Dangling DNS records: US government email domains — typos/expired DNS records let attackers send/receive email and spoof agencies (no CVE)
Severity: medium · Patch status: unpatched · Since 2026-11-05
A study by Alex Shakhov (SH Consulting) of 25,000+ government-related domains found dozens of US towns, cities, counties, and regulatory boards whose DNS records reference mistyped, expired, or repurposed domains. Attackers who register these 'dangling' domains can send/receive email on behalf of agencies, intercept mail, serve spam, or harvest DMARC reports. Livingston County, Mich., and Pikeville, Ky. typo'd 'amzonses[.]com'/'amasonses[.]com' in SPF records, allowing a non-Amazon entity to send mail; Livingston's SPF rotated IPs every 3–8 days since 2021 in a snowshoe spam operation, and Pikeville's domain is now on URIBL. The actor links to prior abuse of Oracle, CNN Money, UC campuses, and Connecticut state government via expired CNAMEs. Fix is auditing and correcting DNS records; no vendor patch applies.
What to do
- Audit all DNS records (SPF, MX, CNAME, NS, DMARC) for typos, expired, or purchasable 'dangling' domains and correct them immediately
- Monitor domain expiry and lock/renew domains referenced in DNS records
- Minimize SPF include lists and verify every third-party service domain character-by-character
- Check DMARC rua/ruf reporting domains are owned and review DMARC reports for anomalies
- Check sending domains against blocklists (e.g., URIBL) and investigate historical mail logs for abuse
- Set registrar transfer locks and alerts on all domains referenced in DNS configurations
Sources
All live incidents on Threat Watch
