The Abandoned Endpoint: How an Expired DMARC Reporting Domain Exposed 86 Domains

Case StudiesContact<br>HomeAboutBlogServices

Case StudiesContactBook a Call

Email Security<br>The Abandoned Endpoint: How an Expired DMARC Reporting Domain Exposed 86 Domains Across 20+ Organizations

Alex Shakhov<br>August 11, 2026

This is the full technical record, published so that every claim in it can be checked. A shorter version is available for readers who do not need the evidence.<br>1. Summary<br>DMARC lets a domain owner send authentication telemetry to a mailbox at any domain, including one they do not control. That is deliberate. The protocol was designed for a world where organizations outsource report processing to specialist vendors, and the mechanism exists so a company can point its reports at a processor without handing over its DNS.<br>The design carries an assumption it never states: that the destination domain will stay under the control of the party the domain owner picked.<br>Domains are leased, not owned. Registrations lapse. When a reporting destination lapses, every DNS record still pointing at it redirects a stream of email infrastructure telemetry to whoever registers the domain next. No error is raised. No bounce is generated. Nothing in the sending organization's environment changes. The reports simply start arriving somewhere else.<br>gca-emailauth.org was such a destination. It appears in the published DMARC records of 86 domains belonging to more than 20 distinct organizations : a NYSE-listed manufacturer with roughly $4.5 billion in revenue, a public university, a public residential STEM high school, a regional education agency serving 35,000 children, a public school district, a county developmental disabilities board, a Saudi financial services firm, and two United States county governments.<br>The distribution is heavily skewed. Fifty-six of the 86 domains belong to a single company, The Toro Company. The remaining 30 are spread across every other affected organization.<br>The domain lapsed. It was available for open registration at commodity price. SH Consulting registered it on 20 November 2025 to prevent acquisition by a third party with less benign intent, notified affected organizations through a coordinated disclosure process, removed the endpoint's mail records on 30 July 2026, and has since transferred the domain to the Global Cyber Alliance at no cost.<br>As of a verification sweep run on 5 August 2026, 65 of the 86 domains still publish the endpoint. Twenty-one no longer do.<br>Four things in this incident are worth more attention than the count.<br>The organizations affected did not misconfigure the reporting endpoint. They published exactly what a training slide told them to publish. That slide carries Global Cyber Alliance branding and copyright, and at the time this research was disclosed it was still being served from GCA's own website in English and Spanish. Anyone completing that course and following the slide as written would join the affected population. The problem was still adding new victims.<br>The endpoint was not on GCA's own infrastructure. This is the finding that reframes the incident. The nameservers on the domain's prior registrations do not match any GCA account, a firm technical fact. GCA's own tentative reconstruction is that the domain had most likely been registered and operated by a partner organization rather than by GCA itself. Either way, the reporting address in GCA's published curriculum was not running on infrastructure GCA controlled. The training materials named a reporting endpoint that the organization publishing the training materials did not control. The dependency was never theirs to maintain, and nothing in their processes surfaced that.<br>The reports carry more than infrastructure data. Where a receiving provider populates the optional envelope_to identifier, aggregate reports disclose recipient domains. In one affected portfolio, those recipient domains resolved to a named distributor network with volume-weighted account sizes, a customer list spanning six countries, and municipal and .gov recipients. Infrastructure exposure can be remediated. A map of who an organization corresponds with cannot be un-disclosed once it is out.<br>Security maturity offers no protection against this particular failure. Sixty-five percent of the affected domains belong to a company running full DMARC enforcement with a tier-one commercial processor, where this endpoint sits as a second reporting address alongside one that works correctly. Their monitoring is healthy. That is precisely why nobody noticed.<br>2. How DMARC aggregate reporting works<br>2.1 What is in an aggregate report<br>DMARC, originally specified in RFC 7489 and superseded by the DMARCbis series (RFC 9989, 9990, 9991) published in May 2026, is not an authentication mechanism itself. It sits on top of SPF and DKIM: it lets a domain owner tell receiving servers what to do when a message fails authentication, and it requests reporting on those...