Noreply.net Became a Mail Sink: and Nobody Checked the Drain

ByMax Dvornik
Email security researcher Cory Solovewicz examining messages sent to a placeholder domain

Security researcher Cory Solovewicz says noreply.net received 401,796 messages after he acquired it in December 2024, including notifications that reportedly carried private customer and organizational data. The volume works out to almost exactly 700 messages a day, mail sent by systems that apparently treated a real, externally owned domain as a harmless no-reply address.

The incident is reported solely through Solovewicz’s account to Ars Technica in August 2026. But the available historical record points to a more durable failure than the story’s surface-level “expired domain” framing: noreply.net had long looked generic enough for people, templates, and even a Postfix tutorial to use as a placeholder.

Solovewicz, a security researcher and consultant, told Ars that he bought noreply.us in 2020 and noreply.net in 2024. He said the .us purchase began as a catch-all mailbox project, before mail intended for other people and organizations started arriving.

“I did not realize that this was going to be as big of a problem as it is,” Solovewicz said, according to Ars Technica.

He reportedly received injury reports from a city government, pizza-order confirmations, repair-service orders, school-platform account setup emails, and test-platform credentials. Ars reported that Solovewicz was notifying affected organizations but was not publicly naming them.

A generic no-reply address passes through application settings and delivers sensitive mail to an externally controlled domain

The raw totals make this more than a handful of stray password resets:

Domain Reported incoming mail
noreply.net 401,796 messages since December 2024
noreply.net attachments 28,365 attachments
noreply.us 37,255 messages over 2,345 days
Both domains, recent month More than 11,000 messages

Ars also reported that more than 14,000 From addresses sent mail to the two domains. That is consistent with a distributed configuration problem: copied deployment instructions, address-rewriting rules, old test settings, and services that substitute a generic domain when an employee or customer address disappears.

Generic noreply.net configurations created a durable mail sink

The clearest evidence for that mechanism is a 2012 Postfix setup guide that explicitly recommended setting myorigin=noreply.net. Its rationale was straightforward: use a valid-looking domain name to signal that a recipient should not reply.

That advice is exactly the sort of configuration that can outlive its author. In Postfix, myorigin helps determine the domain appended to locally posted mail that lacks one. Put noreply.net in a tutorial, deploy the tutorial unchanged, and a system can begin generating addresses at a domain its operator never owned. The mail server does not know it is a placeholder; it resolves and delivers mail as instructed.

The name had been used this way long before Solovewicz’s reported purchase. A 1998 Usenet post appeared from an address at noreply.net, with the poster saying the address had been forged to deter spam. A 2004 forum notification record used no@noreply.net.

Those examples do not prove that a particular company’s 2025 or 2026 messages came from the old Postfix advice, or from any other copied configuration. They demonstrate something narrower and important: for decades, noreply.net could plausibly be mistaken for a generic label rather than recognized as somebody else’s property.

A copied no-reply email setting propagates from an old tutorial through servers and applications into modern production systems

That distinction changes the remediation job. Organizations should not limit abandoned-domain monitoring to domains that once belonged to them. They also need an outbound-email inventory that searches application settings, mail-transfer-agent configuration, templates, test fixtures, address transformations, and vendor integrations for domains they do not control, especially deceptively generic ones.

A useful audit should identify:

  • domains used in sender and reply-to addresses;
  • domains inserted by mail-server settings such as myorigin;
  • fallback addresses used after account deletion or employee departure;
  • no-reply values embedded in application templates; and
  • external domains receiving attachments or account-setup messages.

The expiration story is not established

The “abandoned domain” label may be directionally useful, but it is not proven by the available evidence. A public domain-index listing shows a July 2011 registration date for noreply.net, yet that alone cannot establish whether the domain expired, dropped from registration, was re-registered, or changed hands in a private transaction before the reported 2024 acquisition.

Likewise, the available record does not independently verify Solovewicz’s purchase, the provenance of the messages, the number of affected organizations, or the validity of the credentials he said he received. The reported message counts, content, and notification campaign all come from Ars Technica’s account of Solovewicz’s findings, not from public incident disclosures by the senders.

That limitation does not rescue the configurations. If a production system emits sensitive messages to a domain it does not own, the error exists whether the domain was dropped, sold, inherited, or simply mistaken for an imaginary no-reply namespace. noreply.net is a reminder that “no reply” is a mailbox convention, not a reserved destination.

Key Takeaways

  • Cory Solovewicz told Ars Technica that noreply.net received 401,796 messages after his reported December 2024 acquisition.
  • The reported noreply.net mail included 28,365 attachments.
  • A 2012 Postfix guide explicitly recommended myorigin=noreply.net as a generic-looking no-reply configuration.
  • Public records show noreply.net-style addresses in use as early as 1998.
  • Available evidence does not establish that noreply.net expired before its reported 2024 acquisition.

Further Reading