One DNS typo authorizes 32,066 IPs to send as a .gov domain
A single missing letter in the name of one of the most reliable and trusted domains on the internet, the one belonging to Amazon SES, leaves a Michigan county’s SPF record authorizing tens of thousands of IP addresses to send email on its behalf. This means that anyone with access to those IPs can send email as the county government, bypass security controls, and target the county’s residents.
This Michigan county isn’t the only one exposed by misconfigured DNS records. When we scanned 25,964 government-related domains, we found 43 whose DNS records still reference expired, mistyped, and repurposed domains, leaving them at risk of abuse, and some of them are already being abused. These external dependencies authorize third-party senders, route incoming mail, provide DNS delegation, and receive security telemetry. The government domains themselves can remain registered and be considered protected, because there are no signs to suggest anything is wrong. To keep them out of the wrong hands, we defensively registered 17 of these dependencies and reported our findings to CISA and MS-ISAC.
SPF is a published list of IP addresses and domains that are allowed to send email for a domain. Those addresses and domains are typically the platforms organizations use in their day-to-day operations, such as M365, Salesforce, Amazon SES, and others. An “include” mechanism delegates the decision about which IP addresses should be allowed to a trusted third party. It points to that party’s domain name, which is where the IP addresses it uses to send email are listed. If that external domain expires and changes hands, its new owner can authorize a different set of senders and let them send seemingly legitimate emails on behalf of the organization.
Livingston County, the Michigan county mentioned above, publishes an SPF record for milivcounty.gov that includes amzonses.com, a misspelling of Amazon SES’s amazonses.com.
When we checked, the typo domain’s SPF include chain led to eight records containing 760 entries for individual IP addresses or ranges. Together, they authorized at least 32,066 unique IPv4 addresses, giving any of those IP addresses permission to send mail on behalf of Livingston County’s milivcounty.gov email addresses.
We evaluated every identified IP address against the saved DNS responses, and each returned SPF = pass and DMARC = pass, meaning the county’s existing configuration treats it as an authorized source.
Snowshoeing means spreading sending across many IP addresses, burning them until they’re listed by blocklist operators, and then spinning up a new set.
As of November 3, 2026, the include points to ambertrail.fightingfit.uk.com.
Historical DNS records show amzonses.com has hosted rotating SPF infrastructure since 2021, with the include changing every few days since at least March 2026.
Almost all of the IP addresses tied to the typo domain amzonses.com are listed by reputable blocklist operators such as Spamhaus, URIBL, Abusix, and others.
According to Abusix, this is the same group it previously documented taking over dangling CNAMEs on universities, major brands and a Connecticut state government website.
It’s important to understand what this number means: 32,066 is not a count of attackers exploiting the typo in the county’s SPF record. It’s the number of IP addresses that record authorized to send on the organization’s behalf. A single IP can serve hundreds or thousands of senders, so the address count tells us neither how many senders had access nor how many actually exploited it.
From an email deliverability standpoint, two to three million emails per day per IP address is considered a safe sending volume that does not trigger throttling, deferrals, or rate limiting at major mailbox providers like Gmail, Microsoft, and Yahoo.
A DMARC policy, which is designed to filter out or block unauthenticated email when enforced, doesn’t raise any flags against these blasts, because it only requires one of two authentication protocols — SPF or DKIM — to pass for a message to be considered legitimate. With tens of thousands of IP addresses whitelisted in the county’s SPF record, the receiver sees an authorized sender whose emails it should trust and delivers them straight to the inbox.
And while the county controls its own SPF record in its DNS zone, whoever operates the misspelled dependency controls exactly who can send mail on the county’s behalf. Updating that authorized list can be done remotely and completely independently of the government organization, making this abuse vector even more straightforward than email account compromise, which still requires delivering a phishing email, hijacking login credentials, bypassing MFA, and acting fast before getting caught.
In another example, we found that the SPF record for Pikeville’s pikevilleky.gov includes amasonses.com, which is explicitly named in Red Sift’s analysis following Guardio’s SubdoMailing investigation. Our research identified 75 IP addresses that are authorized to send mail as the City of Pikeville. Registry records show the domain was most recently registered in April 2026, after the abuse was publicized. We have not determined whether the same operator is still behind it or whether it’s still impersonating the City of Pikeville. However, given that many IP addresses in its SPF are listed by blocklist operators, along with the fact that pikevilleky.gov itself is listed on URIBL, it’s reasonable to assume the domain is still being used for abuse.
Amid an extortion scam, Arizona disowns a domain two state boards still trust
For many years, the state agency that licenses and disciplines medical doctors in Arizona was named the Arizona Board of Medical Examiners, and it used the domain bomex.org. In 2002, the board changed its name to the Arizona Medical Board (AMB), and it now operates under azmd.gov. On July 9, 2026, as part of an extortion scam advisory, the Arizona Medical Association published a warning stating that the AMB is no longer affiliated with bomex.org and that the website now hosted on it is not authorized by the board.
However, both azdo.gov and azpa.gov still have a:mail1.bomex.org authorized in their SPF records. Although mail1.bomex.org currently sits behind the Cloudflare proxy and only resolves to Cloudflare anycast addresses, which can’t be used to send email, whoever controls the domain could, in a matter of minutes, turn off the proxy, point it to their own server, and begin sending scam messages as azdo.gov and azpa.gov addresses, with these messages passing both SPF and DMARC checks.
Meanwhile, the Town of Gates in New York operates under townofgatesny.gov, and its SPF record mistakenly authorizes dispatch-us-ppe-hosted.com instead of Proofpoint’s dispatch-us.ppe-hosted.com. A single hyphen in place of a period turned a Proofpoint subdomain into a completely separate domain. The misspelled domain is currently listed for sale; anyone can buy it for just $350 and start sending millions of fraudulent messages from townofgatesny.gov that pass SPF, because the town’s own record gives that domain permission to send mail on its behalf.
We found more SPF dependencies with the same problem:
Government domains delegated to strangers and typos
To activate a domain after registration, you need to set its NS (nameserver) records. Your registrar usually assigns default nameservers, but many owners change them to manage their whole domain portfolio in one place. The nameservers your domain’s NS records point to are where you add the other DNS records your email, website, and applications need to work.
If the domain hosting those nameservers expires or contains a typo, anyone can register it, at which point they can effectively control your domain. Your organization can then lose control of its email, websites, applications, and everything else connected to it.
Oldham County, Kentucky, and Newburgh, Indiana, historically used oldhamcounty.net and newburgh.org, respectively. Both domains are still listed on local government websites, even though the municipalities no longer own them. When we began our investigation, their NS records pointed to nameservers on hastydns.com and koaladns.com. Since then, oldhamcounty.net has switched nameservers several times, including a one-week stretch during which they pointed to magpiedns.com and brainydns.com. As of November 3, 2026, oldhamcounty.net points to koaladns.com, and newburgh.org still points to hastydns.com. All of these NS domains appear in Infoblox’s research on parking and abuse infrastructure, where they’re tied to a single portfolio operator that rotates nameservers to avoid detection and sells visitor traffic to malicious advertisers.
Infoblox DNS data shows oldhamcounty.net has been queried about 15,000 times from 250 different IP addresses over the past six years, and newburgh.org about 250 times from 40, so people are still visiting both former government domains.
heyburnidaho.org was once the official domain of the City of Heyburn, Idaho. It’s still listed as the city’s website by the City of Rupert and on the Heyburn Police Department’s Facebook page, but it now serves a casino login, registration, and deposit page. That’s because the city no longer owns the domain, and its NS records currently point to nameservers on coremalware.com, a domain controlled by attackers. These attackers have also set it up to send and receive email as @heyburnidaho.org, so they can impersonate the city and collect mail still sent to its old addresses, putting local residents at risk.
Infoblox has seen about 1,100 domains using coremalware.com nameservers since July 2025, a pattern consistent with an operator that grabs domains as soon as they expire.
In another example, one of the two NS records for vacstclairil.gov, the domain of the Veterans Assistance Commission of St. Clair County, Illinois, points to ns41.domancontrol.com, a typo of GoDaddy’s ns41.domaincontrol.com that is missing an “i”. That typo domain was first registered by an unknown party on December 8, 2002, re-registered on August 27, 2026, and its nameserver now resolves to an AWS server. The correctly spelled GoDaddy nameserver is not serving the domain. If whoever controls the typo nameserver configured it to serve vacstclairil.gov, it could become the only listed nameserver providing usable answers, effectively giving that operator control over the domain’s DNS responses. Infoblox has documented the same pattern with domaincntrol.com, another misspelling of that GoDaddy NS. No abuse has been confirmed yet, but a recently re-registered typo domain that leaves a potential attacker one step away from controlling a government domain’s DNS is something that shouldn’t be ignored.
According to Infoblox DNS data, 87 domains have delegated to domancontrol.com nameservers over the years, and one other still does today.
Finally, the City of Wells, Minnesota (cityofwellsmn.gov) has a similar typo in one of its five NS records, listing ns1.becomm.net instead of bevcomm.net. This domain is parked, and we found no evidence of abuse. However, Infoblox records show the typo nameserver has been actively queried for the city’s domain since February 19, 2026, with about 15,000 NS records containing the typo.
One step away from intercepting government email
An SPF record is a sender’s policy that lists the IP addresses that are allowed to send email on behalf of your domain. An MX record works in the other direction: It tells other mail servers where exactly incoming email for the domain should be delivered. For many organizations, that’s Microsoft 365 or Google Workspace, but anyone can spin up their own mail server and accept email there, though this can lead to certain vulnerabilities.
We analyzed 25,964 government domains and found that around 27% point to their own self-hosted mail servers to process inbound mail.
We often see that admins setting up mail servers have manually typed in the hostnames their MX records point to, which can easily lead to typos. This means anyone can register the typo domain and start collecting mail addressed to the organization.
An organization can’t always catch this type of error, because many providers have multiple MX records, each hosted on a different server. If something happens with one MX record, nothing visibly breaks, since there’s a backup available to receive the mail.
There’s no mechanism in place to stop other servers from delivering mail to a typo domain, or to flag these invalid records and prevent interception. Only regular infrastructure audits can catch them.
During our research, we weren’t able to confirm that any of these domains is actively intercepting mail to read the organizations’ communication. However, we do see that some of them are already set up to accept and process incoming mail.
Here are the MX dependencies we found, including the ones we registered defensively:
Government security telemetry reaching expired reporting endpoints
DMARC is an email policy that tells receiving mail servers what to do with emails that fail domain authentication, and where to send relevant reports.
Many people don’t even consider the registration of an expired DMARC reporting domain to be a security incident at all, because it doesn’t give an attacker access to systems or let them manipulate the domain or its emails.
But it does give an attacker a map of a domain’s email infrastructure. Most mailbox providers send DMARC reports as XML files that describe what happened, on their end, to the emails they received from the domain. Most of that information is granular and even dull: the IP address that sent the email, the email count per IP, the authentication results, and the policy applied. Some providers, like Microsoft, also show the recipient’s domain name.
However, if attackers start collecting these reports and processing them, they can build a full picture of your domain’s email patterns and security posture: which organizations you send mail to and on which days, how often you communicate with each organization, how many messages you send, and the platforms you use to send messages. That could even lead to targeted phishing campaigns against your recipients that pose as coming from your organization, or spear phishing campaigns aimed at the platforms and systems you use.
We collected about a week of these reports for one county government while we temporarily held an abandoned reporting endpoint of a cybersecurity vendor before transferring it back to them. Here’s what they looked like:
During this research, we found eight reporting endpoints that weren’t registered and were therefore at risk of being picked up by attackers. Those domains were set to receive reports for 11 government institutions. Anyone registering one of them would only need a mail server and a couple of DNS records to start receiving the reports. A single endpoint could have revealed infrastructure intelligence for the Jennings County Sheriff’s Office, the Jennings County Probation Department, the Jennings County Government, and the Jennings County Prosecutor’s Office.
Below is the list of government domains, along with the reporting endpoints we defensively registered:
We also found several reporting domains that had already been registered by someone else by the time we were conducting our research. For example, the City of Greenbelt, Maryland, whose official domain is greenbeltmd.gov, has greenbeltmd.com listed as its DMARC reporting endpoint; that domain is currently listed for sale for $3,899.
Other reporting endpoints outside the organizations’ control:
Nearly half of government domains in the US can’t tell when they’re being spoofed
Our in-house assessment platform analyzed 25,964 unique government-related domains compiled from public sources: 16,984 ending in .gov and 8,980 on other TLDs. We scanned them twice, in June and October 2026, using historical DNS data to track how the records changed over time.
Based on our findings, we defensively registered 17 domains, which we currently hold: three SPF dependencies, six MX domains, and eight DMARC reporting domains. We reported our DMARC findings to CISA in June and additional findings to CISA and MS-ISAC in October, and we’ve already seen changes made to a few domains, which we left out of this investigation.
Today, 43 government domains still reference domains outside their control, and some of them are already being actively abused by attackers.
Altogether, our investigation reveals what domain spoofing protection looks like across government domains today. Almost 15 years after becoming a cybersecurity standard, more than 12,000 domain names for governmental entities in the United States remain completely unprotected from, and completely blind to, spoofing and impersonation over email.
Domains operated by governments in the US are high-value targets, because people tend to trust them as organizations controlled by the government. .gov domains in particular come with strict eligibility requirements: only verified government organizations in the United States can register one.
However, in today’s world of fast-evolving technology, the public sector is often running 10 to 15 years behind cybersecurity standards; moreover, few people are available to help, because those who best understand the subject are kept busy putting out fires from new attack vectors delivered by AI.
CISA is trying to keep pace and does offer tools for vulnerability assessment. Back in 2017, it even required every federal executive branch agency to move its domains to p=reject within a year. But that mandate never covered state and local governments, where nearly all of our findings sit, and some cities or counties don’t even have a team responsible for security.
DNS vulnerabilities have been around for decades, and by now, they should have been sorted out long ago. Instead of adopting the modern technologies of their time when they had the chance, many US government organizations waited for better times without putting security guardrails in place, and now those decades-old gaps are being exploited by the same technologies they missed.
Research by SH Consulting. Prior research on related campaigns and infrastructure by Guardio, Red Sift, Infoblox, and Abusix.
