Here is a list of addresses that you may want to treat as reserved:
- abuse 1,4
- admin 2,3,4
- administrator 2,3,4
- hostmaster 1,2,3,4
- info 1,3
- is 3
- it 3
- list 1
- list-request 1
- majordomo 4
- marketing 1
- mis 3
- news 1
- postmaster 1,2,3,4,5
- root 3,4
- sales 1
- security 1
- ssl-admin 4
- ssladmin 3
- ssladministrator 3
- sslwebmaster 3
- support 1
- sysadmin 3
- trouble 1
- usenet 1
- uucp 1
- webmaster 1,2,3,4
- Listed in RFC 2142 as a mailbox name for a common purpose
- Used by Comodo to issue SSL certificates
- Incorrectly used by RapidSSL to issue SSL certificates
- Treated as a reserved group name by Google Groups
- Listed in RFC 822 -- Standard for ARPA Internet Text Messages as a reserved address
This article suggests that you reserve all mailboxes that start with "admin", "administrator", "webmaster", "hostmaster", or "postmaster". If I were doing that, I would also add "ssl" to my starts with rule. Based on what RapidSSL did, it would make sense to implement an "ends with" rule as well.
RFC 822 also has the reminder that mailboxes are generally case insensitive. You should reserve lower-case, upper-case, and mixed-case versions:
Note: This reserved local-part must be matched without sensitivity to alphabetic case, so that "POSTMASTER", "postmaster", and even "poStmASteR" is to be accepted.
contact@
orsupport@
orcorp@
orceo@
potentially create a problem, among many others? You also have to think about email reuse (if one customer takes X, then delete it, can another one get it? Immediately or not?). The problem space is vast. You may need to specify how clients are to choose their emails, what kind of service they have, etc.