US Government Email Systems Exposed to Abuse Due to Careless DNS Mistakes
A staggering number of US government email systems are vulnerable to exploitation due to simple errors in their domain name system (DNS) records. According to a recent study, dozens of government-related domains contain typos or outdated references that could allow attackers to impersonate these agencies, spy on them, and even take control of their email systems.
The research, conducted by Alex Shakhov, founder of SH Consulting, analyzed over 25,000 government-related domains and identified numerous errors in their DNS records. These mistakes can be attributed to simple oversights or outdated information, but they have serious consequences for the affected organizations. In some cases, attackers could use these vulnerabilities to send emails on behalf of the government agencies, reconfigure their DNS records, or even read their security logs.
Shakhov’s study focused on a specific type of error: typos in DNS records that point to domains either available for registration or already controlled by attackers. These mistakes can be particularly problematic because they allow attackers to exploit the reputation and trust built up over years by the affected government agencies. “Typos in DNS are very dangerous, because technically the organization is being hacked without anyone breaking into its systems,” Shakhov explained. “You already have a domain with a reputation established over years. You put whatever IPs you want into DNS, spin up an email server, and send emails out, exploiting that reputation and users’ trust.”
One such example can be seen in the cases of Livingston County, Michigan, and Pikeville, Kentucky. Both government bodies had authorized Amazon’s Simple Email Service (SES) for their day-to-day email needs, but their DNS records contained typos. Specifically, their TXT records specified “amzonses[.]com” and “amasonses[.]com” as trusted third-party providers – domains that are clearly not affiliated with Amazon. As a result, these government bodies have inadvertently allowed non-Amazon entities to send emails on their behalf.
The implications of these DNS mistakes are significant. In the case of Pikeville, Shakhov discovered that over 75 IP addresses were authorized to send mail on behalf of its official domain. This has led to the city’s official government domain being listed on the URI blacklist website “URIBL.” It is reasonable to assume that the domain is still being used for malicious purposes.
The study also highlighted a worrying trend: attackers are using DNS mistakes to perpetuate “snowshoe” operations – switching between new sending IPs, sending unwanted or malicious emails, and once those IPs gain bad reputations, cycling in new ones. This technique makes it difficult for organizations to detect and respond to these attacks, as the attackers do not need to break into the system; they simply exploit the existing DNS records.
The consequences of these DNS mistakes are far-reaching, affecting not just government agencies but also universities and major corporations that have been compromised by similar attacks in the past. The study serves as a stark reminder of the importance of maintaining accurate and up-to-date DNS records. As Shakhov emphasized, “these attacks are very difficult to detect, because the attackers didn’t break anything. They just registered a domain sitting in the DNS that nobody knew existed.”
In light of these findings, it is essential for government agencies and organizations to review their DNS records and ensure they are accurate and up-to-date. This includes verifying that all domains referenced in DNS records are legitimate and not available for registration or controlled by attackers. By taking proactive steps to secure their DNS records, organizations can mitigate the risk of exploitation and protect themselves against these types of attacks.
Source: Dark Reading — 2026-11-05