Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In a campaign Guardio Labs reported in February 2024, attackers exploited forgotten DNS records tied to legitimate organizations to send email that could pass configured authentication checks. The method did not require breaking into those organizations’ core networks or email accounts: it relied on old domain relationships that still pointed to infrastructure the organizations no longer controlled.
What happened in the SubdoMailing campaign?
Guardio Labs named the operation “SubdoMailing” and associated it with an actor it called “ResurrecAds.” SecurityWeek reported Guardio’s 2024 estimates of roughly 8,800 abused domains, more than 13,000 associated subdomains, and about five million emails per day. Guardio said the number of affected domains was growing by hundreds daily during its observation period. These are historical estimates, not a current count.
The messages often used deceptive alerts, including fake cloud-storage warnings and package-delivery or account notices. Links could pass through redirects that took the recipient’s device type and location into account, then lead to advertising, scams, phishing pages, or malware downloads. Guardio characterized the operation as click-oriented advertising abuse while also documenting malicious outcomes. SecurityWeek’s February 2024 report summarized Guardio’s findings.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The incident describes abuse of DNS and sender-authorization configuration. It does not establish that the named organizations’ core networks or email accounts were compromised.
#1 Best Overall
- SonicWall Comprehensive Anti-Spam Service for TZ270 - 1 Year License (02-SSC-6673)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
How could an old company domain enable the abuse?
Two related weaknesses can leave an attacker with leverage: an abandoned destination behind a live subdomain, or a stale domain that remains listed as an authorized email sender. In both cases, the organization’s DNS records preserve a relationship after its control of the other end has ended.
Dangling CNAME: a live subdomain points to an abandoned target
A CNAME record sends a subdomain to another hostname. If an organization leaves that record in place after the external target or service has been abandoned, and the target domain becomes available for registration, someone else may be able to register it and control the destination behind the still-live subdomain.
Guardio’s example involved marthastewart.msn.com, which pointed to msnmarthastewartsweeps.com, a domain associated with an old sweepstakes. Guardio said archived evidence indicated that the sweepstakes domain had been abandoned after its earlier use and that it was privately registered again in September 2022. The example illustrates how a familiar organization’s subdomain can remain a useful-looking entry point even after the destination relationship has become unsafe.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #2
- SonicWall Comprehensive Anti-Spam Service for TZ270 - 2 Year License (02-SSC-6674)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
Stale SPF references: an old domain remains authorized to send
SPF is a DNS-based policy that identifies servers permitted to send mail for a domain. Its mechanisms can refer to other domains—for example, through include or address lookups. If a policy continues to rely on a domain that has expired and been registered by someone else, infrastructure controlled by the new registrant may fall within the authorization the organization still publishes.
In Guardio’s MSN example, recursively expanding the shown SPF references produced 17,826 authorized IP addresses, including the address observed in the sample message. That is a figure from Guardio’s specific example, not a general property of SPF or an independently remeasured count. Guardio also described a Swatch SPF example involving a now-registered domain whose address records it considered suspicious. The protocol standard sets evaluation rules and lookup limits; the operational question is whether the domains a particular policy authorizes still belong to services the organization intends to trust. See the IETF SPF specification, RFC 7208.
Why did SPF and DMARC pass?
In the sample Guardio examined, authentication results showed SPF pass and DMARC pass; Guardio also described a DKIM pass in its analysis. These results mean that the message satisfied the configured authorization and alignment checks. They do not independently verify that every domain, included sender, or service in the organization’s DNS policy remains under the intended owner’s control.
Rank #3
- SonicWall Comprehensive Anti-Spam Service for TZ270W - 1 Year License (02-SSC-6679)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
That distinction explains how a message can be technically authorized by stale configuration and still be malicious. SPF, DKIM, and DMARC remain useful controls; this incident exploited the DNS and policy inputs those controls consult rather than demonstrating that the protocols themselves do not work. RFC 7489 advises domain owners to review SPF records to understand which networks are authorized to send on their behalf. RFC 7489, the DMARC standard, also describes DMARC reporting and its privacy and handling considerations.
What should domain owners and email administrators check?
The direct defense is to know which DNS relationships remain active, why they exist, and who controls the other end. Review email authorization alongside subdomain records: a forgotten marketing campaign, acquisition, or retired service can leave behind either kind of exposure.
- Inventory the estate. List registered domains and subdomains, DNS providers, and email, hosting, and marketing vendors. Include records inherited through acquisitions and old campaigns.
- Follow each CNAME. For every subdomain CNAME, identify the target and confirm it still belongs to a service the organization uses and controls. Remove obsolete records; do not leave a pointer to a service or domain that has been retired.
- Review SPF authorization. Inspect
include,a, and other mechanisms for stale domains and senders. Remove authorization that is no longer needed, and check the policy against the evaluation limits in RFC 7208. - Use authentication reports as operational signals. Review DMARC reports and sender results to identify unexpected sources and policy drift. Handle report data with the privacy and data-management considerations described in RFC 7489.
- Verify that fixes took effect. After changing records, check the published DNS data and confirm that legitimate senders still authenticate. Assign an owner and a review date to records that depend on outside services.
Which defensive approach fits the job?
Different checks cover different failure modes. A campaign-specific lookup may flag known abuse, while ongoing inventory and monitoring are needed to find broader DNS exposure. No single approach replaces record ownership and cleanup.
Rank #4
- SonicWall Comprehensive Anti-Spam Service for TZ350 - 1 Year License (02-SSC-1809)
- Advanced Spam & Phishing Filtering: Blocks unwanted emails, phishing attempts, and spoofed messages before they reach users.
- Real-Time IP Reputation & Cloud Lookups: Uses SonicWall’s threat intelligence network to identify and block known spammers and malicious domains.
- Integrated with SonicWall Appliances: Runs natively on SonicWall firewalls and Email Security appliances with no additional hardware required.
- Email Continuity & Clean-Up Tools: Reduces email server load and ensures clean, filtered mail delivery to help protect business productivity.
| Approach | What it can help with | What to verify |
|---|---|---|
| Manual DNS inventory and cleanup | Reviewing all known domains, subdomains, CNAME targets, and SPF references. | Whether the inventory is complete, who owns each record, and how often it is reviewed. |
| Continuous DNS and domain monitoring | Surfacing changes or potential dangling targets between manual reviews. | Coverage of domains and subdomains, detection of both CNAME and SPF risks, alerting, ownership workflow, reporting, and fix validation. The available reporting does not establish a comparative vendor assessment. |
| Email authentication reporting and review | Identifying observed senders and authentication patterns that may warrant investigation. | Whether reports are reviewed regularly, handled appropriately, and connected to a process for updating authorized senders. |
| Campaign-specific known-abuse checker | Checking for domains already associated with this particular campaign. | Guardio said it created a SubdoMailing checker, but its current availability is not established here. A clean result would not prove that a domain has no other DNS or email-authorization exposure. |
What the reported numbers do—and do not—show
Guardio’s figures describe its 2024 observation period, not the campaign’s status today. No current independent measurement is established here, so the number of affected domains or emails in 2026 should not be inferred from those historical estimates.
SecurityWeek also quoted Patrick Harr, CEO of anti-phishing company SlashNext, citing 149,345 live phishing threat URLs on legitimate domains. That was Harr’s attributed company threat-feed figure in 2024, not a general prevalence estimate or a number independently verified here. Harr said that DMARC, DKIM, and SPF alone would not detect these threats; his point was that authentication needs to be complemented by detection that looks beyond domain reputation, not that email authentication has no defensive value.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
