Email Aliases and Masked Emails: Stop Spam and Limit Breach Damage

You have one email address. It is on your bank account, your medical portal, forty online shops, a gym you left in 2019, and a forum you posted on once. Every one of those companies holds it, and every one of them can be breached.

When that happens, the leaked address is not just a spam problem. It is the shared identifier that lets an attacker connect your accounts to one another, and the username half of every credential-stuffing attempt made against you. One address reused everywhere means one breach affects everything.

Email aliases — also called masked or forwarding addresses — fix this cheaply. Instead of one address everywhere, you give each service a unique one that forwards to your real inbox. If an alias starts receiving spam, you know exactly which company leaked or sold it, and you can switch that single alias off without touching anything else.

How Aliases Work

An alias is a distinct address that routes to your real mailbox. The company you gave it to never learns your actual address. From your side, mail arrives normally and replies can be sent so they appear to come from the alias.

There are three approaches, and they are not equivalent.

1. Plus addressing — free, instant, weak

Gmail, Outlook, Proton and Fastmail all ignore anything after a + in the local part. Mail to yourname+netflix@gmail.com lands in yourname@gmail.com.

Useful for filtering and for spotting who leaked your data. But the flaw is fundamental: your real address is plainly visible inside the alias. Anyone — including any automated list-cleaning script — can strip the suffix and recover it. Some sites also reject the + character outright. Treat plus addressing as an organisational tool, not a privacy one.

2. Masked-email services — the practical choice

Services such as SimpleLogin, Firefox Relay, DuckDuckGo Email Protection, Apple's Hide My Email and Fastmail's Masked Email generate random addresses like k7fq2p@relay-domain.com, each forwarding to your inbox. Nothing in the alias reveals who you are.

Every one of these can be deactivated individually. Turn off an alias and mail to it stops dead — no unsubscribing, no negotiation, no further contact. Most offer a free tier sufficient for a handful of accounts, with paid plans for unlimited aliases and the ability to reply from them.

Apple's Hide My Email is included with iCloud+ and integrates directly into Sign in with Apple, which makes it the easiest starting point if you are already in that ecosystem.

3. A catch-all on your own domain — maximum control

Own a domain and configure a catch-all, and every address at it reaches you without being created in advance: bank@yourdomain.com, shop@yourdomain.com, anything. You are not dependent on a provider staying in business, and you can move mail hosts without changing a single address.

The trade-offs are real: a domain costs roughly ten to fifteen dollars a year, there is DNS setup involved, catch-alls attract dictionary spam over time, and — importantly — the domain itself is an identifier that links your aliases together if it is registered in your name. This is the strongest option for control, not the strongest for anonymity.

Which Accounts Should Get Which

Aliasing everything on day one is how people abandon the system in week two. Split your accounts into three tiers.

Keep your real address for accounts where recovery is critical: your primary bank, government services, your employer, your password manager, and your domain registrar. These are accounts where a forwarding failure or a discontinued alias service would be genuinely painful, and where the support process for changing an address is slow.

Use a stable alias for accounts that matter but are replaceable: online shops, streaming services, airlines, utilities, subscriptions. This is the bulk of your digital life and where aliases pay off most.

Use a throwaway alias for anything one-off: a newsletter, a discount code, a whitepaper download, a trial, a forum registration. Delete these aggressively without a second thought.

Migrate gradually — new signups get an alias from today, and existing accounts get converted whenever you happen to log in. Trying to convert forty accounts in one evening is the fastest route to giving up.

Warning Signs an Address Has Leaked

• An alias you gave to exactly one company starts receiving mail from unrelated senders. That is definitive evidence of a leak or a sale, and it is the main diagnostic benefit of the whole approach.
• Password-reset emails you did not request. Someone has your address and is probing accounts with it.
• A sudden burst of unrelated newsletters — sometimes deliberate "mail bombing" used to bury a genuine purchase or transfer confirmation in noise. If this happens, check your financial accounts immediately rather than just clearing the inbox.
• Your address appearing in a breach notification service such as Have I Been Pwned.

Getting the Details Right

1. Record the alias in your password manager alongside the password, in the username field. An alias you cannot remember is an account you cannot recover. This single habit is what makes the system sustainable.
2. Check that replies work before relying on an alias for anything transactional. Some free tiers forward only inbound mail; replying from your real address quietly defeats the point.
3. Do not alias your account-recovery address. The address used to recover your password manager or primary email should be as simple and durable as possible.
4. Watch deliverability. A small number of sites block known relay domains, and a few banks reject them. Keep a fallback ready rather than fighting it.
5. Have an exit plan. If the service shuts down, how do you update your accounts? Owning your own domain solves this; with a third-party relay, keeping the alias list exported from your password manager is the mitigation.
6. Aliases are not anonymity. If you enter your real name, address and card details on the site, a masked email does not hide who you are. It limits linkage and spam — a genuine benefit, but a specific one.

If Your Real Address Is Already Everywhere

Most people are starting from this position. It is recoverable, in this order:

1. Check your exposure at haveibeenpwned.com to see which breaches already include you.
2. Secure the mailbox itself first. Your email account is the recovery route to everything else. Give it a unique long password and the strongest two-factor method available — a hardware key or an authenticator app, not SMS.
3. Audit forwarding rules and filters. A very common post-compromise trick is a quiet rule that forwards or auto-deletes messages containing words like "invoice," "bank" or "password." Check these now; almost nobody does.
4. Review connected apps in your account settings and revoke anything you no longer use.
5. Convert the highest-value accounts first — the ones holding payment details.
6. Use each conversion as a password reset too. If the address leaked in a breach, assume the password did as well.
7. Accept that the old address stays somewhat exposed. The goal is not to erase history; it is to stop adding to it, so that next year's breaches do not compound this year's.

The Bottom Line

A single email address used everywhere turns every company's security failure into your problem. Aliases break that chain: one leak affects one alias, you can identify the source precisely, and you can shut it off without any negotiation.

Start small. Pick a masked-email service, use it for the next ten things you sign up for, and record each alias in your password manager. Keep your real address for the handful of accounts where recovery genuinely matters. Within a few months the majority of your digital footprint will run through addresses you can revoke at will — which is a far better position than hoping every company you have ever dealt with keeps its database safe.