Domain offline - are unmaintained email clients a security risk?

Question

I have just unregistered a domain. Now my mail client (Thunderbird) popped up a message saying that it cannot connect to the mail server. That's fine - for the moment.

However, I wonder what would happen when someone else registers the domain. Given the registrant would have an interest in attacking, would it be possible for him to figure out user name and password from a dangling client that repeatedly tries to connect?

Obviously, people would not immediately delete their mailbox locally. Perhaps there are still some mails to be archived or similar.

Is there some kind of "last action" a mail server can send to the client in order to prevent the mail client from connecting to a future server on the same name?

For my mailclient, Thunderbird does not have an option for disabling an account. I can also not delete the server name completely. It wants a valid server name. If nothing is entered, it will automatically choose the old name again.

Answer 1

If you have a domain that has handled important email for you, you need to keep it registered forever or at least until any email you might receive is completely useless.

An attacker can easily buy your old domain, setup a mail server to accept all mail regardless of whether or not the user exists, and accept any mail sent to you.

This means that s/he could send your bank a password reset request for example, accept the email, click on the link and steal your money.

There's no particular risk for your client software. The only risk I can see is that whoever owns the domain can accept and read your incoming mail.

Answer 2

Yeah, that's a remote possibility but it could be possible. If somebody register the domain and set up something to "listen" the requests, all the non-encrypted requests will be owned directly, and not sure about the encrypted ones. Probably too but this could need a more elaborated fake server to be created.