Introduction
‘No‑reply’ email addresses are not invisible inboxes – they are silently harvesting private information for anyone who registers the domain.
Q: Why do companies think it’s safe to send data to a no‑reply address?
A: They assume the address is unmonitored and will never reach a real person.
Q: What kinds of data have been captured through these addresses?
A: Injury reports, pizza orders, school account setups, CCTV images, and even corporate event invitations.
Q: Can organizations prevent this leakage?
A: Yes, by using the .invalid TLD, disabling catch‑all mailboxes, and regularly auditing automated email systems.
The Researchers and the Numbers Behind the Leak
Security researcher Cory Solovewicz has logged 401,796 messages since December 2024, averaging 699.99 emails per day. He owns the domains noreply.us (purchased in 2020) and noreply.net (purchased in 2024). The latter alone has received 28,365 attachments, while noreply.us has recorded 37,255 messages over 2,345 days. In total, the emails originate from more than 14,000 “from” addresses across 6,200 root domains.
Why Automated Systems Target Non‑Existent Mailboxes
When an employee leaves or an account is deleted, many internal tools simply replace the personal address with a placeholder like [user]@noreply.net. The assumption is that the message will disappear into a void, but most mail servers still accept and store the message. This practice mirrors the older issue highlighted by Brian Krebs nearly two decades ago about @donotreply.com.
Real‑World Examples of Sensitive Information Leaked
- A city government’s injury report was sent to Solovewicz’s inbox.
- Automated pizza order confirmations from a national chain landed in the catch‑all.
- School platform account creation emails revealed student IDs.
- An AI firm monitoring industrial sites in the Middle East sent thousands of CCTV stills.
- Hotel reservation emails included full guest names and reservation numbers.
- A San Francisco company’s summer BBQ invitation addressed to “Dear Deleted User” was forwarded to a deleted‑user domain.
Mitigation Strategies and Community Efforts
Solovewicz has reached out to over 14,000 organizations, but only a fraction responded. He presented his findings at Defcon, urging companies to audit their email configurations. Meanwhile, Mike Sheward, head of security at Xeal, bought the domain deleteduser.com for $15 and observed similar misdirected traffic from at least 100 different entities. Together, they now control more than 30 placeholder domains to divert potential malicious harvesters.
Future Outlook and Recommended Standards
If left unchecked, placeholder domains will continue to act as free data mines for cyber‑criminals. Experts recommend: 1. Adopt the .invalid top‑level domain for any address that should never receive mail. 2. Deploy automated tools to detect and disable catch‑all configurations. 3. Incorporate email‑flow reviews into regular security audits. 4. Educate development teams about the risks of hard‑coding “no‑reply” addresses. 5. Use monitoring solutions that flag unexpected outbound email volumes.
Conclusion
Take immediate action: audit your organization’s email routing, replace all “no‑reply” placeholders with .invalid addresses, and disable any catch‑all mailboxes. This simple step protects customer privacy and reduces legal exposure.