DNS record errors expose your email to impersonation, interception, and takeover. A recent study of more than 25,000 government-related domains by SH Consulting founder Alex Shakhov found dozens whose DNS records referenced either mistyped, expired, or otherwise repurposed domains. Those vulnerable included agencies representing US towns, cities, counties, and regulatory boards. Many of the erroneous records pointed to domains that were either available to, or already snapped up by, attackers. Depending on the nature of the error, they could allow attackers to send or receive email on behalf of vulnerable agencies, reconfigure their DNS records, read their security records, and more.
What are DNS records and why do they matter for email security?
Your DNS records are the instructions that tell the internet where your website lives, how your email is handled, and who decides these details. They include A records for IP addresses, MX records for mail servers, TXT records for email authentication, and NS records that identify who manages your DNS. A typo in any of these creates an opening.
Picture a professional services firm whose IT administrator mistyped a domain name in an SPF record years ago. The typo sits there, invisible, until an attacker notices it. The attacker registers the misspelled domain, sets up a mail server, and starts sending invoices that appear to come from your firm. The emails pass authentication checks because your DNS record vouches for them.
Shakhov tells Dark Reading that typos in DNS are dangerous because the organization is being exploited without anyone breaking into its systems. An attacker with a domain already referenced in your DNS can put whatever IPs they want into their own DNS, spin up an email server, and send emails out, exploiting your reputation and your clients’ trust. These attacks are difficult to detect because the attackers did not break anything. They registered a domain sitting in your DNS that nobody knew existed.
How do DNS record errors expose small businesses to email attacks?
DNS record errors create four distinct risks. First, an attacker can send email that appears to come from you. Second, they can receive email intended for you if the record points to a mail server they control. Third, they can read your SPF, DKIM, or DMARC records to understand your email authentication posture. Fourth, if the error is in an NS record, they can alter your DNS configuration entirely.
The Shakhov study found records that referenced domains that were either mistyped, expired, or otherwise repurposed. Some were available for registration. Others had already been snapped up. The window between an expired domain and an attacker registering it can be hours.
Small businesses face the same exposure as the government agencies in the study. Your DNS records carry the same technical weight for a small business with twenty employees. An error is an error, and an attacker does not care about the size of the target.
What should you audit in your DNS records today?
Start with every domain referenced in your DNS. Pull your full DNS zone file from your registrar or hosting provider. Look at every A, AAAA, MX, TXT, CNAME, and NS record. Write down every domain that appears. Then verify three things for each one.
First, is the domain spelled correctly? Compare it character by character to the domain you intended to reference. A single letter or hyphen out of place is enough. Second, does your organization still own the domain? Log into your registrar and confirm. Third, is the domain still serving the purpose the DNS record assumes? An old mail server domain that was retired two years ago and allowed to expire is now a liability.
If you find a domain you do not own, do not assume it is benign. Treat it as already hostile. Remove the reference from your DNS immediately, even if that breaks a legacy service. A broken service you can fix. A domain controlled by an attacker sending email as you is a breach in waiting.
How do you prevent DNS record errors from exposing your business?
Audit your DNS records quarterly. Assign the task to someone who understands that a typo is not a minor oversight. Make it part of your IT calendar alongside password rotation and patch reviews.
When you add a new DNS record, have a second person review it before you save it. A misspelled domain in a TXT record for email authentication will sit there until someone notices, and that someone may be an attacker scanning for errors.
Renew your domains well before expiration. Set reminders six months out, not six days. If you are retiring a domain, leave it registered for at least two years after you stop using it. The cost of renewal is trivial compared to the cost of an attacker registering it and using your old DNS records against you.
Monitor domain registrations that are similar to yours. Services exist that alert you when a domain matching your name is registered. They will not catch every typo referenced in your DNS, but they will catch someone registering a lookalike to impersonate you.
What does email impersonation look like when DNS is the attack vector?
When an attacker controls a domain your DNS trusts, the impersonation is nearly invisible. The email headers show legitimate SPF and DKIM signatures. The sending domain appears in your DNS records. Mail filters see no red flags.
Suppose a manufacturer whose DNS references a typo receives a call from a customer asking why an invoice doubled overnight. The email came from a domain the customer recognizes because it has appeared in correspondence before. The customer paid it. The money is gone before anyone realizes the sending server was not yours.
The attacker does not need your password. They do not need to compromise your mail server. They only need a domain your DNS record points to, a mail server, and a reputation you built over years.
Who is responsible for DNS record accuracy in your organization?
Assign DNS record management to one person. Make sure they know that the task includes regular audits, not just changes when something breaks. If the person who set up your DNS five years ago is no longer with the company, review every record they created. Assume nothing.
If you outsource DNS management to an MSP or hosting provider, ask them how often they audit your records for errors. Ask them to show you the process. If they cannot answer clearly, find someone who can. Your MSP should treat DNS accuracy as a security control, not a clerical task.
Document every DNS record. Write down why it exists, what service depends on it, and who approved it. When you review your DNS six months from now, you will not be guessing about whether a record is still needed.
What else in your DNS should you review for security?
Check your SPF record. It should list every mail server authorized to send email on your behalf. If it references a domain you do not recognize, investigate immediately. If it includes a domain you used to own, remove it.
Review your DKIM records. Confirm that the private keys they reference are still under your control and that the domains they point to are spelled correctly.
Examine your DMARC policy. It tells receiving mail servers what to do with email that fails authentication. If your DMARC record points to a reporting address at a domain you do not own, you are sending your email security data to someone else.
Look at your NS records. These identify the authoritative name servers for your domain. If one of them is a typo or an expired domain, an attacker who registers it can alter your DNS at will.
Frequently Asked Questions
Can a typo in my DNS records really let someone send email as my business?
Yes. If your DNS records reference a domain you do not control, an attacker who registers that domain can configure it to send email that passes authentication checks. The email appears legitimate because your DNS vouches for it.
How often should I audit my DNS records?
Audit your DNS records quarterly. Review them immediately whenever you retire a domain, change mail servers, or transition IT providers. If you find an error, treat it as an active security incident and correct it the same day.
What should I do if I find a domain in my DNS that I do not own?
Remove the reference from your DNS immediately. Do not wait to investigate. Assume the domain is hostile and that an attacker is already monitoring it. After you remove the reference, review your email logs to see if the domain was used to send or receive mail.
Who should manage DNS records in a small business?
Assign DNS management to someone who understands that accuracy is a security control. If you outsource IT, make sure your MSP treats DNS audits as part of regular security reviews. Document every record and review the list quarterly.
Are expired domains a risk even if I never referenced them in my DNS?
If you allow a domain you once used to expire, an attacker can register it and use old email records, backlinks, or customer familiarity to impersonate you. Renew domains for at least two years after you stop using them, or permanently redirect them to your current domain.
Keep reading
Sources
Source: US Government Email Systems Open to Abuse Thanks to Typos
Researched and drafted with AI, then reviewed and approved by Ron Trotto before publishing.