How to Stop Spam Emails: The Complete Email Alias System

Most advice on this subject stops at the first two. Turn on the filter, click unsubscribe, block the sender, repeat forever. That advice isn't wrong, it's just incomplete — it treats spam as weather rather than as the predictable consequence of handing the same address to several hundred organisations over fifteen years.

This guide covers all four mechanisms, what each genuinely achieves, and where each one fails. It's long because the subject has four distinct parts and conflating them is why most people never fix it.

Why you get spam in the first place

Spam is not random. Your address reached a list, and there are a limited number of ways that happens:

• You gave it to a company that shared or sold it. The FTC's own consumer guidance is blunt about this: "When you give a company your email address, it might share or sell it to third parties." Source: FTC, How To Get Less Spam in Your Email. Checked: 2026-08-19.
• A company you trusted was breached. Their security failure becomes your spam problem, and you usually find out months later, if at all.
• Your address was scraped. Published anywhere in plain text — a forum profile, a WHOIS record, a company "contact us" page, a PDF — and automated harvesters will collect it.
• It was guessed. Common first-name-dot-surname patterns at large providers get hit by dictionary attacks. No leak required.
• It was aggregated by a data broker who combined records from several sources and sold the result on.
• You genuinely did sign up, once, years ago, for something that has since been acquired, merged, or sold its list as an asset.

Notice what all six have in common: they happened after your address left your hands. That's the structural problem. Once one address is out there, everything downstream is cleanup.

If you want to work out which of these applies to a specific sender, how did this company get my email address? walks through the diagnosis, and why am I getting so much spam all of a sudden? covers the case where the volume changes overnight.

Why spam filters don't finish the job

Filters are genuinely good now. Gmail, Outlook and iCloud all catch the overwhelming majority of obvious spam without you configuring anything, and marking messages as junk does measurably improve them.

But filtering is a classification problem, and classification has two failure modes that never go away. The FTC puts it plainly: "Filters aren't perfect, so even emails that make it past the filter might still be spam" — which is why their advice includes checking the junk folder periodically for mail that shouldn't be there.

Why unsubscribing solves less than you'd hope

Unsubscribing works better than the internet's folklore suggests — for legitimate senders. In the US, the CAN-SPAM Act requires any commercial message to include a clear way to opt out, and requires the sender to honour that request within 10 business days. The opt-out mechanism has to keep working for at least 30 days after the message was sent, and the sender can't charge you or demand anything beyond your email address to process it.

There's a detail most people miss, and it's genuinely useful: once you've opted out, the sender may not sell or transfer your address, even as part of a mailing list. Penalties run to up to $53,088 per individual email in violation.

So why doesn't unsubscribing fix everything?

• CAN-SPAM is an opt-out regime, not an opt-in one. A company does not need your consent before emailing you. It only needs to stop once you ask. That single design decision is why your inbox looks the way it does.
• It only binds the sender you asked. If your address was already sold to forty other parties before you unsubscribed, you now have forty more unsubscribe links to click.
• Outright criminal senders ignore it. An operation running phishing or malware is not worried about the compliance guide. For those, unsubscribing is at best useless.
• It doesn't apply everywhere. CAN-SPAM is US law. Other jurisdictions differ, and many senders operate outside all of them.

Unsubscribe from senders you recognise. Don't expect it to shrink the total number of organisations holding your address, because it can't.

Why data removal is a different problem

The third mechanism attacks the supply side: ask the data brokers and people-search sites who hold your details to delete them. Services like Incogni do this at scale, filing requests on your behalf and repeating them.

This is a real service that solves a real problem — but it is not the same problem as spam in your inbox, and the two get conflated constantly. Removal targets records that already escaped. It does nothing about the address you're going to type into a checkout form tomorrow.

It also has an inherent treadmill quality. Brokers re-acquire data, which is why removal services work in recurring waves rather than as a one-off. We've written the full comparison in data removal vs data prevention, and a straight product comparison in Don't SPAM Me vs Incogni.

The fourth mechanism: control the address itself

Here's the shift. Every approach above accepts a fixed premise — that you have one email address, everyone has it, and your job is to manage the consequences. Remove that premise and the problem changes shape.

An email alias is a separate address that delivers to your real inbox. Mail sent to it arrives where you already read mail; the sender never learns your actual address. Give a different alias to every service, and three things become true at once:

1. Spam becomes attributable. If hardware-store@yourdomain.com starts receiving casino offers, exactly one company ever had that address. There is no ambiguity and nothing to investigate.
2. A leak stops cascading. The breached company's list contains an address that no other company holds, so it can't be cross-referenced against your other accounts.
3. You get a lever. Switch that alias off and mail sent to it stops being delivered — without touching any of your other addresses, and without needing the sender's cooperation.

That third point is the one that matters. It's the only step in this entire guide that doesn't require a sender, a broker, or a filter to do the right thing.

For the mechanics, see email aliases explained. For what disabling actually does at the protocol level, see what actually happens when you disable an email alias.

Aliases are not disposable addresses

This trips people up, so it's worth being precise. A disposable or temporary address (10minutemail, Mailinator and similar) is designed to expire. It's for receiving one confirmation link and never being used again. Many are public — anyone who guesses the address can read the mail.

An alias is permanent, private, and tied to your account. It's meant to be the address that service uses forever, which means the password reset still reaches you in three years.

Use a disposable address for a one-off download you'll never need again. Use an alias for anything you might need to log back into. Full breakdown: email alias vs disposable email.

Where the aliases live matters more than the features

Most alias services put your addresses on their domain — @duck.com, @mozmail.com, @icloud.com, @simplelogin.com. That's free or cheap and takes about two minutes to set up, which is a genuine advantage and not one to dismiss.

The trade-off shows up later. Those addresses work for exactly as long as your relationship with that provider does. Leave, or watch the service shut down, and every address you handed out over the years stops resolving — including the ones attached to accounts you still need.

Aliases on a domain you own don't have that failure mode. If the routing service disappears, you point the domain somewhere else and the addresses keep working. You're renting the router, not the street name. That argument is worked through properly in what happens to your aliases if the service shuts down?

Building the system

A practical setup, in the order worth doing it:

1. Leave your real address alone. Don't try to clean it up first. It stays as your personal address for people who know you, and it stops going into forms.
2. Get a domain and put aliases on it. Anything short and unremarkable. Turn on WHOIS privacy at the registrar so the domain doesn't publish your name and postal address.
3. Adopt a naming convention and stick to it — company@ is enough. Predictable naming is what makes attribution instant later.
4. Use a new alias for every signup from now on. Don't migrate everything at once; that's a weekend you'll never spend.
5. Migrate opportunistically. When a service emails you about a password reset or a billing change, that's the moment to switch its address.
6. Keep the filter on. Aliases and filtering are complements. Nothing here replaces your provider's spam filter.
7. When spam arrives at an alias, disable that alias. Note which company it was. That's the whole maintenance routine.

The step-by-step version is in a unique email address for every website.

Which mechanism should you actually use?

Most people need two of these at once: filtering plus address control. Some also need removal. Almost nobody needs to pick just one.

What none of this fixes

Being straight about the limits, because privacy content usually isn't:

• Disabling an alias doesn't delete anything. The company still has the address in its database, and so does anyone they sold it to. You've closed the door, not erased the record.
• Aliases aren't anonymity. A domain is registered to somebody, and a domain only one person uses is a consistent identifier across every service you use it on. This is a tool for spam control and attribution, not for hiding who you are.
• Your existing address stays exposed. Aliases protect what happens from now on. They don't retroactively unshare anything.
• No approach stops spam entirely. Anyone promising zero spam is selling something. The realistic outcome is that unwanted mail becomes rare, attributable, and individually switchable off.

Where Don't SPAM Me fits

Don't SPAM Me is the fourth mechanism, and only the fourth. It doesn't remove data from brokers and it doesn't replace your spam filter.

You connect a domain you own, or register one during setup. From then on, every address at that domain works automatically — the alias is created the first time mail arrives, so you invent netflix@yourdomain.com at the signup form itself rather than pre-creating it somewhere. Mail forwards to your normal inbox.

When a sender that isn't the original company starts emailing one of your aliases, you get an alert naming the new sender's domain, and a Data Sellers list builds up over time showing which companies leaked you. Disable an alias and its mail is rejected outright — the sending server gets a hard bounce rather than a silent drop, so the message doesn't quietly vanish.

The software is free. The domain is the cost, and it's yours regardless of whether you keep using us — which is rather the point.

What it doesn't do yet

• Replying from an alias isn't available. Forwarding is one-way for now. If replying as the alias matters to you, SimpleLogin, Proton Pass, Firefox Relay and DuckDuckGo all support it today.
• There's no browser extension. The auto-create behaviour is what removes the need for one, but if you want a generate-address button inside the signup form, other tools have it.

Further reading

• FTC — How To Get Less Spam in Your Email
• FTC — CAN-SPAM Act: A Compliance Guide for Business
• California Privacy Protection Agency — Information for Data Brokers