# US Government Domains Exploited via AmazonSES Typo Vulnerabilities Typo-squatted SPF records allow attackers to bypass email security protocols on government domains. - **Source:** [Technical Information Security Content & Discussion](https://brifing.si/source/00707f34-d14e-4e4d-a6f0-2cd451bd38f7) - **Published:** 2026-11-09 - **Topic:** [technology](https://brifing.si/c/technology) - **Original article:** - **On Brifing:** https://brifing.si/s/caa32a3f-a413-4a6e-9b0b-8564f7116d36 ## Critical SPF Typo Vulnerability A typo in an AmazonSES entry within US government DNS records has created a massive security loophole. Specifically, 32,066 IP addresses were whitelisted to pass DMARC p=quarantine protocols for milivcounty.gov. This configuration error effectively allows unauthorized senders to bypass standard email authentication checks, posing a significant risk to official government communications. ## Snowshoeing Attack Mechanism Attackers are utilizing a technique called snowshoeing to exploit these whitelisted IPs. By rotating the IP set every three to eight days, they evade detection by reputation services like Abusix and Spamhaus. Once an IP is blacklisted, the attackers simply rotate the SPF include chain to maintain their malicious email delivery operations. ## Widespread Domain Typo Issues The vulnerability extends beyond a single instance, affecting multiple government entities. Researchers identified amasonses.com under pikevilleky.gov and amazones.com under townofkirkwood.gov as additional compromised domains. These typos in SPF records demonstrate a systemic failure in maintaining accurate DNS configurations, leaving the door open for attackers to masquerade as legitimate government agencies. ## Dangling Records and Takeovers Beyond SPF typos, researchers discovered 40 other US government domains suffering from dangling records. These include abused Name Server entries, MX records facilitating mail interception, and DMARC records susceptible to telemetry hijacking. These vulnerabilities allow attackers to gain control over domain infrastructure, potentially intercepting sensitive government correspondence and bypassing security filters entirely. ## Proactive Domain Acquisition The research team successfully registered 17 of these vulnerable typos and expired domains to prevent further exploitation. One of the acquired domains had been in active use for two decades before expiring in August. This highlights the danger of abandoned digital assets, which remain linked to government infrastructure long after their registration. ## Neglected Security Guardrails DNS vulnerabilities have persisted for decades, yet many government organizations have consistently bypassed essential security guardrails. By choosing to ignore these fundamental protocols, agencies have left themselves exposed to modern exploitation techniques. The current situation proves that legacy infrastructure gaps are being weaponized by the very technologies these organizations failed to secure. ## Implications for Email Trust The ability to bypass DMARC p=quarantine protocols undermines the entire trust model of government email. When attackers successfully spoof official domains, the risk of phishing and social engineering campaigns against citizens increases dramatically. This incident serves as a stark reminder that even minor configuration errors can have profound consequences for national security. ## Urgent Remediation Requirements Government IT departments must conduct immediate audits of their DNS, SPF, and DMARC records to identify similar typos and dangling entries. Implementing automated monitoring for domain expiration and configuration drift is essential to closing these gaps. Without rigorous oversight, these persistent vulnerabilities will continue to provide attackers with easy access to government networks. ## Sources covering this story - https://www.reddit.com/r/netsec/comments/1xry7z3/ip_snowshoeing_under_us_gov_email_via_a/ — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._