Four methods, in ascending order of how much they actually protect you: plus-addressing (free, instant, no privacy), your provider's built-in aliases (limited), a hosted alias service on their domain (free to cheap, genuinely private), and aliases on a domain you own (costs a domain, and the addresses survive you changing provider). Pick based on how much will end up depending on those addresses.
Method 1 — Plus-addressing
Setup: none. Just type it.
Gmail, Outlook, Fastmail, Proton Mail and many others ignore everything between a + and the @. you+shop@gmail.com delivers to you@gmail.com.
Use it for: sorting your own mail with filters, and spotting which company leaked you.
Don't use it for privacy. Your real address is sitting inside the alias — delete the tag and you have it. List-cleaning scripts strip these routinely, many signup forms reject the +, and there's no way to switch a single tag off. The full explanation.
Method 2 — Provider aliases
Setup: a few clicks in account settings.
Some providers let you add extra addresses that deliver to the same mailbox. Microsoft accounts support this; iCloud offers a small number of additional addresses.
Genuinely separate addresses, so they don't leak your primary. The limitation is quantity — a handful, not one per service — which makes them useful for coarse separation (personal, shopping, public) rather than per-company attribution.
Method 3 — A hosted alias service
Setup: minutes. Sign up, install the extension or app, generate addresses.
DuckDuckGo Email Protection, Firefox Relay, Apple Hide My Email, SimpleLogin and Proton Pass all issue addresses on their domain — @duck.com, @mozmail.com, @icloud.com.
These are real aliases: unlimited or near-unlimited, individually revocable, and they don't reveal your inbox. Several are free. For most people starting out, this is the right first move, and DuckDuckGo in particular costs nothing at all.
The trade-off appears later: the addresses depend on that provider continuing to exist and on you continuing to use it. Why that matters at scale.
Method 4 — Your own domain
Setup: register a domain, point its mail records at a routing service. Ten minutes if the service walks you through it.
Addresses look like shop@yourdomain.com. SimpleLogin Premium, Proton Pass Plus, Fastmail, addy.io and Don't SPAM Me all support this.
Costs a domain — roughly the price of a couple of coffees a year for a common extension — and you have to remember to renew it. In exchange the namespace is yours: change routing service and every address keeps working, because nothing about the address depends on who's routing it.
The catch-all refinement
With your own domain you can go one step further: configure it to accept any address, creating the alias on first use. Then there's no creation step at all — you invent netflix@yourdomain.com while filling in the signup form.
This is what makes per-service addresses sustainable, because the friction of creating each one is what usually kills the habit. It also means the domain accepts guessed addresses until you disable them. The trade-off in full.
Choosing
| If you… | Method |
|---|---|
| Just want to sort your own mail | Plus-addressing |
| Want protection today, at zero cost | Hosted service (DuckDuckGo, Relay free tier) |
| Want a couple of coarse separations | Provider aliases |
| Are routing important accounts through them | Your own domain |
| Want no creation step at all | Own domain with catch-all |
A reasonable path: start with a free hosted service, and move to your own domain once you notice how many accounts depend on the addresses. The migration cost of doing that later is exactly the thing owning a domain protects you from — which is itself a useful lesson to learn cheaply.
Current pricing across all the services: the best email alias services, compared.