Ever wonder how a store you bought from once knows your email three years later? You handed it over. So did the sites that got hacked, sold your data, or leaked it in a breach. Your inbox is a shared secret with hundreds of companies who don't deserve it.
Here's the fix: never give out your real email again. Give each site its own throwaic address instead.
The trick: one email, infinite aliases
An email alias is a fake-looking address that forwards to your real inbox. Sign up for a newsletter with [email protected]. Sign up for a pizza app with [email protected]. Both land in your normal inbox. But now you know exactly who each message is for.
The magic moment comes later. If [email protected] starts getting spam about crypto and weight loss, you learned two things: Domino's sold or leaked your address, and you can kill that alias in one click. The spam stops forever. Your real email stays clean.
Why self-host it
Services like SimpleLogin and AnonAddy do this. But the free versions cap your aliases, and you're trusting a company to sit between you and your mail. The whole point was to stop trusting middlemen.
Self-hosting flips it. You own the domain. You own the forwarding rules. No limits, no company reading your patterns, no service that can shut down and take your addresses with it.
The beginner setup
You need two things: a cheap domain (around $10 a year) and a tool to handle forwarding.
- Buy a domain you don't mind seeing in email addresses. Short is better.
- Run addy.io (formerly AnonAddy) self-hosted using Docker. One config file, one command, and it's live on your home server or a $5 VPS.
- Point your domain's mail records (MX) at your server. The addy.io docs give you the exact lines to paste.
- Set a catch-all rule. This is the beginner's best friend — any address at your domain that doesn't exist yet gets auto-created and forwarded. Now you invent addresses on the spot. No setup per site.
Type [email protected] at signup and it just works. First email arrives, alias exists.
The habit that makes it powerful
Name aliases after the site. spotify@, bank@, randomforum@. When a breach hits the news, search your inbox for that alias. If it's compromised, disable it and re-sign-up with a new one. Your other 200 accounts stay untouched.
Bonus: replies still work. You can answer from the alias, and the site never sees your real address.
Your first move tonight
Buy a short domain, spin up addy.io in Docker, and turn on catch-all. Then sign up for your next newsletter with a fake address. When it starts getting spam, you'll finally know who sold you out — and you'll shut them off in one click.