10

I am in the process of conceiving this idea of a webApp when can be termed as a completely new take for providing Email Service to the consumers on Domains that I own. The idea is similar to what Yahoo does by providing me myname@yahoo.com email address or the same with gmail etc. Apart from the whole infrastructure the main concern I have is how to have a list of critical / important and security related email addresses that are not given out to the consumer.

For Example:

  • admin@example.com
  • administrator@example.com
  • webmaster@example.com
  • root@example.com

Is there any kind of exhaustive list of this kind available.

Improve this question
4
14

Here is a list of addresses that you may want to treat as reserved:

  • abuse 1,4
  • admin 2,3,4
  • administrator 2,3,4
  • hostmaster 1,2,3,4
  • info 1,3
  • is 3
  • it 3
  • list 1
  • list-request 1
  • majordomo 4
  • marketing 1
  • mis 3
  • news 1
  • postmaster 1,2,3,4,5
  • root 3,4
  • sales 1
  • security 1
  • ssl-admin 4
  • ssladmin 3
  • ssladministrator 3
  • sslwebmaster 3
  • support 1
  • sysadmin 3
  • trouble 1
  • usenet 1
  • uucp 1
  • webmaster 1,2,3,4
  1. Listed in RFC 2142 as a mailbox name for a common purpose
  2. Used by Comodo to issue SSL certificates
  3. Incorrectly used by RapidSSL to issue SSL certificates
  4. Treated as a reserved group name by Google Groups
  5. Listed in RFC 822 -- Standard for ARPA Internet Text Messages as a reserved address

This article suggests that you reserve all mailboxes that start with "admin", "administrator", "webmaster", "hostmaster", or "postmaster". If I were doing that, I would also add "ssl" to my starts with rule. Based on what RapidSSL did, it would make sense to implement an "ends with" rule as well.

RFC 822 also has the reminder that mailboxes are generally case insensitive. You should reserve lower-case, upper-case, and mixed-case versions:

Note: This reserved local-part must be matched without sensitivity to alphabetic case, so that "POSTMASTER", "postmaster", and even "poStmASteR" is to be accepted.

Improve this answer
1
  • if you'd like to defer people to my answer below (with code example) that might be helpful, considering this can be quite confusing. – niftylettuce Feb 4 '20 at 8:36
2

This might be slightly related list, although its not for Gmail, but for Google Groups for G Suite:

https://support.google.com/a/answer/6093413?hl=en

Reserved group names:
We reserve certain names that cannot be used if you are creating a group using Google Groups or Google Groups for Business. However, you can use these names if you are creating a group using the Groups control in the Admin console.

abuse
admin
administrator
hostmaster
majordomo
postmaster
root
ssl-admin
webmaster

The names abuse and postmaster are reserved. You can, however, subscribe to them and receive all mail sent to these addresses.

Improve this answer
4
  • Thanks alot mate just the answer I needed. Just wondering, what majordomo stands for. Apart from the systesm names, I would also add the generic once like, sales, info, ceo , manager etc. But it is a long process. – Maharshi Raval Mar 23 '17 at 9:07
  • 1
    You are welcome :).. Just a long thought, do users have email addresses from single common english words also at Gmail? Like lion@, or aeroplane, or car. Am sure many of these can be instantly stopped if you enforce a minimum 7 letters username policy. Also, what about foul words? 7 word will stop dick@, but will not dickhead@ – DavChana Mar 23 '17 at 9:30
  • @MaharshiRaval majordomo = en.wikipedia.org/wiki/Majordomo_(software) – Steve Mar 23 '17 at 10:22
  • 1
    @DavChana yupp.. that makes a lot of sense. Would look into it , thanks a lot for bringing it up. Appreciate your time. – Maharshi Raval Mar 30 '17 at 10:24
2

Based off previous answers and my research elsewhere, I have compiled this GitHub repository which has an updated JSON file, as well as JavaScript/Node.js based code example for implementation.

https://github.com/forwardemail/reserved-email-addresses-list

List of 1250+ email addresses reserved for security concerns

npm install reserved-email-addresses-list email-addresses

The string you are comparing with must be converted to lowercase and trimmed of whitespace. The reason we are converting to lowercase is because the dictionary of words we are comparing with are all lowercase, and in order to compare for strict equality, we must have matching case.

It is also highly recommended that you check for strict equality, and for a list of admin-related usernames, you should check for strict equality, starts with, or ends with comparisons as well.

const reservedEmailAddressesList = require('reserved-email-addresses-list');
const reservedAdminList = require('reserved-email-addresses-list/admin-list.json');
const emailAddresses = require('email-addresses');

const email = '"Admin***!!!"@example.com';
const parsed = emailAddresses.parseOneAddress(email);

if (parsed === null)
  throw new Error('Email was not a valid address');

const str = parsed.local.toLowerCase();

let reservedMatch = reservedEmailAddressesList.find(addr => addr === str);

if (!reservedMatch)
  reservedMatch = reservedAdminList.find(
    addr => addr === str || str.startsWith(addr) || str.endsWith(addr)
  );

if (reservedMatch)
  throw new Error(
    'User must be a domain admin to create an alias with a reserved word (see https://forwardemail.net/reserved-email-addresses).'
  );

References:

Improve this answer
19
  • "The string you are comparing with must be converted to lowercase, trimmed of whitespace, and strictly converted to alphanumeric characters only." Technically the left hand side of an email address is under control of the receiving MTA and can be case sensitive, if that MTA so decides, so lowercasing email addresses by default can be a problem. Also now email addresses are internationalized, so not only ASCII. The regex in your code example would even disallow - or . in the email address! – Patrick Mevzek Jan 29 '20 at 21:33
  • I have fixed the example so it uses punycode toASCII. – niftylettuce Feb 3 '20 at 22:15
  • "I have fixed the example so it uses punycode toASCII." That handles only the RHS (that is the domain part), so it has no impact to the LHS, which is governed by EAI rules. – Patrick Mevzek Feb 3 '20 at 22:18
  • If you note in the example I have removed the conversion to A-Z,0-9 only. And the localpart is obvious in const str declaration. – niftylettuce Feb 3 '20 at 22:21
  • Also @PatrickMevzek - this is for comparison only to find the most accurate/likely match given people may try to abuse systems, such as writing admin1 or admin_. – niftylettuce Feb 3 '20 at 22:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.