Sensitive Info Goes into 'No Reply' Emails Constantly. This Guy Sees It All

The researcher registered two domains intended as catch-all inboxes and quickly discovered that external systems were routing automated notifications to them. Over the course of more than a year the inboxes have accumulated close to half a million messages, many containing personal details such as injury reports, pizza orders, and credential setups. The volume and variety of data demonstrate that the misconfiguration is not isolated but occurs across many unrelated services.

The root cause is a common practice of using “no-reply” addresses as a sink for messages that are presumed unmonitored. When accounts are closed or when a system needs a placeholder, it often rewrites the user’s address to a domain like noreply.net, assuming the address will be discarded. Because the domain is publicly reachable, the email is delivered outside the organization, turning a harmless placeholder into a data-exfiltration channel.

For engineers responsible for email generation pipelines, this means that address handling logic must be audited for unintended external delivery. Replacing placeholder domains with internal, non-routable domains (e.g., using the .invalid top-level domain) or ensuring that address rewrites are confined to internal mail servers prevents the leakage. The change is a configuration update rather than a code rewrite, but it must be verified across all automated notification services.

Remediation costs are modest: purchasing a domain costs a few dollars, but the real expense is the time spent updating email templates, routing rules, and account-deletion workflows. Once the proper domains are in place, messages that would have been sent to the public placeholder will bounce or be absorbed internally, stopping the data flow. The fix does not apply to legacy external partners that still reference the old addresses; those messages will simply fail to deliver until the partners update their configurations.