8 ms·
I've been using this pattern for years. I have a custom domain just for signups, and I sign up with [service].[username]@customdomain. The domain simply has a
by the_duke 5y ago
I've been using this pattern for years.
I have a custom domain just for signups, and I sign up with [service].[username]@customdomain. The domain simply has a catchall email "accounts@customdomain"
Combined with a password manager (Bitwarden) this is absolutely brilliant.
* Spam: if I get any spam, I know exactly which company is responsible, whether directly, through selling user data or because of breaches. And I can simply block the whole alias.
* Multiple accounts: If you need a second account with some service, you simply use a new alias. No need to worry about secondary emails just for a few accounts.
* Mitigate data leaks: if some database gets compromised, all they get is a throwaway email. They also can't try to log in to other accounts or do password resets if they get a hold of the password. (somewhat redundant with a password manager and unique passwords, but still)
* Privacy: all those ad data aggregators have a harder time connecting me between accounts. (of course they still use names, address, credit card info, etc; but it helps)
* Easy self-hosting: email hosting can be a pain. But in this case you only need to receive, never send. And receiving basically always works, even with the most broken email server setup.
A downside is the unique domain name. I always wanted a shared domain with lots of users to further reduce exposure.
I actually thought about starting a service that provides this, but it's a niche product with non-trivial technical hurdles and potentially lots of support demands, so I'm happy that Mozilla is offering this.
The only downside is that people get really confused when they have to deal with your email, for example when calling support. But it's never been a real issue.
Highly recommended!
- ryanjshaw 5y agoWord of advice for anybody doing this: make sure you have a way to SEND email using one of your aliased addresses - because one day you will find a critical service provider can't process your emailed attachments unless sent from your registered email address (e.g. insurance claim document, bank documents, etc.)
- nathancahill 5y agoIf it's handled by Google Workspace, it's easy to add additional "Send as" addresses.
- discardedrefuse 5y agoI do what OP does and your comment gave my cause for concern. I just checked with my email provider and, luckily, it seems I can create Send Identities to solve this issue. Thanks for bringing this to my attention though!
- jlund-molfese 5y agoAnd make sure you can easily fetch new emails on demand! I had a Migadu-Gmail setup, but the Gmail app and mobile site only pulled from the POP3 server every 30 minutes or something. Which was fine until I had to verify my identity in-person at a Verizon store to cancel service and had to explain why I wouldn't be able to receive a verification email to verizon@mydomain for a while. Also annoying for my 401(k) which uses SMS for 2FA and makes the codes expire after 2 minutes. Since then I've switched to a custom domain with iCloud, which unfortunately doesn't support catch-all addresses at all, but is more reliable and faster.
- pizzapill 5y agoYou can manually fetch emails from external accounts via the Gmail settings - Accounts. I'm not sure if this is available in the app but it's available on the (desktop) page. It's a hassle but there is a way in tight situations.
- deleted 5y ago[deleted]
- the8472 5y agoThunderbird supports custom From: addresses in the mail compose window.
- e12e 5y agoBut, your mail might bounce without proper sfp setup. (preventing random from like in the good old days (president@whitehouse.gov) is pretty much the raison d'être for sfp... For better or worse).
- the8472 5y agoThat's not relevant for the discussion in this thread where we already assume you have a custom domain with catchall inbox setup. The custom From is still needed to be able to actually send from any address on that domain.
- e12e 5y agoYes, and part of that setup is proper sfp setup? Eg allow sending from Gmail with a from on your domain?
- the8472 5y agoI don't see how it's specific to sending from thunderbird. It's a general issue if you want to use a domain for mailing.
- e12e 5y agoIt's not spesific to the mua, no. But as thread starter (ed: first responder) said: > Word of advice for anybody doing this: make sure you have a way to SEND email using one of your aliased addresses So a) you need a mua like thunderbird that let's you set FROM header - and b) your domain need to be setup to allow your smtp server(s) to send from your domain (sfp).
- psd1 5y ago
- propogandist 5y agofastmail supports this, but only if using their [web] app or website.
- greenail 5y agoyou can make unique addresses so they can be transparently replied to in any mail reader (including gmail/web). It takes a bit of work but is worth it. I've been using the system I built to do it for over 5 years.
- pylon 5y agoOut of curiosity, is your customdomain in this case something without any personal info on it? I have a custom domain with my first name and last name initial .com, but now I'm thinking if I want this setup, maybe it's better off getting a domain with random words so even if email leaks, no personal data is leaked.
- WA 5y agoNot OP, but same setup. I have a custom domain that has a generic name. Not entirely random just in case I ever have to spell it out or something, but no PII in the domain name. Also, Whois privacy service through my registrar.
- e12e 5y agoI'm not currently using it (took down my opensmtpd server.. Haven't replaced it yet) - but I used a subdomain on a vanity domain (in my case things like hn@s.hypertekst.net). If I need a "new" domain, I can just move to another (r.hypertekst.net - s for spam, r for registration... Etc).
- brucecandoli 5y agoFastmail has recently provided masked email too: https://www.fastmail.help/hc/en-us/articles/4406536368911-Masked-Email https://www.fastmail.help/hc/en-us/articles/4406536368911-Ma...
- mattlondon 5y agoSimilar here. Instead of using the same email address and different password per site, I use my "burner" domain so foo.com@burner and just use the same password for everything. Nothing to remember for a login - just the domain name and the usual password. For "important" things (anything with money or PII etc) I use a unique password + bitwarden
- chrisjc 5y ago> of course they still use names, address, credit card info, etc I haven't used this service, only heard about it. It might cover your missing piece for credit card info. https://privacy.com/ https://privacy.com/ Of course, privacy.com ends up being the one that can aggregate your CC information together.
- stavros 5y agoI've been using this service for years and love it.
- encryptluks2 5y agoI ended up choosing Abine Blur. The interface isn't as nice, but it seemed more security-focused. Privacy.com seemed to actually collect a lot of information and prevent you from removing it later on.
- vxNsr 5y ago> Abine Blur So, I just googled them, they look interesting but their website seems intent on obfuscating what they do, it uses a lot of marketing speak but doesn't tell me how it works. Are you able to use your own domain for the "email masking"? Are you giving them your bank info for the credit card masking or are they billing the credit card on file?
- encryptluks2 5y agoI'm not sure om the first question because I use SimpleLogin for email masking instead, but the second one it is advised to use your bank info so there are no fees. The plan I am on I get unlimited masked cards as long as I use a bank. There is a fee to use a credit card. There is a minimum amount per masked card of $10 but you can immediately request a refund once you use whatever amount or if they just pre-authorize something.
- neogodless 5y agoThis is almost identical to my approach. One minor difference is that I got on the free Google Apps for Business plan a decade or so ago. So deliverability is there, which does come up from time to time. i.e. Occasionally you need support, and the service wants you to email them/reply to their email from the email you use with their service. So in Gmail, I have to set up an account/alias so I can send the email. I did self-host this way back, using MailEnable on Windows Server. It... worked. But I don't recommend it! The other downside is that the catch-all sometimes gets a lot of [gibberish]@[customdomain]. It's not too bad now, but there was a period where gibberish hexidecimal aliases were spammed regularly.
- csmpltn 5y agoYour single point of failure is your account at your registrar, where your domain can be hijacked. Once your domain is taken over - all of your accounts which are connected to this domain are also owned. So you're still only one hack away here.
- neogodless 5y agoThat is accurate for any and all approaches with email, but it does not negate the (significant) incremental improvements this strategy grants you.
- csmpltn 5y ago> "That is accurate for any and all approaches with email" The likelihood of a takeover of @gmail.com or @icloud.com is much lower though.
- the8472 5y agoInstead those can just cancel your account without explanation or recourse. With a registrar you have a contractual relationship enforceable in your local jurisdiction.
- kingcharles 5y agoI went to jail. Got out. Seems like there is no way to reaccess my old gmail account.
- the_duke 5y agoWell, sure. But my registrar requires 2FA and has good support. The domain also has a hard lock for transfers, which would require a signature and id. A targeted hack that could get 2FA tokens or a social engineering attack on the registar aren't threat vectors I'm concerned about. I'm not that interesting. Much better than being at risk of, for example, Google cancelling your Gmail account for whatever reason, or your mail account getting hacked.
- Vinnl 5y agoHeh, I work on Relay and I do the same :) While the approach is great, especially in situations away from my computer where I can't generate a new alias in advance, working on it I discovered that using Relay still has a couple of advantages: - My other addresses are unguessable. - It's far easier to block emails sent to a single alias. With my own domain, I'll have to go and add a filter into which I copy-paste the particular alias I want to block. With Relay, I can just open the dashboard and hit the toggle next to the alias labelled with the domain I used it on. - I was looking for ways to give Mozilla money for a long time (though now I'm working there, so I guess I'm also taking its money). In general, my setup now is to keep using my old setup for long-term accounts with somewhat more reliable services, and use Relay for e.g. requesting a quotation or having a single thing shipped to me.
- VTimofeenko 5y agoOn the unguessability of other addresses - I rotate several schemas making the mask of the address something like [service].[username].$(pwgen -1 | tr '[:upper:]' '[:lower:]')@customdomain. Sometimes "[service]" is also shortened like "hackernews -> hn" to dodge the ban on service name in the e-mail address that some service providers apparently have.
- Vinnl 5y agoAh, I don't necessarily mean guessability of which other addresses I use, but of how you can reach me. If I block yourservice@mydomain.com, you can still attempt to reach me at totallynotyourservice@mydomain.com and it will work. You'll also be able to link my different addresses on different services. If I throw away the Relay alias for your service, that's it - there's no way to lead that back to me anymore.
- VTimofeenko 5y agoGotcha. > you can still attempt to reach me at totallynotyourservice@mydomain.com not if the catch-all address is actually /dev/null and the totallynotyourservice@ has to be mined from somewhere because it's random. Overall, I think it depends on the obfuscation strategy. It's true that having a unique @mydomain.com part is a big giveaway and someone could theoretically track one's activity by searching for all e-mail addresses coming from the domain. My use-case is more to use unique e-mail addresses to throw off credential stuffing attacks, not become untrackable/avoid all spam. For the tracking use-case I generally think several times if I want to register somewhere at all and try the usual routes first (mailinator, random old addresses on public e-mail).
- sysadm1n 5y ago> I have a custom domain just for signups I keep reading about people who say they have a custom domain, but I'm not sure they're aware of the caveat to that. You have to keep renewing it, and domains are infamously changing hands all the time, sometimes to bad actors who want to use the SEO juice of the domain for spam or affiliate marketing, or in the worst case: to take over your identity with it. By all means, yes, keep it renewed, but if you stop renewing it (for whatever reason), assume all the accounts you have tied to it will be in someone elses hands.
- kingcharles 5y agoI (unexpectedly) went to jail. Try renewing your domains while you are in jail. As you say, now you've lost access to everything. My solution: make sure you keep your domains renewed to the maximum allowed by your registrar if you can. 10 years with dotcoms.
- encryptluks2 5y agoOr at least make sure you have some type of plan document to have a family member or someone you trust assist, but having it done automatically is better. Unfortunately, other services like Gmail or what not may end up closing your account after a couple years. If you have your own domain, maybe see if you can prepay for email hosting for a few years as well.
- discardedrefuse 5y agoThis is very similar to how I setup my (paid) Fastmail email with my own domain. But Fastmail goes one step further: When signing up for things I use an email address like: shopping.newegg@depingus.mydomain.com. Fastmail will automatically deliver any messages addressed to the above email into the Shopping folder of my Inbox. I don't have to create an alias or any rules in my email account. Fastmail will handle that when a message arrives. This is great for categorizing messages. And you can still blacklist aliases that have been leaked to abusers.
- piokoch 5y ago"A downside is the unique domain name" that depends, I bet that a lot of services will disallow registration with @mozmail.com addresses and the trick would not work. In case of you custom domain they will never know if this is a real thing or some throwaway address.
- heresie-dabord 5y agoThe functionality isn't easy to discover, but you can use an account at outlook.live.com (MS) to create e-mail aliases. You can manage the aliases within the same parent account.
- crossroadsguy 5y agoI do this but on my main domain. I have another domain and I guess I might to move spam catching exclusively to that domain. Anyway the trouble is writing mail to those services or replying to those. I have 13 from email usernames in my Mail.app right now on my domain. Then I stopped it. It’s just so tedious. I wish there was an app that would let me easily do it once I proved I’m the domain owner maybe - just let me send an email from <anything>@<my domain>.tld without having to add one separately. It should also allow me to reply from same email without hassle I tried Apple iCloud+‘S HideMyEmail feature, but: - It’s a harder lock-in into their ecosystem - Not available on custom domain - You can reply from that random email username if you get email username, but you can’t start a conversation easily. - when you stop paying those randomly generated Hide My Email are gone - Not very convenient in the browser especially if you are not in Safari or a Mac.
- climb_stealth 5y agoAs someone else already mentioned, the Fastmail interface makes this super easy. When you respond to an email it by default sends from the email that was addressed. And when you send emails you can enter anything in the from field for your own domains. The only issue I have had is non-technical people getting confused when I have their business name in my email address.
- thmzlt 5y agoYou can do that in FastMail (web UI or mobile app). It supports multiple domains too. The compose view looks like this: https://imgur.com/a/qULeL5a https://imgur.com/a/qULeL5a
- crossroadsguy 5y agoOh. Undo tuna I’m on mailbox.org and I was looking for a mobile and desktop client rather than a provider. But yeah I’ll definitely consider them the next time I’m looking to move mail provider.
- voltaireodactyl 5y agoFor what it’s worth, MailMate on mac allows for responding via the received address in just the way you describe. It’s a large part of why I ultimately landed on using it exclusively.