On Tue, Jul 25, 2017 at 9:59 AM, Kirk MacDonald <kirk.macdon...@corp.eastlink.ca> wrote: > In addition to what is mentioned in RFC2142, can anyone offer any resources > (or "best practices") for what can be considered "restricted" email > addresses/UIDs for a domain which offers mailbox service to the general > public? This would also be assuming the "restricted" email addresses are > otherwise valid in terms of length, characters, etc. > > I tend to think that UIDs which one could consider "vulgar" aren’t realistic > to restrict, since those types of feelings evolve over time and are subject > to personal and cultural bias (to say nothing of the wordlist/regex > complexity), but it would be interesting to know if there are addresses which > folks commonly feel fall into a role/reserved type of category and/or should > otherwise be restricted to the domain owners use (or no one's use).
Public certification authorities are allowed to use five mailbox names when verifying domain control for TLS/SSL certificate issuance. These are postmaster, hostmaster, webmaster, administrator, and admin. I would suggest ensuring these are controlled, so that there is not a repeat of https://arstechnica.com/security/2015/03/man-who-obtained-windows-live-cert-said-his-warnings-went-unanswered/ Thanks, Peter _______________________________________________ mailop mailing list mailop@mailop.org https://chilli.nosignal.org/cgi-bin/mailman/listinfo/mailop
