Email alias: How to protect your email address from spam

Reading time: 9 minutes

An online shop asks for your email address when you place an order, as does an AI tool, and you also provide it to access the Wi-Fi in a café. A few weeks or months later, you’re puzzled by adverts from senders who’ve never contacted you, and at first you can’t work out how they got hold of your address. In our blog, we’ll show you how your email address ends up in the wrong hands and how you can protect yourself against this with a small but effective tool: the email alias.

Your email address is more than just a way to get in touch

For most people, their email address has long since become the central key to their digital identity. It serves as a username for dozens of services, is used to reset passwords, and links accounts that, at first glance, appear to have nothing to do with one another.

This is precisely what makes it so interesting to others: Anyone who uses the same address everywhere provides data brokers with an anchor point around which information from a wide variety of sources can be pieced together. From individual fragments – online shops, travel portals, gyms, newsletter subscriptions, etc. – a detailed profile emerges.

For cybercriminals, a widely used email address is a real treat: if it turns up in a data breach along with a password, automated scripts try the same combination on other services. This method is known as credential stuffing.

How does spam even come about?

Spam is a business model: advertising emails cost their senders almost nothing, and even if only a tiny fraction of recipients respond, the effort has already paid off. The prerequisite for this, however, is that the senders can actually obtain email addresses in the first place. There is now a whole market dedicated to this, offering reliable methods:

Email addresses are collected automatically:
Programmes known as ‘harvesters’ scan websites, forums, comments sections and social media round the clock for anything that looks like an email address. If you leave your address in a public place, you run the risk of it being automatically captured.
Addresses are passed on and sold:
Unfortunately, not every service handles your data with care. Some providers pass addresses on to so-called ‘partners’, whilst others sell them to data brokers. Once your email address has been sold, it is passed from list to list.
Addresses end up in circulation due to data breaches:
Frequently, companies fall victim to attacks in which entire customer databases are compromised. These data sets, which often contain email addresses along with passwords, subsequently turn up on specialist forums and are traded. Even if you’ve done everything right yourself, your address can still be made public due to a provider’s negligence. Incidentally, you can check whether you’ve been affected on websites such as Have I Been Pwned or using the Identity Leak Checker from the Hasso Plattner Institute.
Addresses are guessed:
Some senders generate addresses automatically by combining common first names, words and numbers with well-known domains. Sooner or later, a simple, obvious address will be hit in this way – even if you’ve never provided it anywhere.

Once an address appears on one of these lists, it’s almost impossible to undo. It gets copied, traded and replicated. If your entire digital life – from online banking and social media to communicating with public authorities – depends on a single email address, this is particularly troublesome. This is exactly where an email alias comes in.

What is an email alias and how does it work?

An email alias is an additional email address that points to your existing inbox. Technically speaking, it is an internal server-based forwarding mechanism: A message sent to the alias is received by the mail server and ends up in the same inbox as a message sent to your main address. You don’t need a second account, a second app or another password. An alias is, in a sense, an additional name for the same mailbox.

An example: Your main address is firstname@example.org. Alongside this, you set up alias addresses such as firstname.shopping@example.org or firstname.news@example.org. All three lead to the same mailbox, but you can choose which address to give to whom. A good email alias does not contain any real names: the more neutral it is, the harder it is to trace back to you.

The key difference is that this is not simply a forwarding to someone else’s account: an alias belongs to your mailbox. You can, and indeed should, therefore not only receive emails via the alias, but also reply and send emails using it, without your actual address being visible to the recipient.

Uses of an email alias

Online shopping
Newsletters
Social media and forums
Competitions, Wi-Fi hotspots and free downloads
Authorities, banks and insurance companies
Classifieds and sales

The limitations of an email alias

Alias addresses are a useful addition, but not a cure-all.

An email alias controls who knows which of your addresses. However, it does not make you anonymous, does not conceal your IP address, and is no substitute for a strong password or two-factor authentication.

How an email alias actually helps

The basic idea behind an email alias is simple: give each service its own address, rather than using the same one everywhere. This offers several advantages.

You can identify who is passing on your data:
If you suddenly start receiving adverts at an alias that you’ve only given to a single provider, the source is clear. And you can simply deactivate that alias. The spam goes nowhere, whilst your main address and all your other alias addresses remain unaffected. Instead of moving your entire digital life, you simply close a single door.
You can spot phishing attempts more quickly:
Let’s say you use a separate email alias for your bank that nobody else knows about. If you then receive an urgent ‘security warning from your bank’ at the address you’ve only ever given to a furniture shop, you can quickly identify the supposed email as phishing. The alias thus acts as an early-warning system for forgeries.
You make it harder to build a profile:
If each service knows a different address for you, data brokers lack the common denominator that would allow them to link your activities. One large profile is broken down into many small, unconnected fragments. Email aliases are data minimisation in practice.
They protect your access:
With many providers, the main address is also the login name. By not revealing this in the first place and instead communicating only via alias addresses, you significantly reduce the attack surface of your account. An attacker may then know an alias, but not your actual username.
You gain a clearer overview:
If you use separate aliases for different areas of your life, you can have incoming messages automatically sorted into the appropriate folders using filter rules. This makes it easier to keep work, personal matters, shopping, etc. separate and to organise your inbox clearly.

As well as email aliases, there are other ways to protect your inbox. The aim – to protect your actual address – is the same, and they are often mentioned in the same breath, but they differ technically.

The email alias

This is an alias in the true sense of the word: a permanent additional address that you create deliberately and which is stored as a separate entry in your mailbox for various purposes. It is suitable for anything you intend to use in the long term, and can usually also be used for sending emails.

The Plus address or email extension

With a Plus address or mail extension, a suffix is appended to your existing address after a plus sign, for example, firstname+shop@example.org. Strictly speaking, this is a form of ‘sub-addressing’: you do not create an alias; instead, the mail server simply ignores everything after the plus sign during delivery, whilst the suffix is retained for filter rules.

Plus addresses are suitable for automatic sorting. However, they offer only limited protection against spam: professional data collectors are familiar with this principle and simply remove the suffix after the plus sign – thereby gaining access to your base address.

The disposable or one-off address

Disposable email addresses say it all in their name: a disposable email address is intended for a single occasion, such as signing up for a service where you don’t fully trust the provider.

Caution is advised when using temporary email services online, particularly regarding validity periods, data protection, security and the risk of being blocked by service providers. To find out how to use disposable email addresses with a trusted email provider such as mailbox, read our blog.

Email aliases with your custom domain

If you take the alias concept to its logical conclusion, you’ll eventually reach the limits of your quota: most providers only allow a certain number of alias addresses. Having your own domain removes this restriction. If, for example, you register surname.de, you can create as many addresses as you like under it and consolidate them all into a single inbox: from firstname@lastname.com to shopping@lastname.com and club@lastname.com.

The benefits go beyond sheer quantity, as having your own domain makes you independent of your provider: if you switch providers one day, you can simply take your addresses with you, rather than having to set them up again everywhere. In our blog, you can find out more about the benefits of having your own email domain and how to set one up.

Special case: ‘Catch-all alias’

On your own domain, you can also activate a so-called catch-all address – a catch-all address that accepts every message sent to your domain, even those sent to addresses you’ve never set up. With catch-all enabled, emails sent to wifi@lastname.com end up in your inbox just as they would if sent to magazine@lastname.com, without you having to set up these addresses beforehand. This offers perhaps the most convenient way of handling aliases of all: you can simply come up with a suitable address on the spot for each service, whether at the checkout or on a registration form. If spam arrives at one of these addresses later, the source is immediately identifiable.

However, this convenience has a downside: because mail is delivered to absolutely every conceivable address, catch-all domains are a prime target for spammers who send common addresses such as info@ or contact@ to any domain. To get rid of a single leaked address, you’ll need to set up an exception.

A catch-all alias really comes into its own when you want to make the most of the full flexibility of your own domain. We show you how to set up a catch-all alias in mailbox in our Knowledge Base.

Creating an email alias: The best way to go about it

Start small, rather than changing everything straight away. First, set up two or three themed alias addresses – for example, for shopping, newsletters and official correspondence – and add appropriate filter rules. You’ll soon notice how much quieter your inbox becomes.

You don’t need to change every existing account retrospectively either. It makes more sense to start with the most important services and consistently register everything new using an email alias.

Make sure you reply from the correct sender address. If you respond to a message sent to an alias using your main address, you’ll be revealing it.

Email alias at mailbox

Spam is the result of a market in which email addresses are collected, traded and resold. Once your address has ended up in this cycle, it is almost impossible to get it out again. An email alias breaks this very pattern: it reveals who is passing on your data, can be disabled individually in the event of misuse, makes profiling and phishing more difficult, and, as an added bonus, keeps your inbox tidy.

If you use mailbox, all the tools described in this blog are already included. With the Standard and Premium plans, you can create, delete and recreate up to 25 aliases ending in @mailbox.org – not just for receiving, but also for sending emails. If you want maximum flexibility, you can also integrate your own domains and use 50 aliases for your own domains on the Standard plan and 250 on the Premium plan.