US Government Domains Exploited via AmazonSES Typo Vulnerabilities
Typo-squatted SPF records allow attackers to bypass email security protocols on government domains.
1Critical SPF Typo Vulnerability
A typo in an AmazonSES entry within US government DNS records has created a massive security loophole. Specifically, 32,066 IP addresses were whitelisted to pass DMARC p=quarantine protocols for milivcounty.gov. This configuration error effectively allows unauthorized senders to bypass standard email authentication checks, posing a significant risk to official government communications.
2Snowshoeing Attack Mechanism
Attackers are utilizing a technique called snowshoeing to exploit these whitelisted IPs. By rotating the IP set every three to eight days, they evade detection by reputation services like Abusix and Spamhaus. Once an IP is blacklisted, the attackers simply rotate the SPF include chain to maintain their malicious email delivery operations.
3Widespread Domain Typo Issues
The vulnerability extends beyond a single instance, affecting multiple government entities. Researchers identified amasonses.com under pikevilleky.gov and amazones.com under townofkirkwood.gov as additional compromised domains. These typos in SPF records demonstrate a systemic failure in maintaining accurate DNS configurations, leaving the door open for attackers to masquerade as legitimate government agencies.
4Dangling Records and Takeovers
Beyond SPF typos, researchers discovered 40 other US government domains suffering from dangling records. These include abused Name Server entries, MX records facilitating mail interception, and DMARC records susceptible to telemetry hijacking. These vulnerabilities allow attackers to gain control over domain infrastructure, potentially intercepting sensitive government correspondence and bypassing security filters entirely.
5Proactive Domain Acquisition
The research team successfully registered 17 of these vulnerable typos and expired domains to prevent further exploitation. One of the acquired domains had been in active use for two decades before expiring in August. This highlights the danger of abandoned digital assets, which remain linked to government infrastructure long after their registration.
6Neglected Security Guardrails
DNS vulnerabilities have persisted for decades, yet many government organizations have consistently bypassed essential security guardrails. By choosing to ignore these fundamental protocols, agencies have left themselves exposed to modern exploitation techniques. The current situation proves that legacy infrastructure gaps are being weaponized by the very technologies these organizations failed to secure.
7Implications for Email Trust
The ability to bypass DMARC p=quarantine protocols undermines the entire trust model of government email. When attackers successfully spoof official domains, the risk of phishing and social engineering campaigns against citizens increases dramatically. This incident serves as a stark reminder that even minor configuration errors can have profound consequences for national security.
8Urgent Remediation Requirements
Government IT departments must conduct immediate audits of their DNS, SPF, and DMARC records to identify similar typos and dangling entries. Implementing automated monitoring for domain expiration and configuration drift is essential to closing these gaps. Without rigorous oversight, these persistent vulnerabilities will continue to provide attackers with easy access to government networks.