Dangling and Mistyped DNS Records Expose 43 US Government Domains to Email Spoofing and Hijack
Baseado só no resumo do feed. O site da fonte não liberou o texto completo para o Tifon, então esta análise saiu apenas do resumo publicado no feed e pode estar incompleta. Ela é atualizada quando outra fonte cobrir o assunto. Ler na fonte original ↗
Security researcher Alex Shakhov of SH Consulting scanned 25,964 US government-related domains and found 43 whose SPF, MX, NS, or DMARC records still reference expired, mistyped, or repurposed third-party domains, exposing them to impersonation, mail interception, and infrastructure spying. These "dangling" DNS dependencies let outside parties who register the lapsed or typo domain decide who may send email as the government entity, where its incoming mail is routed, who controls its DNS resolution, or who receives its security telemetry, all without ever breaching the organization's own systems. Several of the flaws are already being actively exploited, including a Michigan county's SPF record that, due to a single missing letter in Amazon SES's domain, currently authorizes more than 32,000 IP addresses to send mail on its behalf, and the City of Pikeville, Kentucky, whose similarly mistyped SPF dependency is tied to a known subdomain-hijacking operation and has landed the city's domain on the URIBL blocklist. The researcher defensively registered 17 of the vulnerable dependencies and reported the findings to CISA and MS-ISAC.
Entenda a falha
A vulnerabilidade
This is a class of DNS misconfiguration, with no CVE and no affected software version. In 43 of 25,964 US government-related domains, SPF, MX, NS or DMARC records point to third-party domains that expired, were mistyped or were repurposed. Whoever registers that domain gets a say over who may send mail as the government entity (SPF), where its incoming mail goes (MX), who answers its DNS (NS) and who receives its DMARC reports. The attacker needs no access to the victim's systems. They only need to register the lapsed or typo domain. Examples: Livingston County, Michigan (amzonses.com) and Pikeville, Kentucky (amasonses.com), both misspelling Amazon SES. No patch exists; the fix is correcting the records.
Como funciona
A domain owner publishes DNS records that delegate trust to other domains. An SPF include tells receiving mail servers which senders are authorized, MX names the hosts that accept incoming mail, NS names the servers that answer for the zone, and a DMARC reporting address says where aggregate reports are sent. When a receiver or sender looks up one of these records, it follows the reference to the third-party domain and trusts whatever that domain returns. If the domain lapsed or was mistyped and someone else now controls it, the answer comes from them. In the Livingston case the include chain authorized 32,066 IPv4 addresses, and the include target rotated every 3 to 8 days.
Por que é vulnerável
The root cause is unvalidated, unmonitored trust in external names. Records are entered by hand or left in place after a vendor relationship ends, and nothing flags a typo or an expired dependency, so the error goes unnoticed until someone registers the name. The researcher notes there is no mechanism to flag such invalid records. Weak anti-spoofing policy makes it worse: 12,252 domains had no DMARC policy and only 4,124 enforced p=reject, and state and local governments are not bound by the 2017 CISA mandate for federal agencies. Roughly 27% self-host inbound mail, which raises the risk of typos in manually entered MX hostnames. The fix is auditing and correcting the records.
Como foi descoberta
Security researcher Alex Shakhov of SH Consulting scanned 25,964 US government-related domains and found 43 with dangling or mistyped dependencies. He registered 17 of the vulnerable dependencies defensively. He reported the findings to CISA in June and again, with MS-ISAC, in October 2026, and some flagged domains have changed since. Abusix's Steve Freegard said the same group has also hijacked dangling CNAMEs at universities, major brands and a Connecticut state government site. Some cases are already abused: Pikeville's domain is listed on URIBL.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 20:19.
Detalhes técnicos
These two government bodies seem to have authorized Amazon's Simple Email Service (SES) for its day-to-day email needs and, as such, their TXT records specify it as a trusted third-party provider. The domains they list, however, contain typos: "amzonses[.]com" and "amasonses[.]com." As a result, Pikeville's official government domain is now listed on the URI blacklist website "URIBL," and Shakhov assessed that "it's reasonable to assume the domain is still being used for abuse."
The flagship case is Livingston County, Michigan (milivcounty.gov), whose SPF record includes amzonses.com, a misspelling of Amazon SES's amazonses.com (sh.consulting). Its SPF include chain authorized at least 32,066 unique IPv4 addresses to send mail on the county's behalf, and the include target rotates every 3 to 8 days, a pattern consistent with a "snowshoe" spam operation; nearly all of the associated IPs are already flagged by blocklist operators such as Spamhaus, URIBL, and Abusix (sh.consulting). Abusix's Steve Freegard said the same group behind this activity has also hijacked dangling CNAMEs at universities, major brands, and a Connecticut state government site (sh.consulting). Beyond SPF, the research also found government domains with misconfigured MX records (allowing mail interception on domains such as gallianet.net and cityoftroymissouri.com), NS records pointing to attacker- or stranger-controlled nameservers (including a former City of Heyburn, Idaho domain now redirecting to an online casino after its nameservers were taken over), and DMARC reporting endpoints left unregistered, which could let an attacker collect aggregate reports revealing an organization's email partners and security posture (sh.consulting). Roughly 27% of the scanned domains self-host inbound mail, increasing typo risk in manually entered MX hostnames, and of the 25,964 domains surveyed, 12,252 had no DMARC policy at all while only 4,124 enforced p=reject (sh.consulting).
Remediação
The researcher recommends regular infrastructure audits of SPF includes, MX, NS, and DMARC reporting records to catch expired or mistyped third-party dependencies before they are repurposed by attackers, since there is otherwise no mechanism to flag such invalid records (sh.consulting). State and local governments are not bound by the 2017 CISA mandate that pushed federal executive-branch agencies to DMARC p=reject, leaving most of the affected organizations without enforced anti-spoofing policy (sh.consulting). The researcher reported the findings to CISA in June and again, with MS-ISAC, in October 2026, and some flagged domains have already changed since (sh.consulting).
Linha do tempo
-
darkreading.com ↗ · pub. 05/11/2026 18:35 · coletado 05/11 20:00 primeiro registro só resumo do feed
Dangling and Mistyped DNS Records Expose 43 US Government Domains to Email Spoofing and Hijack
ler a análise desta fonte ocultar
Security researcher Alex Shakhov of SH Consulting scanned 25,964 US government-related domains and found 43 whose SPF, MX, NS, or DMARC records still reference expired, mistyped, or repurposed third-party domains, exposing them to impersonation, mail interception, and infrastructure spying. These "dangling" DNS dependencies let outside parties who register the lapsed or typo domain decide who may send email as the government entity, where its incoming mail is routed, who controls its DNS resolution, or who receives its security telemetry, all without ever breaching the organization's own systems. Several of the flaws are already being actively exploited, including a Michigan county's SPF record that, due to a single missing letter in Amazon SES's domain, currently authorizes more than 32,000 IP addresses to send mail on its behalf, and the City of Pikeville, Kentucky, whose similarly mistyped SPF dependency is tied to a known subdomain-hijacking operation and has landed the city's domain on the URIBL blocklist. The researcher defensively registered 17 of the vulnerable dependencies and reported the findings to CISA and MS-ISAC.
Technical Details
These two government bodies seem to have authorized Amazon's Simple Email Service (SES) for its day-to-day email needs and, as such, their TXT records specify it as a trusted third-party provider. The domains they list, however, contain typos: "amzonses[.]com" and "amasonses[.]com." As a result, Pikeville's official government domain is now listed on the URI blacklist website "URIBL," and Shakhov assessed that "it's reasonable to assume the domain is still being used for abuse."
The flagship case is Livingston County, Michigan (milivcounty.gov), whose SPF record includes amzonses.com, a misspelling of Amazon SES's amazonses.com (sh.consulting). Its SPF include chain authorized at least 32,066 unique IPv4 addresses to send mail on the county's behalf, and the include target rotates every 3 to 8 days, a pattern consistent with a "snowshoe" spam operation; nearly all of the associated IPs are already flagged by blocklist operators such as Spamhaus, URIBL, and Abusix (sh.consulting). Abusix's Steve Freegard said the same group behind this activity has also hijacked dangling CNAMEs at universities, major brands, and a Connecticut state government site (sh.consulting). Beyond SPF, the research also found government domains with misconfigured MX records (allowing mail interception on domains such as gallianet.net and cityoftroymissouri.com), NS records pointing to attacker- or stranger-controlled nameservers (including a former City of Heyburn, Idaho domain now redirecting to an online casino after its nameservers were taken over), and DMARC reporting endpoints left unregistered, which could let an attacker collect aggregate reports revealing an organization's email partners and security posture (sh.consulting). Roughly 27% of the scanned domains self-host inbound mail, increasing typo risk in manually entered MX hostnames, and of the 25,964 domains surveyed, 12,252 had no DMARC policy at all while only 4,124 enforced p=reject (sh.consulting).
Remediation
The researcher recommends regular infrastructure audits of SPF includes, MX, NS, and DMARC reporting records to catch expired or mistyped third-party dependencies before they are repurposed by attackers, since there is otherwise no mechanism to flag such invalid records (sh.consulting). State and local governments are not bound by the 2017 CISA mandate that pushed federal executive-branch agencies to DMARC p=reject, leaving most of the affected organizations without enforced anti-spoofing policy (sh.consulting). The researcher reported the findings to CISA in June and again, with MS-ISAC, in October 2026, and some flagged domains have already changed since (sh.consulting).