Address recycling / reuse

I must disagree here, imagine I die unexpectedly and cannot pay anymore, after some time anybody can just pretend to be me and re-register my mail address. Also when I registered an alias I got a lot of mails - now I know where it came from, I probably inherited spam from somebody else. Moreover, if somebody used the mail address for questionable activities, anybody registering this mail address again will inherit this legacy.

Please reconsider this policy.

You are losing customers because of this.

When I die, I don't want anyone who happened to know my email address to be able to recycle it and then use it to receive confidential messages or even gain access to my other accounts using password resets. Your current policy of temporarily blocking re-registration is ineffective because (even on the most expensive plan) it is far shorter than most services will wait before deleting inactive accounts.

To be clear, I don't even care if you recycle your regular @mailbox.org addresses. Perhaps you are concerned that if you never recycle you will quickly exhaust all of the short and easy-to-remember address and that's completely understandable. If that's the case, simply set aside a domain like @id.mailbox.org where all the addresses are randomly-generated gibberish like yn8r9ctb6s@id.mailbox.org and are never recycled. Since they're all random strings, none of them have any inherent value and you don't have to worry about running out of 'pretty' addresses. These addresses still work fine for third party 2FA and password recovery purposes where the 'prettiness' of the address is irrelevant but immutability is important for security.

I just finished evaluating email providers and mailbox.org was my number one choice were it not for this policy. However since address recycling is a deal-breaker for me I had to go with another option. I will probably still switch to mailbox.org in the future if you do end up implementing a solution.

The only reason I am not using Mailbox.org is this policy. I signed up to test and I'm impressed with the quality of the service.

But I can't allow a situation where my address can be re-registered by someone other than myself at any point.

Please re-consider this policy for all account types and I'll happily subscribe.

I feel the same. I am trying out mailbox and I really like it so far but I am only hesitant because of the email recycling policy. I can't risk having any of my emails go to anyone else in case my email is claimed by someone else. Considering how common my name is where I'm from, it is only a short matter of time before someone else claims it.

I understand that this is not a problem if I just keep using my mailbox account, which I plan to for a long time. However, I still can't risk it.

Thank you for all your efforts in providing an alternative but as it stands, I still cannot consider using it fully.

Hello,

thank you very much for your feedback and for addressing our address-recycle policy. The desire to block email addresses permanently is understandable from the user's point of view. However, this is not realistic in the long term for the operation of an email service with a fixed domain.

We work with a limited namespace. If all addresses ever used were permanently blocked, it would eventually be completely exhausted – even if the majority of accounts no longer existed. This would mean that no new customers could be accepted, even though sufficient technical and organizational capacity would be available.

That is why we pursue a controlled middle ground:

- Email addresses are not reused immediately.

- There are long blocking periods based on the duration of use.

The aim is to minimize the risk of misdelivery, data leaks, or account abuse as far as possible.

Permanently blocking all addresses that have ever been used would theoretically provide maximum security, but would mean that the service would no longer be economically and practically viable in the medium term. This is not a special case, but a fundamental limitation for all providers with fixed domains.

Our aim is therefore to strike a sensible balance between security, data protection, and long-term availability. In our view, the current regulation is the most responsible compromise between these requirements.

With kind regards

---

Felix Kaspar
Teamlead
mailbox Support

Useful Links:

• Knowledge Base for Private Customers
• Knowledge Base for Business Customers

Hi Felix,

Thanks for getting back.

Google have been blocking re-registration of addresses on Gmail since its inception in 2004, and it's a completely free service and the most popular in the world. Same with Microsoft and Outlook. A paid email service is never going to get even close to the volume of the aforementioned free alternatives, so how can they provide this guarantee but Mailbox.org can't?

On your final point, surely any responsible mailing service must prioritise security and data protection above all else? Enlighten me if you know otherwise but I am unaware of a single competing mailing service that operates with the recycling policy that you currently do.

The idea that I could have an email with yourselves for 10 years (on the light package), and have it re-registered by someone else after only 90 days of closing the account is madness.

Luke

Another mystery. :-) My account (registered in 2017?) displays "Deleted aliases are blocked from registration for 89 days.". But I have one deleted alias that is blocked until 2029/11/26.