# DNS Setup allows sending mail on behalf of other customers

Hey.com recycles expired addresses while Help Scout retains SPF/DKIM send authorization, letting an attacker spoof recycled hey.com addresses via their own Help Scout inbox.

- Payout: hidden
- Severity: medium
- Program: Basecamp
- Found by: aisforarray
- Disclosed: 2021-02-21
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/981824
- Library page: https://bugbountylibrary.com/r/h1%3A981824
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:email technique:chained technique:recon vuln:business-logic vuln:misconfiguration

**Target:** Email/SPF/DKIM sending infrastructure (Help Scout custom inbox)
**Root cause:** hey.com delegates SPF sending to helpscoutemail.com for the whole domain, and Help Scout verifies address ownership only once; Hey.com then recycles the address to a new owner while the old Help Scout inbox retains send authorization.
**Steps:**
1. `dig hey.com txt` reveals `v=spf1 include:_spf.hey.com include:helpscoutemail.com -all`
2. Create Help Scout trial inbox, add custom address `victim@hey.com`
3. Sign up for hey.com trial with `victim@hey.com`, receive Help Scout verification email, complete verification
4. Cancel the hey.com trial; wait 30 days for address recycling
5. Victim (or anyone) re-registers `victim@hey.com` on hey.com
6. Send mail as `victim@hey.com` from the retained Help Scout inbox; SPF/DKIM pass
**How found:** Recalled Basecamp used Help Scout for support, ran `dig hey.com txt` to check SPF, spotted `include:helpscoutemail.com`, then reasoned about Help Scout's one-time address verification vs Hey's 30-day address recycling.
**Exploitation:** Attacker keeps a Help Scout inbox verified for a hey.com address, lets the address be recycled to a new owner, then sends authenticated mail impersonating that address; CCing an owned address captures replies.
**Escalation:** Impersonate high-profile individuals (e.g. DHH) to scam correspondents; reply-all capture via CC.
**Insight:** When a target delegates SPF to a third-party SaaS, check whether that SaaS verifies address ownership only once while the target recycles addresses or aliases — the stale authorization becomes a spoofing primitive.