Table of Contents
- Introduction.
- Implementing the mail alias .
- Using dummy or temporary addresses against spam and registration wall
- Advantages
- Disadvantages
- Bonus: the “oh shit mail rule”
- Some useful references
Introduction
You’ve probably got one or more personal and professional mail addresses. Who doesn’t?
And you probably want to keep that mail address safe from spammers, scammers or data theft.
Althoug you primarily use mail to communicate (send/receive messages), many platforms also use your mail address for authentication.
Security remark: It’s not always the best option to use single sign-on with platforms like LinkedIn, Facebook, Microsoft Account, Google, …
What’s the security issue?
The main issue with single sign-on is: when your mail address is breached or hacked, the hacker can use the breached mailbox fairly easily to login to the linked platforms.
And from a practical point of view, if you use that single personal mail address to subscribe to newsletters or you use that mail address for downloads protected by a “registration” wall, you’ll quickly experience a mailbox overload because of ‘spam’, eh.. .sorry commercial messages you didn’t ask for.
Another issue is, you usually have only 1 (one) personal mail address available on your mail platform, certainly for enterprise systems, you can’t create other alternative mail addresses at free will. Unless you own the domain name, of course, but that’s rather possible for personal use or small companies…
And except for the mail overload, you’ll notice that many companies sell your mail address to address brokers. And even with the GDPR in place, many of these address brokers have bad habits to scrape mail addresses from the internet, incl. public sources, government sources…
So, the question is, how do you manage this, to protect your personal data, to protect mailbox overload and abuse of your mail address?
First option is using MFA to increase security and block illegal authentication.
But MFA does not stop mail abuse. The mail alias to the rescue!
Implementing the mail alias
What is a mail alias?
A mail alias is an alternative name for the master mailbox. Usually a mail alias is forwarding mail to the target mailbox.
In many cases, that mail alias can also be setup or used as a temporary name for the target mailbox. It’s pretty cumbersome or difficult to switch a master mailbox on or off when you need it.
Purchase a Custom domain name
The most interesting option is purchasing a custom domain name (by preference a short URL).
In most cases, local domain registrars can offer you a custom mail domain of choice for a few bucks a year. It’s worth the money, I promise. Further explanation below.
Just a practical hint: make sure to use a domain registrar that offers unlimited mail aliases.
When you control the mail domain, you can forward any mail alias of the custom domain to your mailbox (eg news@short.url to subscribe to newsletters and filter them in your mailbox in a subfolder for newsletters).
Furthermore, when you own a domain, you can enable/disable a mailbox or alias. Meaning: block mail reception without deleting the mail address (keep the address, but desactivate it.)
Using the “+” mail alias option
If purchasing a custom domain is not an option, you can check with your mail platform or mail administrator to use a “+” alias.
That’s format supported by the internet standards (RFC 5233: https://tools.ietf.org/html/rfc5233), that allows to extend a master mail address with receiver suffixes (BEFORE the @ sign), that still deliver the mail to the receiver. Google calls it “task based” variations of the mail address.
You’ll generally find it back on the internet as “+” aliases (“plus” aliases).
Some examples:
See the references section at the end of the article, for details how this “+” alias works for the well known mail platforms… Google, Microsoft, … and the major free mail providers support the plus-alias.
Using dummy or temporary addresses against spam and registration walls
I don’t know how you do it, but it frequently happens that I need to download a “free” white paper, which only seems to be free if you ‘pay’ with your contact details.
In most of the cases, they force you to “consent” with the requirement to send you marketing,… in GDPR terms it’s not considered consent if it’s forced… But essentially they force you to submit your personal data.
If you don’t want to disclose your data, just for that single download, or … if you want to avoid getting too much spam, what do you do?
One-time use, temporary mail domains (not your own domain)
First and easy option is to search the internet for “temp mail”, “temporary mail addresses” or “disposable mail“, … synonyms for one time use mails.
You use these addresses for quick use, one shot hit.
Samples:
- mailinator.com
- temp-mail.org
- guerillamail.com
- mail.tm
- many more…
Use your custom domain
An easier, but less free, but still cheap option, is to purchase your own custom domain (on the condition you can have multiple mailbox aliases).
The quick and dirty: create an alias like download@yourdomain.url, keep it disabled by default and only enable it when you need to receive a download link. Afterwards, disable it again.
In some cases you literally need to have a mail address just once. Eg, when you want to download a “free” white paper, many companies harvest your mail, put it in a CRM system and keep spamming you afterwards. It’s fairly difficult to escape the forced consent or registration.
Then you can use a temporary mail alias:
- you enable an alias or dummy address,
- register for the download with the alias/dummy,
- then disable the alternative mail address again.
That way the address cannot be harvested for spam or marketing you don’t need. Easy.
(When a address broker tries to use the disabled alias, they will get an NDR, non-delivery report, and delete the invalid mail registration from their farm…)
Advantages
Keep your inbox clean : Mail filtering using simple mail rules
One the most prominent advantages of using aliases is that most of the mail clients can use the receiver address (or alias) to filter and manage incoming mail.
Based on the target receiver alias, you can set simple rules to move incoming mail from your inbox to another folder.
Basically an mail alias offers a simple mailbox optimization technique to make your life easy.
Securing internet logins
Another major advantage of aliases: use it as an alternative identifier for single sign-on.
Instead of logging in to multiple platforms with the same mail address, you better use 1 unique alias address per platform.
For example:
- linkedin@short.url for LinkedIn,
- facebook@short.url for facebook
- twitter@short.url for Twitter
- and so on…
Of course it’s quite important to use different passwords or authentication methods too (incl. MFA).
The main reasoning behind this approach is: if 1 login is breached or leaked, the other accounts are not impacted. If you don’t think you can manage this collection of passwords, there is one good tip: use a password manager to replace your memory.
Use a password manager anyway.
Detecting data breaches
When you use 1 mail address (alias) for every internet login, you can also trace very easily if a website is selling your data to partners, other companies or personal data brokers. You can simply see who sends mail, if that source domain is correctly linked to your alias… or not. If your login is used by unauthorized party you can initiate GDPR subject data access request to track how it got there (against both the original data controller and the secondary party).
And when using a custom domain (or some “+” alias mail providers), you can simple disable or remove the mail alias, so it becomes useless for the perpetrators.
On/Off Temporary mail (when using your custom domain)
In some cases you literally need to have a mail address just once. Eg, when you want to download a “free” white paper, many companies harvest your mail, put it in a CRM system and keep spamming you afterwards. It’s fairly difficult to escape the forced consent or registration.
When you can use a temporary mail, you enable an alias or dummy address, register for the download with the alias/dummy, then disable the alternative mail address again. That way the address cannot be used for spam or marketing you don’t want. Easy.
One-time use temporary mail domains
First and easy option is to search the internet for “temp mail” or “temporary mail addresses”
You use these addresses for quick use, one shot hit. No hassle, no admin. Quick and dirty.
Some more advantages
You can also link your custom domain to shortener tools like bit.ly. This way you can manage your social media and easily track your popularity or maintain statistics on your articles and views. (For Bitly, search for “bitly custom domain”)
Disadvantages
Custom domain management
Managing your own custom domain might be cumbersome, depending how user friendly the management of aliases is. Certainly managing dynamic aliases for multiple users… can time consuming. Certainly if you have a large volume of mailboxes and/or aliases to manage.
But managing a custom domain for own personal use, for a few bucks a year, is really worth the time and money.
If you cannot disable “+” aliases …
… then you might be in trouble, because you cannot stop the abuse once the senders have registered the alias in their mail system.
In many cases, you’ll need to unsubscribe or directly contact the platform owner and demand to remove your data, which can be cumbersome or time consuming… Or you need to excercise your right to be forgotten in the official way. (Ref. GDPR, …)
Temporary mail domains blocked & open access
The major disadvantage is that a lot of spam (eh sorry), marketing websites that offer these ‘free’ downloads, will recognize and block public temporary mail domains (like mailinator, guerilla mail, temp mail, …).
In most cases you’ll have to try a few options, as some of these temporary mail domains have alternative mail domain options, like dynamic domains not only hosting main on the master domain.
VERY IMPORANT SECURITY NOTICE: whatever mailbox you use on these temporary domains, anyone can read or access these mailboxes, so make sure nothing important or private is sent to these mailboxes.
Bonus: the “oh shit rule”
While I’ve been focusing on the security & data protection features of the mail alias, I still want to mention an important principle to protect your reputation: the “oh shit rule”.
The principle is simple: delay the sent articles with one or more minutes before the mails are actually sent to the receiver.
It gives you a bit of slack if you want to fix a mail, or in worst case scenario cancel the mail if you have second thoughts or regret sending the mail, to avoid embarrassment or being forced to search for a new job.
Some useful references
Below you’ll find some interesting articles on managing aliases on the well-known mail providers
Gmail
- Gmail “+” alias: https://support.google.com/a/users/answer/9308648
- Gmail variations: Dots don’t matter in Gmail addresses
Microsoft Office 365 “+” alias
Yahoo
Other providers
Other providers, like Protonmail, … also provide the alias “+” option, sometimes by default. Carefully check if you can remove the “+” alias or not, in case the alias got listed by address brokers.
Custom mail address RFC standard
https://tools.ietf.org/html/rfc5233
BTW, did you know… that following the RFC standards, an email address is case sensitive. 😉
Identity Underground 