A researcher bought noreply.net — and 400,000 corporate emails followed

Ars Technica reported on August 10, 2026 that security researcher Cory Solovewicz, who registered the domains noreply.us and noreply.net, has been passively receiving a torrent of misdirected corporate email — by his count, 401,796 messages to one domain since December 2024, roughly 700 per day. The mail arrives because companies configure "noreply@" addresses on domains they do not own, assuming nobody is listening. Per the report, the messages have included sensitive material ranging from internal reports to test credentials, all delivered to a stranger's mail server by systems that were never supposed to generate replies anyone would read.

The deliverability angle

This is a security story on its face, but the root cause is a deliverability discipline failure: sending systems using addresses on domains outside the sender's control. The same misconfiguration damages mail programs directly. A From or Return-Path address on a domain you don't own cannot pass SPF or DKIM alignment for your organization, which undermines DMARC — now a baseline requirement at Gmail, Yahoo and Microsoft. Bounces, out-of-office replies and spam-filter rejections flow to a third party instead of your bounce processing, so the suppression signals that protect sender reputation never make it home.

What to check

The practical checklist is short. Every address your systems emit — From, Reply-To, Return-Path, envelope sender — must live on a domain your organization owns and monitors. "Noreply" addresses should be real, routable mailboxes on your own domain, even if automation handles the replies; mail sent to them still carries bounce and complaint intelligence you need. And forms or account systems should verify email addresses before trusting them, because the same assumption — "this address goes nowhere" — is how customer data ends up in a researcher's inbox. As Spamhaus-era veterans have said for years: if you didn't register it, don't send as it.