Same. I've done this for years with my crappy namecheap web host email. Works great. Pro tip. Just setup a subdomain on a domain you already own. This makes filtering even easier.
Another +1 for paseo. I've been dabbling with all these tools and I love how they are progressing. But im constantly patching and filing issues on them. Only paseo and openchamber handle mobile terminal scolling well. Paseo has been the most feature complete one with claude and open code support with a top notch mobile experience.
Originally inspired by the stream deck, but I wanted a more dynamic interface and less hardware restrictions. For example you can use your phone as the controller.
Now it can do a whole lot more. Including mouse, keyboard, media controls. Supports custom buttons types and things like sliders and color pickers. Dynamically switches layout based on foreground app, and can also control which app is in the foreground from the controller itself. Having a lot of fun so there are a bunch more features in the hopper like deeper app integration, and an eink version.
Pro tip for doing something like this without apple. Buy or get a cheap domain name. Create a subdomain on it and have it catch and forward all messages to you when sent to that sub. For example:
The problem is if someone figures it out and starts sending you spam to {random}@domain.tld. That's when you will need to sit down and start creating actual aliases for all those used email addresses and stop the catch-all forwarding:)
Also, another downside is that you will loose privacy by using your own domain.
And the lack of privacy makes targeted scam/phishing more likely, and targeted scam is the one we are most susceptible to.
All in all, I am not saying this is bad idea, in fact I am doing it myself, just pointing out this is not so black and white.
Using iCloud solves those problems, but puts you at risk of getting your account banned and loosing access to those emails, so there is that.
Probably best way to deal with it is to get dedicated email domain with a bunch of your friends, and hook it up with something like SimpleLogin. But that's gets complicated quickly ;)
I have run this for years with very little problems. And I can honestly say that have not found anyone writing to addresses I did not give them at their domain. Simple as this is, it is way to niche for companies to figure it out and exploit it. And if that really was a problem I'd just create a new subdomain.
If you are worried about privacy, get a domain just for this. Use domain privacy and dont host other things there.
Yes, some sites whitelist domains or dont allow subdomains. For those I'll use another account - or a firefox alias or something. But 9 out of 10 work fine.
I am not a fan of alias services since materializing names takes discipline. How many do you make? Maybe there is a limit of 50. When do you share them across services? My guess is many people just create 2 or 3 aliases they use for everything - which defeats the purpose. Sure, it masks your personal address, but once one gets compromised, you find it basically served as your personal address anyway.
I also dont really keep track of most of the names I use. Since most are one time things that I would never use again, like to sign a waiver or something. But I mostly stick to '{domain}@' for the names. So my nytimes account would just be nytimes@, which is predictable when I need to recover it. I used to use addy.io for this, but it was not as good since it had account limits and I had to manually manage every alias. Much easier for me to just create a mail filter to sinkhole an old name. Of course I have never really needed to do this anyway.
> I have run this for years with very little problems. And I can honestly say that have not found anyone writing to addresses I did not give them at their domain. Simple as this is, it is way to niche for companies to figure it out and exploit it.
Someone I knew did this. Spammers used lists of common names.
I've found using a subdomain helps with that, spammers will try [email protected] but won't bother trying to brute force subdomains.
However be warned some surprisingly large websites don't support subdomains, for example eBay will silently send [email protected] to [email protected] and you'll only figure it out by looking at your server logs for rejected mail.
In those cases I have to specifically alias that [email protected] to the subdomain.
With this new Apple privacy subdomain maybe eBay will finally fix this.
Because the world runs on incompetence, so it's ultimately unavoidable (best case, you don't know that something important that you're relying on is run incompetently).
WHOIS isn't a factor here. If an attacker knows or deduces that you're the only individual receiving mail at *@yourdomain.example [1], they can track you across different databases by just looking for your domain name.
The privacy preserving aspect of hide-my-email services is the fact that they have thousands of users using the same domain name.
[1]: This is trivial if you have a service's email database leak. You just find all domains that have exactly one user. If the service targets individuals (who would sign up with personal emails, not work emails) and is reasonably popular, you'll get a pretty good list of single-user domains.
> If an attacker knows or deduces that you're the only individual receiving mail at *@yourdomain.example [1], they can track you across different databases by just looking for your domain name.
How would that attacker gain access to such databases? Let's say HN is compromised and my email here, say [email protected], is leaked. How does that help you track me elsewhere? If I start receiving spam at [email protected] because of the leak, I will simply revoke the alias and the spam will bounce.
> How would that attacker gain access to such databases?
Data breaches happen all the time.
Some services also expose emails, intentionally or unintentionally. Github is one example where your email might be exposed publicly.
> How does that help you track me elsewhere? If I start receiving spam at [email protected] because of the leak, I will simply revoke the alias, and the spam will bounce.
Because, as parent said, if someone deduces that you are the only user of mydomain.com, they can just search leaked or exposed records for @mydomain.com and infer that the accounts most likely belong to the same person.
That's the difference, with hide my email millions of unrelated people share the same domain, so you can't reliably link one email to another just based on the domain.
> The problem is if someone figures it out and starts sending you spam to {random}@domain.tld.
It's a non-issue. I've been using a catch all domain for at least a decade. I get a small amount of spam to random made up emails but not enough to care about plus it all gets caught and filtered.
I do this. The awkward thing is when I am in person or on the phone and have to explain that my customer email address is [their_business_name]@my_weird_domain.tld
But the people usually just nod along.
The other downside is that it's forward-in only, wish I could proxy responses without setting up a whole new inbox (and outbox).
> The only awkward thing is when I am in person or on the phone and have to explain that my customer email address
I had one small business aggressively threaten me that they fully owned their business name and I wasn't allowed to use it in my email address.
My solution was to keep my wonderful aliases and dump them. If a business is concerned but nice about it I'll offer an alternative such as plumber@
> The other downside is that it's forward-in only, wish I could proxy responses without setting up a whole new inbox (and outbox).
If you have your own domain most mail providers don't care what username@ you use on your sent mail so you shouldn't need any additional mailboxes (especially if they already offer inbound catch all)
I also use the ReplayAsOriginalRecipientUp [1] extension in Thunderbird which takes the recipient address and puts it as the sender for ongoing communication.
> I had one small business aggressively threaten me that they fully owned their business name and I wasn't allowed to use it in my email address.
I haven't had that, but before I switched to Hide My Email I've had many businesses ask if I was an employee of the business - many people don't intuit the difference between [email protected] and [email protected].
So I guess I'll take a moment and plug my email provider, Fastmail. Their integration with 1Password to enable creation of Masked Email at account creation time is really fantastic! I have several hundred of these at this point, it's made my digital life appreciably better.
But to the point of forward-in-only -- I use the fastmail web client and iOS client. Both of these respond using the Masked Email address if you choose to respond to an email. In fact I can choose any of my masked email addressed as I am composing mail to initial communication from that address.
In short, "it just works". I really can't say enough good things about Fastmail!
Just happened to me today! I was at the Verizon store and my address was verizon@... Sometimes it leads to confusion, but sometimes it leads to getting extra special treatment actually! They think I'm someone important.
Not really, this only works for other emails hosted by Gmail (including Workspaces) or if you supply SMPT that will send those emails. If you use simple email forwarding from your DNS provider, you don't have SMPT server to give to gmail:/
Google will happily send from smtp.gmail.com, after verifying that you own that email. You won’t get DKIM, but Google’s reputation is enough to make the mail land in people’s inboxes.
I do something similar, use an open source service called addy.io, bought a domain but you can also use their domains too, and each website has a separate login i create through bitwarden with the addy integration.
DeepSeek didn't always have a whitelist. At some point they went crazy due to spam, started requiring Chinese phone numbers only, and then loosened it to an email domain whitelist. (IIRC)
If you try to sign up with a domain they don't support, they tell you something like "please use a popular email provider like gmail"
This lacks the easy control over blocking the “aliases” you’re done with.
The real pro tip is to use this domain with something like addy.io (paid or self-hosted) where you can either pre-create the aliases or have them dynamically created for you as they become used for the first time - and having control over each of them so you can block it when you want.
I have never had to do this in my years of using this scheme. And if I did, I would create an email filter. Which I consider to be more standard and scalable then managing a bunch of individual aliases.
This is absolutely not difficult to get right. Run OpenDKIM and OpenDMARC on your server along with your email stack (I use Postfix and Dovecot). Use a tool such as mail-tester.com to verify compliance.
Looking forward to use all these nice AI features without using the warp account/service. So I can bring my own claude and it will show all the agent panes etc.
reply