HeadlinesBriefing favicon HeadlinesBriefing.com

Microsoft Autodiscover Misroutes example.com

Hacker News: Front Page •
×

A bug in Microsoft's Autodiscover service is redirecting the IANA-reserved `example.com` domain to Sumitomo Electric's mail servers. When configuring a dummy `[email protected]` account in Outlook, the service incorrectly returns IMAP and SMTP settings pointing to `imapgms.jnet.sei.co.jp` and `smtpgms.jnet.sei.co.jp`.

The misconfiguration appears hardcoded, not stemming from DNS records. A direct API call to Microsoft's `prod.autodetect.outlook.cloud.microsoft` endpoint confirms the faulty response, which includes a debug header showing the entry was manually added in February 2020. This has persisted for nearly six years across various networks and machines.

This bug poses a subtle security risk: test credentials sent to `example.com` could be intercepted by a third-party entity. It also highlights a systemic failure in Microsoft's internal data validation, where a reserved domain should never be assigned to a real service provider's infrastructure.