I registered an expired DMARC reporting domain (gca-emailauth[.]org) for $10. It had been published as the aggregate-reporting (rua) address in Global Cyber Alliance DMARC training docs going back to a 2019 bootcamp, and at some point it lapsed.
Shortly after registration, aggregate DMARC reports for 86 domains across 20+ organizations started arriving.
56 belonged to The Toro Company (NYSE-listed), including myturf[.]com, their distributor platform, which sits at p=none. The rest – University of Wisconsin–Stevens Point (14 subdomains), the North Carolina School of Science and Mathematics, Ennis ISD (Texas), Great Prairie AEA (an Iowa education agency serving 35,000 students), two county governments, and several commercial domains.
For most of these it was a second rua address sitting behind a working commercial processor (Proofpoint, in Toro's case). But it looks like nobody was actually reading those reports – the state university just removed the rua tag from DMARC entirely while keeping p=reject, and all but one Toro domain were centralized through a _dmarc.parked.thetoroco.com CNAME, meaning they didn't even assume there was real traffic going through any of those domains.
GCA's engineers later traced it to a former partner who'd held the domain and let it lapse – the dependency was never written down.
If you manage DNS: run
dig +short TXT _dmarc.example.com
read every address in the rua= part, and confirm you still control the domain after each @
https://www.sh.consulting/blog/abandoned-dmarc-reporting-domain
Source: r/sysadmin · by /u/PlasmaJam