replaces pct with test-mode t; the article recommends record updates.
The article recommends four DNS records to reduce email spoofing from parked domains: null MX, SPF with no permitted senders, DMARC p=reject, and wildcard DKIM revocation. It also covers portfolio inventory, deployment, and optional controls.
The article describes how attackers can replay a DKIM-signed email from a hijacked account, causing tracking events to spike. It recommends alerting on single-message open rates above 1,000% and investigating account activity.
An email-security researcher says an expired DMARC reporting domain he registered received reports from 86 domains for eight months, exposing recipient, sending-infrastructure and routing data; 65 still pointed to it at his latest check.
An investigation found 86 domains across 20+ organizations had directed DMARC reports to an abandoned endpoint. After registering it, SH Consulting received reports until July 2026; some included recipient-domain data that can reveal business relationships.
