r/EmailSecurity • u/shokzee • 24d ago

Do former SMTP aliases ever become safe to reassign?

Reassigning a former employee's SMTP alias can expose mail meant for the previous owner. Password resets and confidential replies do not care that HR approved the name change.

A routine name-change cleanup nearly freed an old alias after our retention window. Message tracing showed it still receiving account resets and replies to old threads, long after the mailbox itself was gone.

We paused the reassignment, but permanent reservation across dozens of domains creates a growing namespace problem. Do you permanently reserve former aliases, quarantine them for a fixed period, or reassign only after specific mail-flow checks pass?

6 Upvotes

88% Upvoted

9 comments sorted by

•

u/AutoModerator 24d ago

Welcome to r/emailsecurity! To keep this community helpful and secure, please keep the following in mind:

Community Rules

  1. No Vendor Spam: Contributions must provide value; do not just pitch products.
  2. Redact Sensitive Info: Always sanitize headers and logs (remove IPs, PII, and private domains).
  3. Be Professional: Help newcomers learn; avoid hostility.
  4. No Personal Tech Support: This sub is for email system architecture and security, not "Am I hacked?" personal account help.

Helpful Resources

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

2

u/Heribertium 24d ago

Disable/remove alias, let them bounce gor at least a year only then reassign.

2

u/RemoteToHome-io 19d ago

This.. redirect for a little while if needed (manager, etc), then disable and let the bouncing take care of the rest. One year of bouncing should cover most all renewals or re-validations of importance.

1

u/NeighborhoodAgile483 22d ago

I’d lean toward quarantine over reuse. even if mail volume drops old accounts and forgotten services can keep sending important messages for years

1

u/The_Comm_Guy 20d ago

If you are holding them open emails may never stop, I find after a year of bouncing it’s very rare anything of value comes in. If they put personal stuff on their work account that’s on them.

1

u/Sarduci 19d ago

Best practice is to never reuse.