Forgotten CNAME let spammers send mail as marthastewart.msn.com

Guardio Labs showed how a stale CNAME on an MSN subdomain pointing to an expired domain let spammers send mail as msn.com while passing SPF and DMARC. Over 8,000 domains were abused this way, including VMware, McAfee, eBay and CBS.

• The CNAME to msnmarthastewartsweeps.com sat for 21 years; the domain was bought in 2022
• The buyer controlled the subdomain's SPF record and could send as msn.com
• Guardio counted over 8,000 domains abused via SubdoMailing
• 36 services are marked vulnerable in the can-i-take-over-xyz list