A brand-new address is the one moment prevention is actually available, and most people spend it in a week. Nobody has it yet, so every future holder is one you choose. Two rules keep it clean indefinitely: never give the address itself to an organisation — only to people — and give each organisation its own alias instead. Everything else is detail.
Why this moment is different
Every other piece of spam advice is damage limitation, because your address is already with hundreds of organisations and there's no recall.
A new address has none of that history. The entire future distribution of it is still a set of decisions you haven't made. That's rare, and it's worth about five minutes of planning before you start using it.
The two rules
Friends, family, colleagues, anyone who'd phone you if it bounced. Never a shop, an app, a newsletter, a wifi portal or a signup form.
Set this up before you start using the new address, not after. Once you've handed the real one to twenty companies, you're back to managing exposure instead of preventing it. Every method
Hold those two and the address stays clean essentially forever, because the only route to it is people who know you.
Setting it up properly
- Choose something not guessable.
firstname.lastname@gmail.comgets dictionary-attacked with no leak required. A less predictable local part removes an entire attack route for free. - Decide where the aliases live first. Free provider service, or your own domain if you want the addresses to survive changing provider. The trade-off
- Pick a naming convention and write it down. Conventions
- Turn on two-factor authentication immediately. This inbox will become the reset route for everything you own.
- Use a password manager from account one. It records which alias went to which service as a side effect.
- Never publish the address anywhere public. Anything public is an alias you're willing to burn.
The mistake that undoes it
Almost everyone does the same thing: sets up the new address, then spends a fortnight signing up for things with it directly because aliases feel like extra work in the moment.
Two dozen organisations later, the new address is on the same trajectory as the old one and the opportunity is gone. This is why setting up aliases before the first signup matters more than any other step — the friction has to be lower than the temptation on day one, not day thirty.
A catch-all setup is the version with no friction at all: you invent the address at the form, and it exists because you typed it. How that works
Migrating from an old address
If this is a replacement rather than a first address, don't try to move everything at once — that's the project people abandon at account thirty.
- Move critical accounts deliberately: bank, government, insurance, primary recovery.
- Let the long tail move opportunistically, when a service emails you anyway.
- Keep the old address alive and forwarded. Don't delete it — something you forgot will surface in eighteen months.
Whether starting over is even worth it: usually not, and here's when it is.
What to expect
Held properly, a new address receives essentially no spam, for years. Not because anything is blocking it, but because the number of organisations holding it stays at zero — and organisations are where spam comes from.
More: the rule for who gets your real address · the 30-day plan