Seven Ways to Make Your Email Aliases Even More Secure
Using email aliases was once a niche privacy measure. However, they are now a common solution offered by many major email services, including Apple, DuckDuckGo, SimpleLogin, and Firefox. Creating and running a simple alias to hide your real email address has become easier than ever, but given recent data breaches and sophisticated cyberattacks, it’s becoming increasingly clear that basic setup isn’t enough.
That’s why cybersecurity experts now recommend using a well-thought-out email aliasing strategy, combining multiple aliases and strong authentication protocols to protect your real email from prying eyes. As a journalist who often covers sensitive topics related to security and compliance, I’ve been using email aliases for nearly a decade. Here are a few tips that have saved me a lot of time and effort protecting my privacy.
Why Use Email Aliases
Email aliases replace your real email address with a fake one that can forward emails to your primary inbox. This way, senders don’t need to know your real email address to contact you, and aliases can be easily disabled if they’re being spammed excessively.
Using email aliases has become standard practice for users who need to transmit sensitive information and maintain a certain degree of privacy, such as journalists, lawyers, corporate executives, and public figures who expect to be targeted by spammers and cybercriminals. However, they are no substitute for real account security and will not prevent anyone from hacking your account if they somehow manage to obtain your real email address.
Furthermore, recent technological developments have made maintaining email aliases more difficult due to delivery issues and data leaks. Using email aliases to ensure inbox privacy is still acceptable, but now that spammers have become much more sophisticated, you need a real strategy to maintain your privacy.
Why Your Email Addresses Need a Strategy
Using email aliases hides your real address from the recipient, but not from your email provider or anyone else who might link your data to leaked information. Therefore, if you use the same alias everywhere or forward all emails to the same inbox without other security measures, your emails will only appear private. Determined attackers can and will find ways to exploit this single vulnerability.
There’s another problem no one warns about. Most modern email services, including Gmail and Outlook, have built-in authentication and flag alias domains directly as spam. To get around this, you need to not only set up your own domain for email aliases but also properly configure it using authentication protocols such as SPF and DKIM.
Finally, your email alias provider could be compromised, allowing your forwarding address to be accessed via email headers, as happened with Apple Mail. Alias providers may also have other vulnerabilities, such as the non-functional sync features in ProtonMail , which many have complained about. Therefore, relying solely on one provider without setting up your own domain is a serious warning sign.
Obviously, you need to plan your email alias strategy from the start to avoid important emails being missed, ending up in your spam folder, or having private messages leaked due to poor technical implementation by your email provider.
Segment nicknames by services, not just by relationships.
Most users prefer to use multiple aliases for different interactions, such as one for personal email, one for work colleagues, one for scheduling meetings and appointments, one for streaming services, and so on. This works well as a convenient way to keep your inbox organized, but it doesn’t protect the alias from data leaks in one of its associated services or apps.
For example, if you had one email address that you relied on for all your banking and financial transactions, the infamous Experian data breach in 2015 could have compromised all your financial services by exploiting that single vulnerability.
Privacy experts recommend using separate email addresses for each service—for example, one for Netflix and a completely different one for Apple TV—and then combining them under a single subdomain on your own domain dedicated to streaming services. This means your Netflix email address would look something like [email protected] . This way, if one platform is hacked, your other email addresses for similar services will remain private.
You shouldn’t rely on “additional addressing” if you want to ensure privacy.
A common way to create email aliases is to simply add a “+” sign next to your real email address , such as [email protected] . This is great for tidying up your inbox, but it doesn’t actually ensure the security of your email address, as anyone can guess your real address by deleting everything after the “+” sign.
Instead, it’s better to use a combination of randomly generated words or hash keys. If someone sees an email alias that looks like [email protected] , it won’t help them identify other email aliases on the same domain. This is especially useful if you don’t yet have your own domain and rely on a generic domain from your email provider or alias service, as such domains are even easier to guess.
Use your own domain if you plan to make extensive use of aliases.
Using your alias provider’s shared domain, such as @simplelogin.io or @gmail.com, is problematic for at least several reasons. First, it makes it virtually impossible to abandon that domain if you ever want to switch to a different email or alias provider. Meanwhile, if you use your own domain, you can simply redirect it to your new alias service if the old one becomes unsafe or convenient.
But beyond being tied to an email service or alias service, this can also negatively impact deliverability rates: many of these domains have low spam scores and don’t pass most incoming message filters. With your own domain, you can set up domain authentication via SPF, DKIM, and DMARC . This way, mailboxes will assign you a separate spam score based on your individual email activity, rather than the collective behavior of all other users of that shared domain.
That’s why a custom domain is a worthwhile investment if you want to continue using email aliases as a long-term privacy strategy. You gain greater control over your data and can configure enterprise-grade security features unavailable with free shared domain email accounts.
Pay attention to email headers.
Here’s what happened to users of Apple Mail’s “Hide My Email” service before July 7: Typically, “Hide My Email” generates a random two-word alias to hide your real email address from recipients, but due to a technical vulnerability, an attacker could easily discover your real address by spamming your inbox. They would simply send spam to your alias and wait for Apple Mail’s filters to respond with a rejection notice containing your real email address right in the email header.
When receiving forwarded emails from your alias service, expand the header section to ensure your real address isn’t showing up in the email’s metadata. (In Gmail, this is the small drop-down list next to the recipient’s name at the top of the email.) If you see a “Forwarded to” field in the message header with your real email address, you’ve been leaked.
Back up your alias lists regularly.
Many providers integrate their email accounts with a password manager for easy access control, but this comes with its own risks.
Several users on the Privacy Guides forum report accidentally deleting all their SimpleLogin usernames while attempting to clear the Proton Pass accounts associated with them. Apparently, Proton has an automatic sync feature between the two services that works both ways. The situation is even worse if you don’t use your own domain, as these usernames will be lost forever unless you recover them.
Regularly back up your list of email aliases in a text document or spreadsheet so that if you delete one, you can create new ones with identical names and prevent important emails from being missed.
Before decommissioning, remove old email addresses by destroying them.
Many email providers retain records of deleted accounts for months or even years to comply with legal requirements. This makes them a common target for data brokers who seek to harvest any useful information from these accounts. Fortunately, there’s a simple solution.
Before deleting an old email account or alias, be sure to replace all personal information associated with it with random values. This includes your name, address, date of birth, and any payment information that could be used to identify you.
Use a backup communication method that does not have aliases.
Many popular email services, such as Gmail and Outlook, tighten controls on the use of aliases, so situations often arise where using an alias for communication is simply impossible. Many email accounts have spam filters that reject emails sent from random aliases or refuse to honor forwarding requests from your alias provider. This also has a cumulative effect, as the more email services reject emails from an alias, the worse it impacts your alias’s reputation and deliverability rates.
For banking platforms, important parcels, legal notices, and other priority emails, it’s recommended to use a separate email address that isn’t hidden behind an alias and doesn’t require forwarding. This can serve as a backup option in situations where missing a message is simply unacceptable.