Reading the article, there is a huge flaw in the autodiscover protocol by Microsoft. https://www.akamai.com/blog/security/autodiscovering-the-great-leak https:

Reading the article, there is a huge flaw in the autodiscover protocol by Microsoft. https://www.akamai.com/blog/security/autodiscovering-the-great-leak https://www.akamai.com/blog/security/autodiscovering-the-gre... According to it, it seems that if someone registers autodiscover.com then example.com lacking autodiscover.example.com will make Outlook try checking if autodiscover.com has an entry. It's just a braindead system.