Email aliasing explained: give every service its own address

Email aliasing gives every account its own forwarding address — netflix.you@yourdomain or a random alias from a dedicated service — that lands in your one real inbox. The payoff is twofold: when spam or phishing arrives on a specific alias, you know exactly which service leaked or sold it, and you disable that alias instead of abandoning your whole address. Setup runs from free (Apple's Hide My Email, Firefox Relay's basic tier, SimpleLogin's free tier) to a few dollars a month or a personal domain, and the system works with your existing inbox untouched.

How does aliasing actually work?

An alias service sits between the world and your real mailbox. Mail to any alias is forwarded to your true address; replies you send are relayed back out through the alias, so correspondents never learn the destination. When an alias starts attracting spam, you deactivate or delete it — the forwarding stops, and everything sent to that alias dies at the gateway, while every other alias keeps working. The core insight is that your email address functions as both a login name and a tracking identifier; aliasing splits those jobs apart.

What are the options?

• Apple Hide My Email — built into paid iCloud plans; generate unlimited random @icloud.com forwarding addresses from Safari and Mail. Simplest option if you are already in the Apple ecosystem.
• Firefox Relay — Mozilla's alias service, with a free tier of a few aliases and paid tiers for more plus a phone-mask.
• SimpleLogin (owned by Proton) — the most flexible standalone option: unlimited aliases on paid tiers, custom domains, and the ability to self-host if you want independence.
• DuckDuckGo Email Protection — a free @duck.com personal address that strips trackers and forwards, plus unlimited private aliases.
• Your own domain — professional-grade: any mailbox at your domain plus unlimited addresses via plus-addressing or catch-all forwarding rules. The address never becomes orphaned when a vendor shuts down, because you own the domain.

What is plus-addressing, and is it enough?

Plus-addressing — you+netflix@gmail-style suffixes supported by major providers — is free and needs no setup, but it is a weak cousin: the real address remains obvious (delete the suffix and mail still arrives), some registration forms reject the plus sign, and you cannot disable one suffix independently without writing filter rules. It reveals who leaked while doing nothing to stop the flow. True aliases are opaque and independently killable, which is the difference between noticing a leak and turning it off.

What do you gain in practice?

Three concrete wins. Leak attribution: phishing aimed at your-shopping-site alias proves which database you are in, which tells you which password to change. Breach containment: when a service is breached, the stolen address is one dead-end alias rather than your permanent identity. Spam surgery: marketing mail that ignores unsubscribes is turned off at the alias, not litigated with the sender. Against credential stuffing and targeted phishing, unique aliases also act as a signal — an email "from your bank" arriving on the alias you only ever gave a pizza chain is self-declaring as fake.

What are the downsides?

Honest costs: some services — particularly banks — behave poorly when the login email "changes," so keep financial accounts on a stable, memorable address. A lost alias-service account becomes a single point of failure, so secure it like a password manager, with MFA and recovery codes. Recovery paths get tangled: if you lock yourself out of a service, the reset mail must reach the alias. And the first year of migration is messy — adopt aliases for new signups while letting existing accounts migrate opportunistically, rather than attempting a big-bang changeover.

How do you start?

Pick one lane: if you are Apple-only, turn on Hide My Email today — it is already paid for. If you want cross-platform and free, DuckDuckGo or Firefox Relay. If you want the durable solution, register a domain (about $10-15 a year) and either run SimpleLogin against it or use your mail host's aliasing. Then a simple discipline: every new signup gets its own alias, high-value accounts get their most carefully guarded aliases, and your true address shrinks to the few people and institutions that genuinely need it — your bank, your doctor, your family.