Check your DNS! Abandoned domains used to bypass spam checks

Researchers at Guardio Labs have discovered that a group of spammers is using long-forgotten subdomains from established brands like MSN, eBay, CBS, and Marvel to send out malicious emails. The emails can bypass spam checks and to recipients they look like they come from a legitimate source.

A subdomain is a named sub-division of domain name. For example and are both subdomains of the domain.

Companies use subdomains for all kinds of purposes, from differentiating marketing campaigns to naming different online systems.

It’s also common practice for companies to create CNAME (Canonical Name) DNS records that alias a subdomain to another domain or subdomain.

For example, the subdomain is an easy to read alias for a CloudFront server called

When companies use these techniques and don’t clean up their records after they’re done, criminals can take advantage.

The researchers provide the example of, which was an alias for the domain.

At some point, MSN no longer needed the domain and stopped paying for it, but did not remove the CNAME record that alised to it.

Criminals discovered the link between the two and bought the domain.

This is bad, as the researchers explain:

This means that the subdomain inherits the entire behavior of , including it’s SPF policy.

The Sender Policy Framework (SPF) is an anti-spam DNS record that sets out what domains and IP addresses can send email for a particular domain.

By registering the old and forgotten alias, the criminals were able to add their own IP addresses to the SPF record, allowing them to send spam from that passes SPF checks.

Guardio Labs warns that SPF also offers criminals another way to gain control. SPF’s include: syntax can include a list of other domain names that are allowed to send emails on behalf of a domain. If any of the included domains are abandoned, criminals can buy them up and send email on behalf of the parent domain.

Once the researchers knew what they were looking for they identified thousands of instances of so-called “subdomailing”, encompassing both CNAME and SPF-based tactics and going back at least two years.

The sheer number of hijacked subdomains and available IP addresses is big enough for the criminals to cycle through them to minimize detection and depletion of their “assets.”

As an organization it is important to regularly check your domains for signs of compromise and better manage your online assets—starting with removing unused subdomains and DNS records.

Guardio Labs has created a special subdomailing checker website, allowing domain administrators and site owners to quickly check if any trace of abuse has been found. The researchers note that the checker queries a database with the latest domains impacted by CNAME and SPF-based hijacking. So, a positive result does not mean you are safe, just that you haven’t been hijacked yet.