US Government Email Systems Open to Abuse Thanks to Typos

Erroneous or outdated DNS records can give attackers surprising powers over organizations’ email systems.

Simple oversights in domain name system (DNS) records are exposing government organizations to all kinds of potential impersonation, spying, and more.

In a new study of more than 25,000 government-related domains, SH Consulting founder Alex Shakhov found dozens whose DNS records referenced either mistyped, expired, or otherwise repurposed domains. Though few in number, those vulnerable included all sorts of agencies representing US towns, cities, counties, regulatory boards, and more.

Many of the erroneous records pointed to domains that were either available to, or already snapped up by, attackers. Depending on the nature of the error, they could allow attackers to send or receive email on behalf of vulnerable government agencies, reconfigure their DNS records, read their security records, and more.

“Typos in DNS are very dangerous, because technically the organization is being hacked without anyone breaking into its systems,” Shakhov tells Dark Reading. “You already have a domain with a reputation established over years. You put whatever IPs you want into DNS, spin up an email server, and send emails out, exploiting that reputation and users’ trust. And these attacks are very difficult to detect, because the attackers didn’t break anything. They just registered a domain sitting in the DNS that nobody knew existed.”

How One Domain Typo Allows Attackers In

Little matters more to a website’s security than its DNS records, which includes instructions about where the website lives in IP space (A/AAAA), its domain (CNAME), how its email is handled (MX, TXT), and who decides these details in the first place (NS). At the end of the day, though, it’s a totally public set of information in plaintext. A simple typo in any of these instructions can have surprisingly significant impacts.

Take Livingston County, Mich., and the city of Pikeville, Ky. These two government bodies seem to have authorized Amazon’s Simple Email Service (SES) for its day-to-day email needs and, as such, their TXT records specify it as a trusted third-party provider. The domains they list, however, contain typos: “amzonses[.]com” and “amasonses[.]com.” Thanks to these mistakes, these bodies have been allowing a non-Amazon entity to send emails on their behalves.

To what end? When Shakhov checked the two organizations’ Sender Policy Framework (SPF) allowlists, he found that Pikeville’s listed 75 IP addresses, and Livingston’s listed more than 32,000 different IP addresses, all authorized to send mail on behalf of their official domains. As a result, Pikeville’s official government domain is now listed on the URI blacklist website “URIBL,” and Shakhov assessed that “it’s reasonable to assume the domain is still being used for abuse.”

In the Livingston County case, the “included” SPF list was rotated every three to eight days since 2021. This suggested that an attacker was performing a “snowshoe” operation: switching to new sending IPs, sending unwanted or malicious emails, and once those IPs attained bad reputations, cycling in new ones.

This information alone doesn’t necessarily prove that attackers were abusing Livingston County’s email domain, or prove how much they might have. But it does prove that they could have. Shakhov connected the actor behind this compromise to a previously documented group that was seen abusing websites from major corporations such as Oracle and CNN Money as well as universities — like the Universities of California in Los Angeles, Davis, San Diego, and Santa Cruz (UCLA, UC Davis, UC San Diego, and UC Santa Cruz) — and the Connecticut state government, thanks to expired CNAME records.

More DNS Flubs Expose Government Agencies

Just about any DNS record can be abused if it contains a typo or refers to an otherwise incorrect domain for some other reason. The nature of the abuse depends, however, on the record in question. Once they register a so-called “dangling” (purchasable) domain, attackers can intercept mail (if the issue lies with an MX record), serve spam content (if it’s in CNAME or NS), send phishing that appears to come from a legitimate sender (SPF), or collect security intel through Domain-based Message Authentication, Reporting, and Conformance (DMARC).

For example, the website for the City of Rupert, Idaho, currently refers to its neighbor Heyburn’s old domain name, heyburnidaho[.]org. That domain was purchased by a malicious actor, which reworked its name server (NS) records to point to its shady gambling website. The actor also arranged to be able to send and receive emails from addresses with an @heyburnidaho.org suffix.

A less serious exposure could occur if attackers grab hold of a DMARC reporting domain. DMARC is an email security protocol, and its part of a TXT record can tell a mail server where to send reports. Those reports can contain sensitive information about an organization’s email infrastructure. Shakhov found 11 local government institutions at risk of this sort of information theft, including four county and law enforcement agencies from Jennings County, Ind.

Taking advantage of these situations is one of the easiest jobs hackers can choose for themselves. “Attackers constantly scan DNS records for vulnerabilities and mistyped domains, because it’s one of the easiest and cheapest ways to get into someone’s infrastructure,” Shakhov explains.

“Records at the root domain, like MX, NS, SPF, DMARC, CAA, etc. can be looked up by anyone,” he continues. “Subdomains are harder to find, but Certificate Transparency logs reveal most of them. So attackers just scan DNS in bulk and get whatever they want. It’s even easier for government domains, because it’s only about 26,000 domains to scan, and attackers can do it multiple times a day at almost no cost. CISA even publishes the full list of .gov domains, so attackers don’t have to find them.”

What Proper DNS Hygiene Looks Like

Shakhov laments that while DNS has been around for nearly half a century, “There’s typically no one at an organization responsible for DNS management. As a result, over time it often turns into a graveyard of expired domains from previous vendors, former corporate domains forgotten after acquisitions and mergers, or just typos, when someone typed a record by hand instead of copying and pasting it.”

Proper DNS hygiene, he says, requires that organizations follow at least a few, core processes. First of all, he argues, “Admins and IT teams must stop typing DNS records by hand. Across millions of domains we scanned this year, 47% of the unregistered domains we found in SPF and DMARC records were typos, either of the organization’s own domain or of a provider’s.”

Second, organizations must have a map of their DNS infrastructure and know where every DNS record came from. Depending on the circumstances, this can be easier said than done. “At universities, it’s quite common for students to put a project on GitHub and ask the IT team to add a CNAME so it lives under the university domain,” Shakhov explains. “The student graduates, but the CNAME stays. The GitHub account gets abandoned and removed, so whoever creates an account with the same name already has a CNAME sitting under the university’s DNS.”

Organizations should also consider registering misspelled versions of their own domains, to prevent attackers snapping them up later.

And, finally, “Regular DNS audits are a must,” Shakhov says. “In most cases, it’s just a simple script that scans your DNS for invalid domains or destinations and flags them. It’s never been that difficult to do a quarterly DNS review to make sure everything is up to date.”