DNS typos expose US government email systems to abuse

A new analysis of more than 25,000 government-related domains highlights how simple oversights in DNS records can give attackers surprising influence over public-sector email systems. SH Consulting founder Alex Shakhov describes several instances where mistyped, expired or repurposed domains were referenced in authoritative DNS records, enabling malefactors to impersonate agencies, read security data and, in some cases, send or receive emails on behalf of government bodies.

The study cites concrete examples involving Livingston County, Michigan, and the city of Pikeville, Kentucky, where TXT records point to Amazon’s SES as a trusted third-party provider but contain typos such as amzonses[.]com or amasonses[.]com. In Pikeville, the SPF allowlist lists 75 IP addresses; in Livingston County, more than 32,000 IPs are authorised, creating a broad surface for abuse.

Shakhov suggests the domain reputations could already be leveraged for ongoing abuse, noting that Pikeville’s domain now appears on the URI blacklist site URIBL.

The findings outline how different DNS record types—MX, NS, SPF, TXT (DMARC), and CNAME—can be exploited when records point to or rely on misnamed domains. The report describes a “snowshoe” pattern in Livingston County where IPs are rotated every three to eight days, indicating frequent changes in sender infrastructure to avoid detection.

Other examples include the City of Rupert, Idaho, which used Heyburn’s old domain to facilitate mail delivery under an alias and the potential exposure of DMARC reporting domains that could leak sensitive infrastructure details. Shakhov emphasises the ease of scanning DNS for vulnerable records and urges regular audits, domain misspelling protections, and a mapped view of DNS provenance to mitigate risk.