Expired DMARC Reporting Domain Exposes Fortune 1000 Infrastructure for $10

A cybersecurity researcher registered an expired DMARC reporting domain (gca-emailauth[.]org) for $10, which had been used in Global Cyber Alliance (GCA) training materials since 2019. After registration, they received DMARC aggregate reports from 86 domains across over 20 organizations, including 56 domains from The Toro Company (a NYSE-listed Fortune 1000 firm) and others from educational institutions, government agencies, and businesses. Most domains still published the expired endpoint alongside a functional reporting address, and only 21 domains removed it after disclosure. The issue stemmed from a former GCA partner who had let the domain lapse without documentation.