An email alias is a second email address that delivers to an inbox you already read. Mail sent to the alias is forwarded to your real address; the sender only ever sees the alias. Because you can create a different one for each service and switch any of them off independently, aliases let you work out which company leaked your address and cut that company off without changing the address anyone else uses.
How an alias actually works
There's no magic in the mechanism. When mail arrives for shop@example.com, the mail server that handles example.com looks up where that address should go, rewrites the envelope recipient to your real inbox, and passes the message on. Your provider delivers it like any other message.
Three consequences follow from that, and they explain most of what people find confusing:
- You don't get a second inbox. An alias is a routing rule, not a mailbox. Everything still lands in the inbox you already use.
- The sender never learns your real address. They only ever addressed the alias. Your actual address appears nowhere in the message they sent.
- Replying is a separate problem. Hitting reply sends from your real address unless the service specifically implements reply handling, which not all of them do. More on this below.
The four ways to get aliases
They are not equivalent, and the differences matter more than the feature lists suggest.
1. Plus-addressing (subaddressing)
Gmail, Outlook, Fastmail and others let you append a tag: you+shop@gmail.com delivers to you@gmail.com. It's free and instant.
It's also transparent. Anyone can see the real address by deleting everything from the + to the @, and list brokers strip these routinely. It's useful for filtering your own mail into folders. It is close to useless as a privacy measure, because it doesn't hide anything.
2. Provider-hosted aliases
DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email and the free tiers of SimpleLogin and Proton Pass give you addresses on their domain — @duck.com, @mozmail.com, @icloud.com. These are real aliases: the address genuinely doesn't reveal your inbox.
They're free or cheap and take minutes to set up. The catch is that the addresses live on someone else's domain, which matters more than it sounds — see what happens if the service shuts down.
3. Aliases on a domain you own
You register a domain and point its mail at a routing service. Addresses look like shop@yourdomain.com. SimpleLogin Premium, Proton Pass paid tiers, Fastmail, addy.io and Don't SPAM Me all support this.
Costs a domain — roughly the price of a couple of coffees per year for a common extension — and needs DNS records set up once. In exchange, the namespace is yours: the addresses survive you changing provider.
4. Catch-all on your own domain
A refinement of the above. Instead of creating each alias first, the domain accepts any address and creates the alias on first use. You invent netflix@yourdomain.com while filling in the signup form — nothing to set up in advance, no extension, no app switch.
The trade-off is that a catch-all accepts everything until you disable individual addresses, so a spammer guessing addresses at your domain will get through until you turn those addresses off. In practice this is rare for an unremarkable domain, but it's a real property worth knowing. See catch-all in the glossary.
What aliases protect you from
- Attribution. One address, one company. Spam at that address names its own source with no investigation required.
- Cascading leaks. A breached company's list holds an address nobody else has, so it can't be matched against your other accounts.
- Unilateral shut-off. You stop the mail without needing the sender to cooperate, and without disturbing any other address.
- Not publishing your real address. Anything you post publicly can be an alias you're willing to burn.
What they don't protect you from
- They are not anonymity. The alias hides your inbox, not your identity. You typed your real name into the form next to it. A custom domain used by one person is also a stable identifier across every service you use it on.
- They don't delete anything. Disabling an alias stops delivery. The company keeps the record, and so does anyone they sold it to.
- They don't retroactively help. Aliases change what happens from now on. Your existing address stays as exposed as it already was.
- Some sites reject them. A minority of services block known alias domains at signup. This is far less common with your own domain than with well-known shared ones.
Do aliases break password resets?
No — provided you use a permanent alias rather than a disposable address. The alias keeps working indefinitely, so the reset email arrives normally. This is the single biggest practical difference between aliases and throwaway addresses, and it's covered in email alias vs disposable email.
The one thing to avoid is disabling an alias attached to an account you still need. If you disable the alias you used for your bank, the bank's password reset will bounce. Disable aliases for senders you're done with, not for accounts you still use.
Can you reply from an alias?
Depends on the service. DuckDuckGo Email Protection, Apple Hide My Email, Proton Pass, Firefox Relay Premium and SimpleLogin Premium all support replying so the recipient sees the alias rather than your real address. Checked: 2026-08-19, from each provider's own documentation.
Don't SPAM Me does not support this yet — forwarding is one-way for now. If two-way conversation through an alias is important to you, choose one of the services above.
Where to start
If you want the shortest useful version: pick one alias provider, use a new alias for every signup from today, and don't try to migrate your existing accounts in one sitting. Move them when a service happens to email you. The full routine is in a unique email address for every website, and the wider context — filters, unsubscribing, data removal — is in how to stop spam emails.