Email Aliases and Masked Email: Privacy and Leak Tracing

Using one email address for every shop, newsletter, bank and social account turns that address into a universal identifier, a phishing target and half of every credential pair that leaks in a breach. Email aliases and masked email break that link by giving each service its own address that still lands in your inbox. This guide compares the three main approaches (plus addressing, relay or masking services, and catch-all or custom domains), explains what each one actually hides, and shows how to use them to trace which company leaked or sold your address. It is written for individuals who want practical privacy, and for security and IT teams who run the mail systems and sign-up policies that aliases touch.

Key takeaways

Plus addressing is free but transparent. [email protected] is easy to set up, yet anyone who sees it can strip the tag and reach your real address, so it helps with sorting and tracing, not with hiding.
Masked or relay addresses actually hide the inbox. Services such as Apple Hide My Email, Firefox Relay, DuckDuckGo Email Protection and Fastmail Masked Email issue random addresses that forward to you and can be blocked or deleted per service.
A custom domain gives you portability and control. If you own the domain, you can change mail providers without changing hundreds of addresses, but you take on DNS, SPF, DKIM and DMARC responsibility.
One alias per service makes leaks traceable. When spam or phishing arrives at an address you only gave to one company, you know where it came from and can kill that address without touching the rest.
Aliases do not replace account security. Use a password manager, unique passwords and strong MFA, and keep high-value accounts (bank, primary email, password manager) on an address you fully control.

What an email alias is, and what it does not hide

An email address has a local part (before the @) and a domain. An alias is any extra address that delivers into the same mailbox. The internet mail standard says the local part is interpreted only by the host named in the domain part (RFC 5321 section 2.3.11), which is why every provider can invent its own alias rules, and why the same trick behaves differently at Gmail, Microsoft 365 or a relay service.

Aliases protect against three things: a single leaked address being used to link your accounts across services, bulk spam and marketing that you cannot switch off, and phishing that relies on knowing which address you use for which company. They do not hide your name if you type it into the sign-up form, your IP address (see the IP Address Privacy Guide), your payment card (see the Virtual Card Numbers Guide) or the content of mail once it arrives.

The three approaches compared

Approach	Example	Hides real address?	Can kill one address?	Cost and effort	Main weakness
Plus addressing (subaddressing)	[email protected]	No: the base address is visible	Only with a filter rule	Free, nothing to set up at Gmail or Exchange Online	Tag can be stripped; some sign-up forms reject "+"
Provider dot variants	[email protected]	No	No	Free, personal Gmail only	Not an alias for tracing; all variants are the same account
Masked or relay address	random.word123@relay-domain	Yes, until you reply in a way that reveals it	Yes, block or delete per address	Free tiers with limits; paid tiers for more addresses or features	You depend on the relay provider staying in business and available
Catch-all on your own domain	[email protected]	Hides your provider address, not your domain	Yes, with a rule or by turning the address into a reject	Domain cost plus DNS and mail authentication work	Attracts dictionary spam; the domain itself identifies you
Named aliases on your own domain	[email protected]	As above	Yes, delete the alias	As above, more admin per alias	Manual creation slows sign-ups

Plus addressing in practice

Subaddressing is defined for mail filtering in RFC 5233, a Standards Track RFC that splits the local part into a "user" part and a "detail" part around a separator such as "+". The RFC does not fix the separator; it depends on the mail system.

Gmail and Google Workspace: Google's help says messages sent to your address or any variation with a plus sign arrive in the same inbox, and suggests creating a filter on the To field (for example cassy+news@) to label or archive them. Separately, personal Gmail ignores dots in the local part, but Google Workspace accounts treat dots as part of the address.
Microsoft Exchange Online: plus addressing is on by default. Admins can turn it off with Set-OrganizationConfig -DisablePlusAddressInRecipients $true or in the Exchange admin centre under Settings, Mail flow. Microsoft notes that plus addresses are receive-only (users cannot send from them), they are not mailbox aliases, and Exchange first tries to resolve the full address before retrying without the tag.
Sieve filtering: on servers that support the Sieve "subaddress" extension, the :detail tag lets a script file mail by the tag, and RFC 5233 recommends testing the envelope recipient rather than headers when sorting by recipient.

Where it falls short: a spammer or data broker can trivially remove "+tag", and some sites reject the "+" character in sign-up forms even though it is valid. Treat plus addressing as a labelling and tracing tool, not as privacy.

Masked email and relay services

A relay service hands out an address on its own domain, receives mail for it and forwards the message to your real inbox. Each address can be switched off independently, so a leaked or sold address stops working without affecting any other account.

Service (documented features)	Address format	Notable behaviour from vendor documentation
Apple Hide My Email	@private.icloud.com or @privaterelay.appleid.com	Built into Sign in with Apple and iCloud+. With Sign in with Apple, only the app or website that received the address can use it to contact you. Apple says it does not read message content beyond standard spam filtering and deletes messages from relay servers after delivery, usually within seconds. Changing the forwarding address needs iCloud+.
Firefox Relay	Random mask, or [email protected] on Premium	Premium adds custom subdomains, replies within 3 months of receiving a message, and promotional email blocking. Messages over 10 MB are not forwarded. Mozilla warns that adding CC or BCC to a reply exposes your real address, and that blocked promotional mail cannot be recovered.
DuckDuckGo Email Protection	Private Duck Addresses	Free; unlimited private addresses created on the fly; removes multiple types of hidden email trackers; works with an existing inbox such as Gmail or Outlook.
Fastmail Masked Email	Random words plus a number, at fastmail.com or a custom domain	States are Active, Blocked (mail goes to Trash) and Deleted (mail bounces, restorable). Integrates with 1Password and Bitwarden so a masked address is generated at the same time as the password. Removing the custom domain deletes its masked addresses.

Names are given only to explain the feature types; this is not a recommendation. Feature sets and limits change, so check the provider's current documentation before relying on a specific behaviour.

Replying without leaking the real address

Reply through the relay: use the provider's reply mechanism so the recipient sees the masked address. Fastmail replies from the masked address by default; Firefox Relay supports replies on Premium only.
Never add CC or BCC from the real inbox: Mozilla documents this as a way the real address is exposed.
Watch the signature and display name: your full name and phone number in a signature undo much of the privacy.

Catch-all and custom domains

With your own domain you can either create named aliases one by one or enable a catch-all, where the mail server accepts any local part at the domain and delivers it to one mailbox. Catch-all is convenient (you invent the address at the sign-up form) but it accepts every guessed address, so dictionary spam lands in your inbox and you cannot tell at a glance which addresses you actually issued.

Prefer an allow-list over a pure catch-all: keep catch-all on only while you are creating new addresses, or have the server reject unknown addresses and add each new one deliberately.
Authenticate the domain: publish SPF, sign with DKIM and set a DMARC policy so attackers cannot spoof mail from your alias domain. See the DMARC, SPF and DKIM Guide.
Protect the domain registration: enable registrar MFA and auto-renew. If the domain lapses, whoever registers it next can receive password reset mail for every account behind it.
Remember the domain is a fingerprint: a personal domain used for every alias still links your accounts together; it hides your provider, not you.

Choosing the right approach

Situation	Recommended approach	Why
Sorting newsletters and tracing who shares your address	Plus addressing	Free and instant; good enough when hiding the base address does not matter
Shops, trials, forums, one-off downloads	Masked or relay address	Real address hidden; delete the mask when the relationship ends
Bank, tax, health, primary email recovery, password manager	A stable address you fully control (own domain or primary mailbox)	Losing access to a relay or a lapsed domain would lock you out of the accounts that matter most
Long-term personal use across provider changes	Named aliases on your own domain	Portable; you can move providers by changing MX records
High-risk individuals (journalists, executives, people facing harassment)	Masked addresses for public sign-ups plus a separate private domain	Reduces what a leaked database reveals; see the Doxxing Prevention Guide

For organisations: employees often use relay addresses for vendor trials and SaaS sign-ups. That creates shadow accounts the company cannot recover or offboard. Require work accounts to use corporate addresses (or corporate-domain aliases owned by IT), and use group mailboxes or shared aliases for supplier contact points so that access survives staff changes.

Using aliases to trace leaks and phishing

Issue one address per service and record it in your password manager entry for that service, so the mapping is never lost.
When unexpected mail arrives, check the To address. Mail to the alias you gave only to one retailer, from a sender that is not that retailer, means the address was leaked, sold or shared.
Check breach notification services: Have I Been Pwned lets you monitor addresses you control and offers domain search after verifying you control a domain, which suits custom-domain alias users. Its FAQ notes that plus aliasing is not currently supported as a separate search and appears in about 0.03% of loaded addresses.
Respond: change the password for that service, kill or rotate the alias, and treat further mail to it as hostile. If the service has not disclosed a breach, you have useful evidence to report to it or to the data protection regulator.

Targeted phishing often uses addresses taken from marketing or customer platforms. In the Mailchimp breach, attackers who hijacked an internal support tool reached customer data, including mailing lists that were then usable for convincing follow-up phishing. A per-service alias makes such mail stand out because it arrives at an address the impersonated brand never had.

Security risks and abuse to plan for

Credential stuffing still works if passwords are reused: an alias changes the username, but if you reuse passwords, a leaked alias plus password still opens that one account. The 23andMe credential stuffing breach shows how reused credentials from other breaches unlock accounts at scale (ATT&CK T1110.004).
Relay availability is now in your recovery path: if the relay provider has an outage, closes or suspends your account, password reset mail stops arriving. Keep critical accounts off relay addresses.
Attackers use aliases too: fraud teams see relay and plus addresses in fake sign-ups and free trial abuse. Blocking every alias domain punishes privacy-conscious customers; score them as one signal among many instead. See the Subscription and Free Trial Abuse Guide.
Normalisation breaks matching: organisations that strip "+tags" or dots to detect duplicates must remember that only the destination host defines what an address means (RFC 5321). Stripping dots is right for personal Gmail, wrong for Workspace.
Reconnaissance: attackers collect email addresses to plan phishing (ATT&CK T1589.002, Gather Victim Identity Information: Email Addresses). Unique aliases reduce how much a single address reveals.

Detection and measurement

For individuals, the signal is mail to an alias from an unexpected sender. For mail administrators running aliases or plus addressing for staff:

Log recipient tags: message trace in Exchange Online or the Gmail log search shows the full recipient address including the tag, which helps when investigating where a phishing campaign harvested targets.
Monitor catch-all volume: a rise in distinct local parts received at a catch-all domain shows dictionary spam.
Metrics: share of personal or test accounts on aliases rather than the primary address; number of aliases disabled after unexpected mail (each one is a detected leak); time from first suspicious message to alias disabled; count of SaaS accounts registered with non-corporate or relay addresses found in expense or SSO reviews; DMARC pass rate for any alias domain you own.

Framework mapping

Framework	Reference	Relevance
NIST SP 800-53 Rev. 5	SI-12(1) Limit Personally Identifiable Information Elements	Giving each service a different, non-identifying address limits the PII each holds
NIST SP 800-53 Rev. 5	SI-8 Spam Protection	Per-alias blocking and relay spam filtering
NIST CSF 2.0	PR.AA-01	Corporate accounts must use organisation-managed identities, not personal relay addresses
MITRE ATT&CK	T1589.002, T1566.002, T1110.004	Address harvesting, link phishing and credential stuffing that aliases make harder or easier to spot
GDPR	Art. 5(1)(c) data minimisation	Services that accept masked addresses collect less personal data; they still must treat the alias as personal data

Common failure patterns

Putting the bank behind a relay: the relay account becomes a single point of failure for the most important recovery path.
Losing the alias map: random addresses with no record of where they were used cannot be traced or cleaned up. Store each in the password manager entry.
Letting the alias domain expire: a lapsed personal domain lets someone else receive your reset emails.
Leaking the real address in replies: replying from the real mailbox, or adding CC, reveals it.
Treating plus addressing as anonymity: the base address is in plain sight.
Staff signing up for work tools with personal masks: the account cannot be recovered or offboarded when they leave.

Practitioner checklist

NHI Mgmt Group recommends the following checks.

Keep one stable address you control for bank, tax, health, primary email recovery and the password manager.
Use a masked or relay address for shops, trials, forums and newsletters, one per service.
Record every alias in the matching password manager entry.
Use unique passwords and strong MFA regardless of aliasing.
Reply through the relay only, never with CC or BCC from the real inbox.
If you own an alias domain: SPF, DKIM, DMARC, registrar MFA and auto-renew; avoid a permanent catch-all.
Monitor addresses or your domain with a breach notification service and disable any alias that receives unexpected mail.
For organisations: require corporate identities for work accounts and decide whether plus addressing stays enabled in your mail platform.

Email Aliases and Masked Email Guide: Plus Addressing, Relay Masks and Catch-All Domains Compared