Email Security

Why Reusing Passwords Is Dangerous: The JustDropped Example

Alex Shakhov

December 15, 2025

When you create an account on a website, do you REALLY think your password is encrypted??

This is exactly why you should never reuse the same password across different platforms / accounts.

JustDropped - a huge marketplace of expired domains w/ more than 500,000 monthly visitors according to Hypestat will LITERALLY email you your original username and password if you click “Forgot Password” :D

Get the free Email Deliverability Guide

15 rules for reaching the inbox. Used by 450+ organizations.

Download the Guide

More from the Blog

Cloudflare DNS management dashboard showing a CNAME record and a TXT record both at _dmarc, with the TXT containing v=DMARC1; p=none and the CNAME pointing to dmarc-r.dmarc.cc

Email Security

How Cloudflare DNS Silently Breaks DMARC When ESPs Auto-Deploy Through Entri

May 5, 2026

A specific combination of Cloudflare DNS, a CNAME-based DMARC delegation, and an ESP onboarding through Entri can silently bypass p=reject — leaving domains spoofable while every dashboard reports green. Here's how the conflict happens, how to detect it with dig, and how to fix it.

Terminal output of a dig query showing a production DMARC record with rua=mailto pointing to example@third-party-example.com, the unregistered domain referenced in Cloudflare's documentation.

Email Security

I Registered the Domain in Cloudflare's DMARC Documentation. Eight Other Sites Copied It.

April 30, 2026

Cloudflare's DMARC documentation instructed administrators to send aggregate reports to a domain that had never been registered. We registered it — and within days, real DMARC reports started arriving from 22 production domains. This isn't just a Cloudflare problem.

Email Security

When ESP Setup Instructions Break Your DMARC Protection

April 16, 2026

Moving to DMARC p=reject doesn't guarantee spoofing protection if your SPF record authorizes an ESP's shared IP pool. MailerLite prescribes exactly this configuration in their setup UI — and the exposure applies to every ESP that requires a root-domain include.