Did You Realize noreply.us and noreply.net Are Real Domains?

Not Everyone Does; Those Emails Do Go Through

We’ve all fed fake email addresses into websites that demand you give them one but don’t require you to verify it.  Companies do the same, filling in the From: field on their automated emails with some variety of noreply in the email address.  If the address provided to customers is inside of a domain you own, for example noreply@pcper.com, you and those you email are safe.  However if you are depending on something like newsletter@oreply.com then you are in for a nasty surprise; that domain exists and your email will end up being delivered to somewhere you do not control.

The good news is that both the noreply.us and noreply.com domains are owned by an ethical security researcher who is not taking advantage of the information contained in the hundreds of thousands of emails that end up on his mail server.  The contents of the emails his two noreply domains get would be a gold mine for a less principled owner as many of these emails are not simply a demand for someone to stop spamming them.

This is not new, indeed back in the ancient time when Brian Krebs worked for Washington Post he tried warning people about a similar address that was being used improperly.  The .invalid domain is a real thing and guaranteed to be a proper disposal for unwanted email replies as it is not and never will be a valid domain.