A long time ago I set up a bunch of TLDs and started using those to host email addresses. It never occurred to me that if I sold those TLDs, someone could buy one, and if they guessed the email address I used then have access to all of the accounts that used that email address. Duh. I know all of the important accounts (I think), and can close or change them, but what if there are other accounts out there? Someone could just reuse my email [email protected] if they own tld.com, right?
-
1the problem is actually a little worse - they can set up a catchall and then wait for an email to identify the x@ - I've bought a few businesses and see this side of things often - including receiving email I should not be party to - so you are right to be concerned.– davidgoAug 20, 2020 at 0:09
-
1Real world snail mail has the same problem, that while a single unified mail system might support redirection there is nothing stopping someone sending mail or critical information via another carrier you haven't set up redirection with. There is no guarantee you will receive everything for that address. This is why standalone mail services like Google exist and also a good reason why they do not allow deleted accounts to have their addresses re-registered.– Mokubai ♦Aug 20, 2020 at 6:34
1 Answer
Someone could just reuse my email [email protected] if they own tld.com, right?
Correct. You should also be aware that catch-all mailboxes are a thing, so they don't even need to guess the mailbox / user name, they only need to have control of the domain / MX records.
How can I protect old email accounts when I sell a domain with an MX address?
Realistically, you can't prevent someone from receiving mail that is sent to a domain that they control.
If you have the option of Two-Factor Authentication, then this mitigates the risk somewhat, but many sites do not support this, and will permit password reset / account recovery with just a link that is sent to the registered email address.
... in summary, don't lose control of a domain that you've used to register important accounts or expect to receive sensitive / confidential emails on. Not a great solution to the question unfortunately, but as far as I know, "it is what it is"...