Are e-mails that have a name slightly different from the web page legitimate e-mails?

Question

I usually receive e-mails from an organization called Change.org, that is a site for create on-line petitions (it's site is https://www.change.org/).

The thing is, they send me e-mails with suggestions about petitions to sign in, but the sender's email is change@f.change.org. I started to think about this e-mail and I'm thinking if it's a legitimate e-mail or not, because the "@f.change" part in the sender's email. Why there is a "f."? Shouldn't it be just change@change.org?

I realized a lot of emails don't have exactly the same name of the web page. Is this a thing about the e-mail services that organizations or enterprises use or is a signal that is a phishing e-mail?

Answer 1

These can sometimes be threats, but not this time. That's probably a legitimate Change.org email.

---

There are two related concepts here.

The first is subdomains, children of the main domain that can designate different servers. Techniques like domain shadowing can facilitate subdomain abuse at scale when an attacker gains access to the system used to assign their own subdomains. Of course, a bad actor can also take over an existing host with a direct attack.

The second is cousin domains, aka look-alike domains, such as homograph attacks (like paypa1.com or pâypal.com) or combosquats (like paypal-support.com) or doppelgangers (like wwwpaypal.com) or typosquats (like papyal.com).

In this case, you gave f.change.org as "slightly different from" change.org. That's a subdomain unless you've got a non-ASCII character hiding in there (which would be an IDN homograph attack), so it's either legitimately from change.org or it's hijacked in some manner like domain shadowing.

I bet if you check the email, it passes DMARC, which will prove that it was sent by change.org (whose DMARC record does not specify aspf:s or adkim:s and therefore has relaxed alignment, meaning f.change.org matches change.org as noted in RFC 7489.

Answer 2

First, let's define something: change.org is a domain name. example.com is a domain name. something.example.com is a subdomain (something) under a domain name. You can think of it like an address where you say the house number, then the street, then the city, then the country. And sometimes you can omit some details from the address, so not every domain needs a subdomain.

---

Emails from completely different domains could also be legitimate emails. There are some companies that have a domain just for email and one for the website domain.

Some even use separate companies to send emails.

Both of these practices can make it very difficult for people to determine which email is legitimate and which is fake. Most companies are trying to make it easier for people by using the same domain.

What makes an email source legitimate is the intent of the company. And if a company makes that intent unclear, it creates confusion. People end up contacting the company to confirm that the email is legitimate. (and if you do, ask the company to fix the confusion they created).

This email, however, isn't really doing anything strange. The subdomain name is from the same domain that no one else shares. So,

• www.change.org
• mail.change.org
• f.change.org

would all be the same "place". This gets tricky, however, if the domain is shared with lots of people, but for Change.org, it's just them.