# How I snooped into your private Slack messages [Slack Bug bounty worth $2,500]

Unclaimed MX records on team subdomains let an attacker claim them and intercept emails sent to Slack's Email app, reading private channel messages.

- Payout: $2,500
- Severity: critical
- Program: Slack
- Credited: Rojan Rijal
- Disclosed: 2016-09-13
- Write-up quality: 7/10
- Original: https://web.archive.org/web/20200817171403/https://whitehatnepal.tumblr.com/post/150381068912/how-i-snooped-into-your-private-slack-messages
- Library page: https://bugbountylibrary.com/r/blog%3Aweb-archive-org-web-20200817171403-https-whitehatnepal-tumblr-com-post-150381068912-how-i-snooped-into-your-private-slac
- Tags: domain:web impact:data-leak impact:integrity kind:bounty platform:blog sev:critical tech:email technique:recon vuln:misconfiguration vuln:subdomain-takeover

**Target:** Slack Email app integration / team subdomain MX records
**Root cause:** Team subdomains like teamname.slack.com had MX records pointing to a third-party email service where the domains were unclaimed, allowing anyone to register them and receive mail.
**Steps:**
1. Enumerate MX records for slack.com and observe third-party email provider.
2. Notice teamname.slack.com subdomains also have MX set to same provider and are unclaimed.
3. Upgrade to Standard plan, install Email app on a channel to get hashedtext@team.slack.com address.
4. Claim team.slack.com at the email provider and route all mail to attacker inbox.
5. Send/observe messages to hashedtext@team.slack.com being intercepted instead of reaching channel.
**How found:** Started from MX record recon on slack.com, noticed third-party email service with slack.com already claimed but team subdomains unclaimed; hypothesized emails to team domains could be intercepted, then confirmed via the Email app integration.
**Exploitation:** Attacker claims the victim team's slack.com subdomain at the third-party MX provider and configures routing to their own inbox, intercepting all emails addressed to the channel's Email app address; attacker can read, forward, or modify messages before the team sees them.
**Escalation:** Any team using the Email app is affected since all team subdomains shared the same unclaimed MX setup, enabling snooping across arbitrary teams.
**Insight:** Check MX/SPF records of per-tenant subdomains (teamname.slack.com) against the third-party mail provider's claim status; unclaimed tenant domains on shared mail infrastructure are a takeover/interception vector.