[HN Gopher] Microsoft mishandling example.com
___________________________________________________________________
Microsoft mishandling example.com
Author : mrled
Score : 221 points
Date : 2026-01-23 13:04 UTC (9 hours ago)
(HTM) web link (tinyapps.org)
(TXT) w3m dump (tinyapps.org)
| godzillabrennus wrote:
| This is the same company that mishandled the Office brand
| (abandoned it) and is mishandling the Xbox brand (what even is an
| Xbox anymore?). Are we surprised?
| rurban wrote:
| NSA probably. Gives them plausible deniability.
|
| Maybe some of their targets did use example.com for some probing,
| and the NSA had a hand in Sumitomo Electric Industries' mail
| server.
| whizzter wrote:
| Reading the article, there is a huge flaw in the autodiscover
| protocol by Microsoft.
|
| https://www.akamai.com/blog/security/autodiscovering-the-gre...
|
| According to it, it seems that if someone registers
| autodiscover.com then example.com lacking
| autodiscover.example.com will make Outlook try checking if
| autodiscover.com has an entry.
|
| It's just a braindead system.
| irusensei wrote:
| Not surprised. They used to have training material incentivizing
| professionals to use .local as TLD for Active Directory realms.
| Thats a reserved domain for Multicast DNS.
|
| Working on Linux automation systems we would need to make sure to
| disable anything related to Avahi in our images otherwise name
| resolution would fail for some customers.
| szszrk wrote:
| My company used .local for EVERYTHING. I took it as normal at
| the time, until I got into problems with VMWARE products.
|
| Support patiently explained .local is reserved for something
| else and kindly provided Wikipedia links.
|
| They never responded why they used .local in their docs,
| trainings, webinars they provided, though :)
| irusensei wrote:
| My impression is that Ballmer IE6 era Microsoft didn't gave a
| shit about standards.
| jve wrote:
| Is standard you are talking about is Multicast DNS
| https://www.rfc-editor.org/rfc/rfc6762 from year 2013?
| PcChip wrote:
| I've worked with hundreds of customers that use .local
| internal domains and vmware, what issues are you describing?
| EvanAnderson wrote:
| Things from docs making it into production is insidious.
| There were some early Sun docs that referenced a 129.9.0.0/16
| network. Some helpful contractor in my locality, specializing
| in local government work, configured several police, fire,
| and city governments with that subnet internally back in the
| 90s. A few of them are still running that way today. I
| remember running into some oddball behavior with the Teredo
| adapter in Windows 7 that I traced back to it behaving
| differently because the PC's IP address didn't fall into
| RFC1918 space.
| somat wrote:
| Makes me remember the 192.1 addresses that were all over at
| one place I worked. "Um you know that is a valid internet
| address right?" "Yeah, but the guy who originally set the
| systems up was confused about the private address space,
| used the wrong one and we don't want to break anything so
| are not going to change it"
|
| Good times.
| ndriscoll wrote:
| Haven't they been telling people to do that since before it
| became reserved? If so, the problem is more that you can't
| "reserve" something that's already in wide use, and mdns
| should've used something like .mdns.
|
| It's like when .dev became a gTLD, knowingly breaking a bunch
| of setups for a mix of vanity and a cash grab. Obviously
| dropped the ball on the engineering side.
| WorldMaker wrote:
| Seems more a reason to never use stuff you don't actually
| control and are reserved for future purposes. Everyone knew
| who was in charge of DNS TLDs and that while they were being
| at first conservative in how many they assigned, they
| reserved the right to assign as many as they wanted.
|
| But also, yes Microsoft documentation used .local before mDNS
| reserved it, and IIRC Microsoft was also involved in
| suggesting it for mDNS as mDNS came out of the multi-company
| standardization efforts from Apple's Bonjour. That said, my
| impression of most of that documentation from that time is
| that it was incorrectly using .local as a fake TLD where they
| should have been using .example or .example.com and also
| pointing people to the RFCs that those were not valid choices
| in a real setup. A problem with such documentation is that it
| is too easy to take literally. A follow up problem was sort
| of the "accidental security through obscurity" benefits of
| using non-globally resolvable addresses becomes "best
| practice" through essentially stubbornness and status quo
| (related to all the recent rediscussions on HN about NAT44 is
| not a firewall except by accident and you can have very good
| firewalls that aren't NAT44).
| p_ing wrote:
| Usage of .local for AD predated mDNS. That advice stopped with
| the advent of mDNS in favor of
| 'corp.<registered_domain>.<tld>'.
| EvanAnderson wrote:
| The original Windows 2000 guidance for AD was
| corp.example.com, from my recollection. The silly .local
| thing (which does predate mDNS) happened as a result of the
| Small Business Server refresh for Active Directory.
| hu3 wrote:
| This is why I never use these IANA-reserved domains like .test,
| .example, .invalid, .localhost.
|
| I always make up some impossible domains like domain.tmptest
|
| Otherwise you're one DNS "misconfiguration" away from sending dev
| logs and auth tokens to some random server.
|
| > Since at least February 2020, Microsoft's Autodiscover service
| has incorrectly routed the IANA-reserved example.com to Sumitomo
| Electric Industries' mail servers at sei.co.jp, potentially
| sending test credentials there.
| whizzter wrote:
| .example is probably far safer than example.com.
|
| https://www.akamai.com/blog/security/autodiscovering-the-gre...
|
| According to it, it seems that if someone registers
| autodiscover.com then example.com lacking
| autodiscover.example.com will make Outlook try checking if
| autodiscover.com has an entry.
|
| It's just a braindead system.
| jsheard wrote:
| It's all fun and games until Donuts buys .tmptest for some
| reason.
| wongarsu wrote:
| brb, just filing paperwork to apply for the .tmptest gTLD /s
| lagniappe wrote:
| I suspect you'd download a car.
| ThePowerOfFuet wrote:
| $100K
| thequux wrote:
| $227k just to apply, and another few hundred thousand in
| legal, compliance, and contracting to reach delegation.
|
| Source: I'm on the board of dotMeow and wrote the financial
| plan
| Cthulhu_ wrote:
| Would that really make a difference in this case? It's a
| configuration error / bug in Microsoft's discovery server, they
| could have a fallback that goes "any unknown address, return
| this .jp address".
| tialaramex wrote:
| It so happens that in this very specific case your obviously
| bad choice didn't make anything worse, that doesn't make it a
| good choice.
|
| "Aha, the defective trucks only cause injuries to people who
| have their hands on the wheel at highway speeds, but I've never
| bothered holding the wheel at high speed, I just YOLO so I
| wouldn't be affected"
|
| If people had used IANA's reserved TLDs they too would be
| unaffected because although Windows will stupidly _try_ to talk
| to for example autodiscover.example that can 't exist by policy
| and so the attempt will always fail.
| larrik wrote:
| And then you fire off 100k emails, they all bounce, and your
| mail service shuts you off...
| dc396 wrote:
| As others have pointed out, using 'tmptest' works until someone
| buys tmptest -- unlikely, but people will buy anything these
| days.
|
| I always use the ISO-3166 "user-assigned" 2-letter codes (AA,
| QM-QZ, XA-XZ, ZZ), with the theory being that ISO-3166
| Maintenance Agency getting international consensus to move
| those codes back to regular country codes will take longer than
| the heat death of the universe, so using them for internal
| domains is probably safe.
| andreldm wrote:
| That's why example.com states "Avoid use in operations", not only
| that could create unnecessary traffic for them as well as leak
| information as in situations like this.
| charles_f wrote:
| Yeah, it feels more like a safety net than something you should
| purposefully use
| binaryturtle wrote:
| Why do you need to send a password when using their Autodiscover
| API? Would Outlook send the respective passwords for each email
| account to Microsoft?
| philipwhiuk wrote:
| I suspect they try to login and reverse engineer the IMAP
| config.
| Neil44 wrote:
| curl -u just requires the field to be there, I suspect. No
| authentication takes place. You can send any password and the
| output doesn't change.
| GranPC wrote:
| > Microsoft's Autodiscover service misconfiguration can be
| confirmed via curl -v -u "email@example.com:password"
| "https://prod.autodetect.outlook.cloud.microsoft/autodetect/d..."
|
| Wait, does their autodetect send email and password to their
| servers, instead of just domain???
| stronglikedan wrote:
| See replies to a similar question here (in case you haven't
| already): https://news.ycombinator.com/item?id=46732623
| technion wrote:
| Autodiscover has always been an interesting security problem. I
| wrote this years ago:
|
| https://lolware.net/blog/2020-09-02-autodiscover-circus/
| gruez wrote:
| >Microsoft's Autodiscover service misconfiguration can be
| confirmed via curl -v -u "email@example.com:password" "https://pr
| od.autodetect.outlook.cloud.microsoft/autodetect/d...":
|
| Hold up, does this mean outlook sends your full credentials to
| Microsoft when you try to set up an outlook account? I'm sure
| they pinky promise they keep your credentials secure, but this
| feels like it breaks all sorts of security/privacy expectations.
| thedanbob wrote:
| It's more common than you might think. I know of at least one
| popular email client that stores your credentials on their
| servers to enable features like multi-account sync and
| scheduled sending.
| spiffyk wrote:
| I would expect such a feature to use end-to-end encryption
| for the data, so that only the user can see the credentials.
| It does, right? Right?
| gruez wrote:
| >>multi-account sync and scheduled sending
|
| >I would expect such a feature to use end-to-end encryption
| for the data
|
| How would "end-to-end encryption" when such features by
| definition require the server to have access to the
| credentials to perform the required operations? If by "end
| to end" you actually mean it's encrypted all the way to the
| server, that's just "encryption in transit".
| treyd wrote:
| > If by "end to end" you actually mean it's encrypted all
| the way to the server, that's just "encryption in
| transit".
|
| This is what Zoom claimed was e2ee for a little while
| before getting in trouble for it.
| tom1337 wrote:
| Do you mean Spark? I get why they need to do it that way but
| I also hate that they have to do it that way because it sucks
| for privacy.
| RajT88 wrote:
| I bought a hardware password manager a while back and the
| bulk load tool sent all your creds to a cloud service. I have
| not used it since, and sent the manufacturer a nasty note.
|
| It was the Ethernom Beamu, company now defunct.
| dec0dedab0de wrote:
| I think outlook is pretty much a saas product these days.
| tga wrote:
| Most likely, and nobody cares.
|
| Already many years ago I remember installing a firewall on my
| phone and noticing in surprise that Outlook was not connecting
| at all to my private mail server, but instead only sending my
| credentials to their cloud and downloading messages from there.
|
| The _only_ Android mail client not making random calls to cloud
| servers was (back then) K-9 Mail.
| nhinck2 wrote:
| Yeah since the Windows 11 2023h2 update.
| brulx126 wrote:
| Not just that, the new outlook app makes Microsoft a complete
| man-in-the-middle for your email account.
|
| https://www.xda-developers.com/privacy-implications-new-micr...
| koakuma-chan wrote:
| And? Do you think Gmail is end to end encrypted?
| brulx126 wrote:
| I am talking about the fact that the new default email
| client on Windows will hand over all your email credentials
| to Microsoft. This has nothing to do with Gmail.
| koakuma-chan wrote:
| Oh you mean even if you don't use Microsoft's email? Now
| I get it.
| gruez wrote:
| My bank isn't end to end encrypted either, but that doesn't
| mean it's suddenly ok for Microsoft (or any other company)
| to suddenly start MITMing my online banking connections.
| AlexandrB wrote:
| Adding a bunch of middlemen that _also_ see the data
| increases the risk.
| delfinom wrote:
| I think the concern is that it copies the emails of your
| non-Microsoft accounts that you added to the Outlook app,
| over to Microsoft servers
| amluto wrote:
| This seems like it would completely break any attempt to
| track access from unauthorized users or devices -- any IT
| department using a backend other than Microsoft's would need
| to pretend that all access from MS's servers is safe.
| donmcronald wrote:
| They store passwords and proxy everything at the same time
| they're pushing OAuth, authenticators, passkeys, etc. for
| their own services. Everyone should have revolted when they
| bought Acompli and started doing this kind of thing.
| kstrauser wrote:
| I am so glad people are finally noticing and complaining
| about this. It's the same reason I won't use Spark or
| Superhuman. Those are neat services, but I can't abide
| storing the creds to perhaps the most security-sensitive
| service I use to a cloud provider. If they get hacked, then
| the attacker can access my email account, send phishing
| emails to my contacts, read and respond to password reset
| requests they make to other online services, etc. It would be
| disastrous.
|
| No, I'll keep my credentials stored and used locally, thanks.
| encom wrote:
| So like Cloudflare for email.
| butvacuum wrote:
| Basically everything microsoft makes that touches http will
| send your username and your password to any server that asks
| for Basic Authentication.
|
| It looks like Microsoft Edge had the _ability to disable_ this
| added in 2020 or 2021, but it isn't currently the default and
| the Group Policy unintuitively only applies to unencrypted HTTP
| Connections.
| gruez wrote:
| >Basically everything microsoft makes that touches http will
| send your username and your password to any server that asks
| for Basic Authentication.
|
| Are you talking about NTLM hashes? It's a weak hash, but not
| the same as "sending your password". The biggest difference
| is that even a weak hash can't be reversed if the password
| has high enough entropy.
| lazide wrote:
| Not necessarily, the server can say it only supports basic
| auth and....
| gruez wrote:
| I don't think there's any evidence that windows sends
| cleartext passwords. The whole reason why NTLM is a thing
| is to avoid sending cleartext passwords.
| lazide wrote:
| Outlook appears to be
| p_ing wrote:
| The 'https://' disagrees with your 'sending clear text
| passwords' statement.
| lazide wrote:
| It's clear text to the receiving server, which is what
| we're talking about, not one way hashed.
| butvacuum wrote:
| yes, I meant to type hash. Not that it matters as even 10yr
| old integrated GPUs are enough to brute force 8 or 9
| character NTLM(or any variant) passwords in a few hours.
| Not that you need to with Pass The Hash.
| dspillett wrote:
| _> Hold up, does this mean outlook sends your full credentials
| to Microsoft when you try to set up an outlook account?_
|
| Not just an "outlook account" - _any_ account in outlook, with
| default settings at least.
|
| I run a mail server, mainly for me but a couple of friends have
| accounts on there too, and a while ago one friend reported
| apparently being locked out and it turned out that it was due
| to them switching Outlook versions and it was connecting via a
| completely different address to those that my whitelists
| expected _sometimes at times when they weren 't even actively
| using Outlook_. Not only were active connections due to their
| interactive activity being proxied, but the IMAP credentials
| were stored so the MS server could login to check things
| whenever it wanted (I assume the intended value-add there is
| being able to send new mail notifications on phones/desktops
| even when not actively using mail?).
|
| _> but this feels like it breaks all sorts of security
| /privacy expectations._
|
| It most certainly does. The behaviour can be tamed somewhat,
| but (unless there have been recent changes) is fully enabled by
| default in newer Outlook variants.
|
| The above-mentioned friend migrated his mail to some other
| service in a huf as I refused to open my whitelist to "any old
| host run by MS" and he didn't want to dig in to how to return
| behaviour back to the previous "local connections only, not
| sending credentials off elsewhere where they might be stored".
| 1718627440 wrote:
| Always has been.
| Neil44 wrote:
| I think the curl -u switch just requires the password field to
| be filled, there obviously isn't a legit user account
| test@example.com with a password of password either at
| microsoft or at the Japanese imap server.
| gruez wrote:
| >I think the curl -u switch just requires the password field
| to be filled
|
| Yeah you're right, if you don't specify the password (eg. -u
| user), it prompts you for it
|
| >there obviously isn't a legit user account test@example.com
| with a password of password either at microsoft or at the
| Japanese imap server.
|
| But presumably the fact it's there at all suggests it's a
| required parameter? Maybe "password" is just a placeholder,
| but it's unclear based on the command line transcript alone.
| Thaxll wrote:
| Where does sei.co.jp comes from? Why Microsoft would use that
| domain in the first place?
| irusensei wrote:
| It's not really the domain but the registration in the MS
| Office Cloud. If you query who owns example.com mail you get
| that company.
| Daviey wrote:
| I'm willing to bet they were the first user to try and add
| example.com to their Outlook account, and MS then just assigned
| it to them without verifying they own the domain.
| onionisafruit wrote:
| I gather this has little to do with "example.com" and more to do
| with any domain that doesn't have an autodiscover subdomain.
| butz wrote:
| Nice to see tinyapps.org is still alive.
| emmelaich wrote:
| > _The domain has a null MX record (indicating it doesn 't accept
| email)_
|
| Not quite true, SMTP will use the A record if there is no MX.
| dpifke wrote:
| In this case, "null MX record" means MX exists, but does not
| specify a valid server: $ host -t mx
| example.com example.com mail is handled by 0 .
|
| Senders should not fall back on the A record in this case.
| philo23 wrote:
| Just a guess but why do I get the feeling it's because someone
| who setup sei.co.jp in Azure Entra (aka Azure AD) some how
| managed to add/claim the domain "example.com" against their
| companies tenant.
|
| It's clearly not using the DNS records for discovery because they
| don't exist, the only other option I can see is some weird fall
| through or hard coded value and it seems like an odd one to pick.
| 1vuio0pswjnm7 wrote:
| Now that example.com is hidden behind Cloudflare, how does the
| public know who is controlling the origin servers
|
| The IPv4 for example.com used to be 93.184.216.34
|
| Was there an announcement somewhere
___________________________________________________________________
(page generated 2026-01-23 23:01 UTC)