Using Catch-All Email - Beware

[jberryhill]

There is a significant contingent of domainers who use variations on the theme of "catch-all" email inboxes to find sales leads. I believe there may be one or two businesses premised on providing free or low-cost email services for that specific purpose, which have been discussed here in the past.

There are a couple of risks to doing that. What I have generally advised is that it is hard to hold a domain registrant liable for what they don't know and don't have. If, unknown to the registrant, there is some other similar domain name which is being used by another party for communications, then the registrant will not be accumulating mis-directed email containing potentially sensitive information if the name is not configured to receive email. If, on the other hand, the registrant receives mis-directed sensitive communications containing, say, financial information, health data, or trade secrets, then there are legitimate concerns about why the registrant is accumulating those communications and what the registrant is doing with the information.

In the worst case scenario, the collection of mis-directed email is intentional, as in:

https://www.adrforum.com/DomainDecisions/125751.htm

"As to Respondent’s purpose in doing so, shortly after having registered the <wfubmc.com> domain, actual confusion occurred and Respondent complied with Complainant’s request to forward misdirected email to Complainant. When Respondent was asked in May 2002 what his proposal would be for Complainant to acquire the <wfubmc/com/net/org> domains, he said he could provide forwarding services for $20/year/user, or for a flat fee of $5,000 annually per domain. He then stated: “In light of the opportunity costs, lost productivity, security risks and privacy risks that are continuously being incurred by the Institution with the status quo, I believe this to be a bargain. Of course an offer for complete acquisition would be considered”."

Where a domain is parked or otherwise lightly used for HTTP queries, the existence of an MX DNS record (as opposed to simply having no MX record) might indicate simply that the registrant uses the domain name primarily for email and does not particularly care about a web presence as, for example, is the case for johnberryhill.com. There are numerous UDRP cases in which a respondent's use of a domain name primarily for email has been found legitimate. e.g. <https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2020-1577>

But where the domain name is similar to a distinctive mark, and there is no substantial use of the domain name for a website, then the existence of an MX record may suggest that the respondent may be collecting mis-directed email addresses or even sending confusing email addresses:

https://www.adrforum.com/domaindecisions/1888544.htm

"First, Complainant contends that the <o‑iglass.com> domain name has been registered and used in bad faith because the original Respondent was probably preparing to use the disputed domain name in furtherance of an email phishing scheme and for other improper purposes. [...] Complainant argues that an “@o‑iglass.com” email address associated with the disputed domain name is potentially being used to impersonate Complainant and to send phishing e-mails to Internet users, presumably designed to solicit information under false pretenses."

That same point appears to have been made sua sponte in:

https://www.wipo.int/amc/en/domains/search/text.jsp?case=D2020-2754

"Furthermore, the MX records associated with the disputed domain name are openly available for view by the public and by the Panel. The Panel considers configuration of an email server on the disputed domain name as additional evidence corroborating Complainant’s assertions. More specifically, the disputed domain name contains in its entirety Complainant’s DEWBERRY trademark, and the record is devoid of any evidence to suggest that Respondent has any legitimate interest in sending emails from the disputed domain name. Respondent’s proactive configuration of an email server supports Complainant’s assertion that the disputed domain name creates a risk that Respondent would be engaged in a phishing scheme by using an email address impliedly associated with Complainant."

It is also true that some entities in the parking business cooperate with anti-spam organizations to provide anti-spammers with a feed of inbound email to parked domains, to assist in training automated spam identification and blocking systems.

However, the tendency of paranoid reasoning to track "I don't know what is going on, so it is probably something bad", and its application in UDRP jurisprudence as "here's a new hammer to beat anything that looks like a nail" mitigates against setting up passive email service for domains which are not going to be used for email purposes. I believe the open-ended "why is there an MX record for this domain" observation is an up and comer tool for finding bad faith use.

 

[HotKey]

Thanks. And wonderful.. another way to put the onus of protection against stupidity upon the owner rather than the user.

 

[WhoaDomain.com]

Thank you. Learned something new.

 

[developermat]

I've said this many times that it is a dangerous strategy to discuss "email leakage" with end users over a domain you are selling and also it's extremely unethical.

Setting up email catchalls for no other reason that to gauge, monitor, collect, read, forward is wrong (even though it may be interesting and easy). Just because you have a physical mailbox outside your house doesn't mean that you have the right to open and read every piece of mail that is put in there. If it is addressed to someone else you shouldn't read it. You should put return to sender on the front and put it back in a mailbox.

I once had someone send me a check, but they were off by a number in the address, the person actually deposited the check in their own account after signing the back with their own name and the bank clerk not checking it properly. Obviously this isn't ok, but when I spoke to the person how deposited my check, they said they they didn't realized and deposited it with a bunch of other checks.... No it isn't ok. It is a crime. It isn't cool to open people's mail and emails that are not intended for you and it's wrong that folks use catchalls for this purpose.

Also I think that there is an added ethical issue when folks stretch how much leakage of sensitive data is actually happening, to promote the value or a domain or "why a non-dotcom owner is making a mistake by not owning the dotcom version of their domain" - I believe this issue is hyped beyond reality by some to promote self interests.

 

[CraigD]

Pigeons.

The mail will always get through, except perhaps when they are having a coo.

 

[DuDD]

thanks for your sharing

 

[pb]

Some parking companies set up a MX record if you use their nameservers, for unknown purposes - I asked on two different occasions and they didn't answer. I asked to remove these records for my domains and they reluctantly did it. But setting them up in the first place is asking for trouble. Even if it's just a sinkhole / ddos mitigation (I don't know, I'm not an expert), they should at least be transparent about it, for domain owners' sake.

 

[jberryhill]

Some parking companies set up a MX record if you use their nameservers, for unknown purposes

I can't speak for all of them, but some of them provide the resulting data to outfits such as SpamHaus to train spam blockers.

 

[jberryhill]

And, here's another one:

https://www.wipo.int/amc/en/domains/search/text.jsp?case=DCO2020-0094

In August 2020, the Respondent contacted the Complainant via LinkedIn, stating in relevant part as follows:

“I own <Magna.co> domain name and I am reaching out to few companies to explore a possible sale of the domain name.

When I setup the email address for magna.co to contact potential end users, I started receiving business emails concerning your company (check attachment).

Would you be interested in owning this domain name to protect your business information and brand?”

The Complainant rejected this initial offer to buy the disputed domain name. The Respondent then sent another LinkedIn message as follows:

“Thank you for your reply. I thought its better that your company owns this domain name. In the last three weeks I got 350+ emails concerning your company.

Imagine your competitors American Axle & Manufacturing, Lear Corporation, Visteon, Faurecia, Linamar, Aptiv or Gentex owning the domain name and what information they can extract from the emails to gain advantage on your company. It can be a minor leak with serious consequences.

Once the domain is sold to an end user its very difficult and expensive to own. If you are reconsidering this matter, Visit magna.co and submit your offer.”

...

The Panel also finds it more likely than not that the Respondent set up a "catch-all" email address for the disputed domain name in hopes that emails intended for the Complainant would be misdirected to the Respondent and therefore to gain inappropriate leverage over the Complainant, and moreover improperly obtaining sensitive information intended for the Complainant.

 

[jberryhill]

Just because you have a physical mailbox outside your house doesn't mean that you have the right to open and read every piece of mail that is put in there.

That's brilliant.

 

[draco]

Have their been any UDRP cases based only on having a catch-all email? No threats, use of the information from the emails, etc. Atom has a catch-all option to use to find leads for domain sales. While I realize anyone can file a UDRP for any reason, I'm wondering if it could lead to the loss of a domain just because of the catch-all email?

 

[SixFigures.ltd]

I'm wondering if it could lead to the loss of a domain just because of the catch-all email?

It sounds ridiculous imo.

 

[jberryhill]

Have their been any UDRP cases based only on having a catch-all email?

Those are just quick "exact match" phrase searches. Not every decision in which it was a factor is going to use that exact phrase.

 

[jberryhill]

It's also worth noting that "based only on catch-all email" is an odd requirement. UDRP decisions are based on three criteria, which may themselves take into account a number of things. Sometimes it is a "totality of circumstances" situations, where it is not one factor in particular, but the cumulative weight of each straw on the camel's back.

What I can guarantee you is that where catch-all email is present as "a" factor among many, it is not going to be a helpful one for the domain registrant.

 

[Future Sensors]

What I can guarantee you is that where catch-all email is present as "a" factor among many, it is not going to be a helpful one for the domain registrant.

Any insights on how the existence of a catch-all email address was determined in those cases? Did the registrant happen to respond to (test) emails?

Sure, if no email is accepted for the domain, that's clear-cut. But when there's an MX setup (or an A record with a mailserver on that IP) and the mailserver accepts emails to several (test) addresses, you can't be certain about the internal handling of those emails. They could be silently read, discarded, or result in a response from the registrant.

Recently, I asked a new marketplace why they are accepting emails for all customer domains by default.

This was their response:

https://www.namepros.com/threads/domaineasy-com-official-thread.1336838/page-7#post-9270536

 

[jberryhill]

Any insights on how the existence of a catch-all email address was determined in those cases? Did the registrant happen to respond to (test) emails?

Great question. How about you read them and report back?

But when there's an MX setup (or an A record with a mailserver on that IP) and the mailserver accepts emails to several (test) addresses, you can't be certain about the internal handling of those emails. They could be silently read, discarded, or result in a response from the registrant.

If more than 5% of UDRP panelists knew what this means - "MX setup (or an A record with a mailserver on that IP)" - I would be shocked.

I did a search on "configured for email" so you can report back on these too:

Domain	Case	Date	Decision
mcdonaldhopkiins.com	NAF 2116496	2024-10-17	Transferred
nceivable reason for respondent apos s to register mcdonaldhopkiins com that does not infringe upon complainant apos s mcdonald hopkins mark the domain name is configured for email exchange and thus respondent apos s intent must be use the domain name to send spoofing emails respondent apos s use of a proxy service to hide its identity wh
refund-hmrcrepayments.com	WIPO D2024-3143	2024-10-09	Transfer
d to the complainant s services while pay per click ads exploit the complainant s reputation the complainant notes that the disputed domain name is technically configured for email communication as its dns zonefile contains mx and spf records suggesting potential use for email communications additionally the disputed domain name is listed
coccinellesupermarche.net	WIPO D2024-2440	2024-09-18	Transfer
proceeding that were registered in may 2024 composed of variations of the complainant s registered coccinelle supermarche or cocci market trademarks typically configured for email use but not yet associated with active websites or else parked for pay per click ppc advertising 5 parties contentions a complainant the complainant contends t
ussandoz.com	WIPO D2024-2720	2024-09-16	Transfer
s registered on february 12 2024 the respondent s landing page displays apparent links to third party commercial websites and the disputed domain name has been configured for email functionality 5 parties contentions a complainant the complainant contends that it has satisfied each of the elements required under the policy for a transfer
glenfiddich.site	WIPO D2024-3067	2024-09-09	Transfer
and casino games in indonesia the website has a download button that when clicked by internet users starts the download of an apk file the domain name has been configured for email communication at the time of drafting the decision the domain name resolved to an error website 5 parties contentions a complainant the complainant provides ev
bollor.net	CAC 106422	2024-05-07	Accepted (Transfered)
n 1997 and is used to operate its main website the disputed domain name bollor net was registered on april 4 2024 and is inactive on the web but mx servers are configured for email parties contentions the complainant s contentions are summarised below no administratively compliant response has been filed rights the complainant has to the
liquiddeath.site	WIPO D2024-0894	2024-04-26	Transfer
r a website selling the complainant s products without disclosing the lack of relationship with the complainant the fact that the disputed domain name has been configured for email correspondence only increases the risk of implied affiliation as internet users receiving communications from email accounts at the disputed domain name are li
westernflyerexpressllc.com	WIPO D2024-0376	2024-03-13	Transfer
mers as set out in the factual background section above mail exchanger mx records remain set for the disputed domain name thus the disputed domain name remains configured for email use and can continue to be used for fraud the disputed domain name is identical to the complainant s corporate name which the complainant has used since 1996 a
equinoroilandgass.site	WIPO D2023-5265	2024-01-29	Transfer
ted states where the respondent is based since 2019 the domain name registered in 2023 resolves to a holding page and is not in active use although it has been configured for email use with mx servers in a prior udrp case equinor asa v dollz james wipo case d2023 3026 another domain was pointed to the same holding page and mx servers 5 pa
davispolklatam.com	WIPO D2023-4547	2024-01-24	Transfer
ain name was registered on september 26 2023 the disputed domain name is not currently being used by the respondent in connection with an active website but is configured for email purposes and has been used in a fraud scheme exhibit k 5 parties contentions a complainant the complainant asserts that each of the elements enumerated in para
lastpass.co	WIPO DCO2023-0070	2023-10-02	Transfer
e domain name to distribute malware accessing the website via chrome led to a security threat detected warning the site that the domain name directs to is also configured for email capabilities 5 parties contentions a complainant complainant contends that i the domain name is identical or confusingly similar to complainant s trademarks ii
syngneta.com	WIPO D2023-3010	2023-09-25	Transfer
mx records this raises the possibility that the domain name may be used for fraudulent email communication this is a possibility as it is with any domain name configured for email usage but of itself not determinative of bad faith registration and use the cases cited by the complainant in support of this contention include statoil and sw
terravita.shop	WIPO D2023-3130	2023-09-01	Complaint denied
ant s other branding elements have been adopted the domain name is not flagged in the databases of any information security vendors the domain name is also not configured for email as mail exchange mx records are not set thus its potential usage for email based fraud is excluded without more the respondent s website could just as conceiva
aclvansix.com	WIPO D2022-4072	2022-12-28	Transfer
stead the disputed domain name resolves to a website indicating that it is a parked domain name despite being a parked page the disputed domain name is notably configured for email activity because mx servers have been established for the disputed domain name the panel finds that complainant has satisfied the requirement of paragraph 4 a
zakabel.com	WIPO D2022-4005	2022-12-19	Transfer
e complainant s trademark and why its use of the disputed domain name should be regarded as legitimate it should also be noted that the disputed domain name is configured for email communication and recipients of email originating from it may be deceived that that they are receiving communications from the complainant in view of the above
kimley-horn.info	WIPO D2022-3561	2022-12-02	Transfer
sputed domain name trading on the complainant s trademark and reputation in order to obtain pay per click revenue in addition the disputed domain name has been configured for email servers which may indicate the disputed domain name could be used for possible phishing attempts or some other illegitimate use especially given that the dispu
biontech.asia	WIPO D2022-3413	2022-11-10	Transfer
the udrp for registration of domain names containing the trade marks of third parties demonstrating a pattern of bad faith activity the domain names have been configured for email servers and so the complainant is also concerned about possible phishing b respondent the respondent did not reply to the complainant s contentions 6 discussio
saint-gobains.com	WIPO D2022-2181	2022-08-04	Transfer
nown of the complainant and its prior rights when the respondent registered the domain name the domain name has resolved to an inactive page but mx servers are configured for email purposes besides this the respondent has not demonstrated any activity in respect of the domain name it is not possible to conceive of any plausible actual or
kisqalihcp.com	WIPO D2022-1418	2022-06-10	Transfer
place a virus on the computer of an individual who is researching life saving treatment is particularly reprehensible further the disputed domain name has been configured for email servers which may indicate the disputed domain name could be used for possible phishing attempts or some other illegitimate use this is a terrible example of b
nescafe.email	WIPO D2022-0854	2022-05-18	Transfer
sputed domain name trading on the complainant s trademark and reputation in order to obtain pay per click revenue in addition the disputed domain name has been configured for email servers which may indicate the disputed domain name could be used for possible phishing attempts or some other illegitimate use especially given that the dispu
hartfordgrp.com	WIPO D2021-4156	2022-03-10	Transfer
ame the disputed domain name is also listed for sale on sedo com with a minimum offer of usd 100 additionally the disputed domain name hartfordgrp com has been configured for email servers and there is a possibility that the disputed domain name has been used or will be used for phishing or some other illegitimate use b respondent the res
gotowebinar.one	WIPO D2021-2899	2021-12-02	Transfer
021 and resolves to the complainant s official website a mail exchange mx record search for the disputed domain name revealed that the disputed domain name was configured for email capabilities 5 parties contentions a complainant the following are the complainant s contentions the disputed domain name is confusingly similar to the complai
arcelormittalgroup.co	WIPO DCO2021-0064	2021-09-29	Transfer
tered on august 3 2007 it owns arcelormittal com the domain name was registered on july 28 2021 the domain name does not resolve to an active site but has been configured for email use the name of the complainant s ceo has been used falsely in the whois contact details for the domain name 5 parties contentions a complainant the complainan
auth-lastpass.com	WIPO D2021-2186	2021-08-27	Transfer
e website complainant s concern was further heightened when an mx record search of the domain name system dns record indicated that the disputed domain name is configured for email capabilities given the construction of the disputed domain name notice of deceptive content at the website and the disputed domain name s email capabilities co
xiidralinsider.com	WIPO D2021-2149	2021-08-24	Transfer
in bad faith in acquiring and setting up the domain name when respondent clearly knew of complainant s rights finally complaint states that the domain name is configured for email which increases the risk of phishing activities b respondent respondent did not reply to complainant s contentions 6 discussion and findings under paragraph 4
7-11.co	NAF 1936902	2021-04-16	Transferred
spondent has also configured the disputed domain name 7 11 co domain for email referring to a screen capture of a unix computer session showing the domain name configured for email complainant submits that this is further evidence of respondent s bad faith use of the disputed domain name see the hlt group limited trading as holborn colleg
daciagroup.co	WIPO D2020-3315	2021-02-16	Transfer
was not registered and is not held by either of the complainants 4 5 it would appear that no website has operated from either of the domain names but each were configured for email use 4 6 on june 18 2020 the respondent received an email from domain sourhdi stating as follows i just bought recently the domain renaultt com and i received e
arnoldclrk.com	WIPO D2020-2940	2021-01-10	Transfer
ed to distribute unrelated software under a variant of the complainant s well known mark taking unfair advantage of the complainant s rights the domain name is configured for email purposes exhibiting potential for phishing b respondent the respondent did not reply to the complainant s contentions 6 discussion and findings a identical or
tangs-freres-fr.com	WIPO D2020-2471	2020-12-15	Transfer
nant and will assume that it is not functioning correctly which is damaging to its business the complainant also submits that the disputed domain name has been configured for email it refers to another domain name tangs freres fr which it says was used for a phishing email scam including the sending of emails impersonating the complainant
moorehousesofitel.top	WIPO D2020-0800	2020-06-08	Transfer
nd this has been true since the complainants discovered the domain name in november 2019 the registrar s whois record also showed that the domain name had been configured for email servers indicating that it could be used for phishing scams sending fraudulent emails impersonating the complainants even if it was never used for an associate
fidelity-int.net	WIPO D2019-1896	2019-10-10	Transfer
ich mon one page is festooned with the quote money is loved when they are held in safe hands and we love our hands what is not funny is that the domain name is configured for email a recipient of an email from an address ending in fidelity int net who then quickly inspects the home page prominently displaying a fidelity international logo

 

[jberryhill]

You see that one decision where the complaint was denied?

"the domain name is also not configured for email as mail exchange mx records are not set thus its potential usage for email based fraud is excluded"

So:

- lots of decisions mentioning email configuration and catch-all email as a negative factor (and, sure among many factors usually);

- one decision mentioning the lack of any email configuration as a positive factor.

Draw your own conclusions.

 

[jberryhill]

It sounds ridiculous imo.

Well, who can argue with that, right?

 

[Future Sensors]

Thanks for this @jberryhill

I'm in logo-creation mode for my domains right now, so diving into legal texts is a bit beyond my mental bandwidth at the moment. I appreciate the overview.

At first glance, relying solely on the existence of MX records as an indication seems overly simplistic, as evidenced by DomainEasy’s response. Hopefully, the additional details from my post will be useful in future cases when defending this aspect.

 

[jberryhill]

At first glance, relying solely on the existence of MX records as an indication seems overly simplistic, as evidenced by DomainEasy’s response.

Let me put it this way.... On those occasions where the operations of various service providers was relevant, and actual sworn statements about how their services functioned, would have come in handy in a UDRP proceeding, I have never encountered one - with only one exception - who was willing to provide one.

In Toros .com, the Complainant claimed the Respondent offered the domain name for sale to them at $37,500, however....

https://domainnamewire.com/wp-content/Decision-D2023-5383.pdf

Contrary to the Complainant’s contention that the Respondent offered to sell the disputed domain name to
the Complainant through the domain broker, Saw.com, for USD37,000, the Respondent has submitted a
declaration by the founder and chief executive officer of Saw.com, Mr. Gabriel, in which he declares that
Saw.com was never engaged by the Respondent to offer the disputed domain name for sale to the
Complainant. Instead, Mr. Gabriel declares that the Complainant approached his company to engage it to
attempt to buy the disputed domain name on the Complainant’s behalf. In order to demonstrate that the
price the Complainant proposed to offer was “unrealistically low”, Mr. Gabriel further declares that Saw.com
provided the Complainant with an appraisal from the appraisal tool on the Saw.com website. When
providing that “guide” to the Complainant, Saw.com specifically stated to the Complainant:

“It is difficult to estimate what price could be requested for the domain as the owner (we don't
own the domain) is the primary variable, but I've generated an appraisal for you to give you an
idea of what it could sell for.”

The Complainant has not sought to dispute the matters set out in Mr. Gabriel’s declaration.

But an unverified statement from an unidentified person on a website saying "Oh, we receive all the email, but we don't do anything with it" is kind of marginal.