2

I saw a question a few days ago that talked about if a domain is bought by someone else then would the emails to that domain be compromised. And it got me thinking about google gsuite and specifically the use of the services like gmail, files, and photos.

Say my domain.xyz which is registered with gsuite expires and someone else buys it. If I remember correctly the administrator password of gsuite can be reset by using a DNS txt record on the domain. If someone else owns the domain now he can easily reset the administrator password.

With administrator access the new owner or lets say the intruder could easily have access to ALL USERS email/files/photos/etc in my company by resetting the passwords.

My question is:

  1. Is my observation correct?
  2. If it is, will the new owner of the domain get access to my entire companies or all employees files/emails in gsuite? Or will google clear everything?
  • Welcome! Could you elaborate on what you mean by "registered with gsuite"? Are you using google domain hosting, are you using emails with that domain for docs and photos and such as login information? Are you using gmail with that domain? – Tobi Nary Jan 8 at 10:06
  • @TobiNary sorry I’m not really sure how to ask it. Feel free to edit my question. What I meant is i have a domain like domain.xyz, then I register it with google to use all their services with my email@domain.xyz where I can also add members like my employees to employee1@domain.xyz. I can use all of google services by using my own email. Private emails, docs, photos of the company is all in this ecosystem. – majidarif Jan 8 at 10:13
  • To use the domain for google hosted email, google servers need to have at least an MX record, possibly more for SPF and co. on your domain. Since you didn't mention any of this I suspect that the domain is in fact google-hosted and it would (probably*) delete all associated accounts when the hosted domain is unregistered. *ask google support what their process is - we cannot possibly know. – Tobi Nary Jan 8 at 10:16
  • @TobiNary sorry I should have mentioned that my domain was bought with Godaddy. I set up an mx record to point to google. I’ll take time to reword my question later. – majidarif Jan 8 at 10:18
3

A couple of months ago I was searching google for the same questions, and I found that someone is providing the list of expired domains where free google legacy accounts are still active.

https://www.fiverr.com/share/DAPPA

I ordered that service and received a list of available domain names. All login pages for those domains were active but no login info was provided.

enter image description here

As per the guide provided by seller, anyone can reset admin user password by verifying domain ownership. But when I start the process by registering a domain name it was not like that, google asked me a lot of questions about account owner and old organization in order to give me the account access.

There were few recovery methods explained in the guide which were quite difficult to complete, I register 11 domains but failed to recover Gsuite accounts on all accept 3 with 500 users free license. It took me 3 weeks of research to succeed.

Conclusion:

Old Gsuite account recovery is a nearly impossible and quite difficult process but if you find any loophole or sufficient information about the previous account holder and his company details in archive web, you can reset admin password as I did.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.