Why You Should Use Email Aliases
Email aliases refer to swapping your real email address with a stand-in that can forward emails to your primary inbox. This way, senders don’t need to know your real email to communicate with you, and you can easily decommission aliases if they are targeted by too much spam.
Email aliases have been a standard practice for users who have to communicate sensitive information and maintain a degree of privacy, like journalists, lawyers, corporate executives, and public figures who expect to be targeted by spammers and cyber attackers.
However, email aliases don’t replace real account security and won’t stop anyone from breaking into your account if they somehow find your real email address. Moreover, recent technological developments have made email aliases harder to maintain due to deliverability issues and data leaks.
Why Your Email Aliases Need a Strategy
Email aliases hide your real address from the recipient, but not from your email provider or anyone determined to cross-reference your details from leaked data. So, if you use the same alias everywhere or route every email to the same inbox without other safeguards, your email only looks private.
Determined attackers can and will find ways to exploit that single point of failure. Then, there’s the other issue that no one warns you about: most modern email services have built-in identity verification and will send shared alias domains straight into spam.
If you want to get around this, not only do you need to set up your own custom domain for email aliases, but also properly configure your domain with authentication protocols like SPF and DKIM.
Segment Aliases by Service, Not Only by Relationship
Most users prefer to maintain a bunch of aliases dedicated to different relationships, like one for personal emails, one for their work colleagues, one for scheduling meetings and appointments, one for streaming services, and so on.
This works fine as a convenience hack to keep your inbox clutter-free, but it doesn’t insulate an alias if one of the services or applications associated with it experiences a data breach. For example, if you had a single email alias that you relied on for all your banking and financial activity, Experian’s infamous 2015 data breach could have compromised all your financial services using that single vulnerability.
Privacy-conscious experts recommend maintaining a separate email alias for each service, such as one for Netflix and a completely different one for Apple TV, then bundling them under a single subdomain on your custom domain that’s specific to streaming services. That means your Netflix alias ends up looking something like streaming+netflix@yourdomain.com.
Don’t Rely on ‘Plus Addressing’ if You Want Privacy
A common way to generate email aliases is to simply add a + sign next to your real email, such as yourname+alias@gmail.com. This is fine for decluttering your inboxes, but doesn’t actually secure your email address because anyone can guess your real email address by removing everything after the + sign.
Instead, it’s better to use a combination of randomly generated words or hashkeys. If someone sees an email alias that reads yourname_random123@gmail.com, that doesn’t do anything to help them figure out the other email aliases on that same domain.
Use a Custom Domain if You’re Going All-In on Aliasing
Relying on your alias provider’s shared domain, like @simplelogin.io or @gmail.com, is problematic for at least a couple of reasons. For one, it makes it near-impossible to divest from that domain if you ever want to switch to a different email or alias provider.
Whereas if you use a custom domain, you can just point that domain to your new aliasing service if the old one is no longer safe or convenient. But aside from being locked into an email or alias service, you may also hurt your deliverability rates: a lot of these domains have poor spam scores that don’t pass most inbox filters.
With a custom domain, you can set up your own domain authentication via SPF, DKIM, and DMARC. That way, inboxes assign you a separate spam score based on your own email activity, not the collective behavior of everyone else using that shared domain.
Pay Attention to the Email Headers
Here’s what happened with people using the Hide My Email service in Apple Mail before July 7: normally, Hide My Email generates a random two-word alias to conceal your real email from recipients, but due to a technical flaw, an attacker could easily uncover your real address by targeting your inbox with spam mail.
They would simply spam your alias and wait for Apple Mail’s filters to respond back with a rejection notification, which would contain your real email address right there in the email header. Whenever you receive an email forward from your aliasing service, expand the header section to make sure your real address isn’t revealed in the email metadata.
If you see a ‘Forwarded-To’ field with your real email in the message header, that means you have a leak. Back up your alias lists frequently, as many providers bundle their email aliases with a password manager for easy access management, but that comes with its own risks.
Several users on the Privacy Guides forum note that they accidentally deleted all their SimpleLogin aliases when trying to clear the Proton Pass logins associated with those accounts. Apparently, Proton has an auto-sync feature connecting the two services that works both ways.
