Use the company's name as the address, decide it once, and never think about it again. netflix@yourdomain.com, ikea@yourdomain.com. The convention needs to satisfy exactly one requirement: seeing the address tells you which company it belongs to, instantly, without a lookup. Everything else — folders, labels, tags — is optional decoration on top of that.
Why the convention is the whole system
At twenty aliases, any scheme works. At two hundred, the difference between a readable convention and a clever one is whether you still use the system at all.
The moment that decides it: spam arrives, you look at the To: address, and you either know immediately who's responsible — or you have to go and look it up, which you won't, so you'll leave the alias running.
Conventions that work
| Convention | Example | Best for |
|---|---|---|
| Company name | netflix@ | Almost everyone. Start here. |
| Company + year | netflix2026@ | Services you may re-register with later |
| Company + fixed suffix | netflix-k2@ | Readable but not guessable from one sample |
| Category | newsletters@ | Rarely — see below |
| Random string | x7fq2k@ | Unguessable, unusable at scale |
Why category addresses usually disappoint
Grouping by purpose — shopping@, newsletters@, finance@ — is tempting because it's fewer addresses. It also destroys attribution within the category: when shopping@ starts getting spam, you know a shop leaked you, not which one.
Since per-company addresses cost nothing extra with a catch-all setup, the saving is imaginary and the loss is real.
The guessability trade-off
Anyone who sees netflix@yourdomain.com can guess amazon@yourdomain.com. On a catch-all domain those guesses are accepted until you disable them.
For most people this is a fair trade: any resulting junk is trivially attributable and one action from being stopped, and readable names pay off every single day. If you're concerned about a targeted adversary rather than marketing lists, add a short fixed suffix you reuse everywhere — netflix-k2@, amazon-k2@. Still readable to you, not derivable from one sample. More on catch-all risk.
Normalising the name
Decide these once so you never hesitate mid-signup:
- Lowercase always.
- Strip spaces and punctuation: "John Lewis" →
johnlewis@. - Use the brand you'd recognise, not the legal entity.
ikea@, notingka@. - Drop the TLD:
booking@, notbookingcom@.
Do you need a record of them?
With a readable convention, mostly no — the address is self-documenting, which is the point.
Two things worth keeping anyway: your password manager already stores which address you used per site, if you let it save the username field. And your alias service's dashboard lists what exists and what's receiving mail. Between those, a separate spreadsheet is redundant.
Folders and filters
Optional, and worth it for high-volume categories. Filter on the recipient address rather than the sender: route everything at newsletter aliases into a reading folder, leave transactional aliases in the inbox.
Keep this light. The alias system's value is attribution and control; inbox organisation is a separate problem, and conflating them is how people end up with forty rules they don't understand.
More: best practices · the core routine