Prevent Domain Takeovers — Audit `Email Alias` policy today!

“Several mailboxes on a post surrounded by trees in Muriwai” by Mathyas Kurmann on Unsplash

If you are an IT administrator of a major organization — academic or industrial, chances are you have come across enforcing an email policy at some point in your career at your organization.

For most organizations, on the technical side, typically for new hires, students, and staff members, the system auto-generates the new username, email addresses and alias(es). The process is something like:

Generate a unique Active Directory username (also serving as the primary email address) using a combination of initials and numbers.

As an example, for an incoming freshman John Smith, this would likely be js555@example.edu or jsmith555@example.edu along with john.smith@example.edu being assigned as their alias.

This is a commonly observed pattern at most educational institutions.

The IT administrators may, at their sole discretion:

• allow the user to create an alias which better represents their real name, or
• generate an alias for them resembling their real name, e.g. john.smith@company.com with the user having some discretion to request another alias through manual intervention with the admins.

While user discretion & agency are much valued tenets of Human-Computer…