One email address per service with your own domain and Fastmail

When a website gets hacked, your email address often ends up in a database that circulates on the internet. Spam follows shortly after. With a single address for everything, you can neither tell who lost it nor do anything about it without changing the address everywhere.

My approach: every provider gets its own address, all under my own domain.

The principle

The address is the provider’s domain in front of the @ of my own domain. For signing up with bank-xy.ch, that is [email protected]. All mail lands in the same mailbox. The result:

Leaks are traceable. If spam arrives at one address, I know which provider it leaked from.
I can switch off one address. Only that address is blocked, all others keep working.
I can reply from each of these addresses.

The last point was the decisive one for me.

How I got here

All-Inkl: My mailbox started out at All-Inkl. Its webmail lets you enter the sender address per message at the top. As soon as I connected the mailbox to my Google account or a desktop mail client, that stopped working properly. Many mail clients do not treat aliases as a separate option.

Proton Mail with SimpleLogin: Next came Proton Mail together with SimpleLogin. Receiving through aliases worked. To reply from an alias, I had to open the SimpleLogin app every time and create the matching address. That was too cumbersome.

Fastmail: With many providers you can receive through aliases but not reply from them. That becomes a problem as soon as a service only accepts replies from the exact address it wrote to. For a bank, that is the normal case. In Fastmail, aliases are a core concept: whatever can receive can also send. For me, that was the simplest solution.

What this looks like in Fastmail

Add your own domain. Fastmail then handles delivery for the domain.
Create a wildcard alias. Under Settings → My email addresses you create an alias *@my-domain.com. Every address on the domain then lands in your mailbox. Wildcard aliases require a domain of your own.
Pick the sender when writing. With a wildcard alias you can type the sender address freely, even if it never existed before.
Switch off one address. You create exactly that address as its own alias and set it to Disabled. Mail to that address is rejected from then on, all other addresses on the domain keep working. A specific alias always takes precedence over the wildcard alias. Details are in the guide to aliases.

According to Fastmail, new aliases take up to 15 minutes to become active.

Order when switching off

Before I disable an address, I first change it at the provider itself. Otherwise I stop receiving mail there, including the mail for resetting the password. Only then do I set the old alias to Disabled in Fastmail.

Fastmail and 1Password

Fastmail also offers Masked Email: randomly generated addresses that can be blocked or deleted individually. 1Password can connect to Fastmail. With the browser extension, you then create a new masked address right when signing up on a website, without leaving the page. Address and password end up in the same entry.

The price

The system only works if I know which address belongs to which provider. With dozens of accounts, you cannot keep that in your head. For every service, address and password belong together in a password manager. How that works is described in the article Password manager for beginners.

Tip: unsubscribe from marketing right away

After signing up with a new service, marketing emails often follow. I open the first one, scroll to the very bottom and click Unsubscribe. That takes ten seconds and keeps the mailbox clean.

This works because providers are obliged to offer it: under Swiss competition law (page in German), mass advertising by email requires consent, a clearly identifiable sender and a simple, free way to opt out.

One limitation applies: only click Unsubscribe for services you signed up to yourself. With mail from unknown senders, you may confirm that your address exists. Mark such mail as spam instead.

Conclusion

The effort lies in the setup and in the discipline of using a new address for every sign-up. In return, when there is a leak I see immediately where it came from and can end it with one click.

If you would like a similar setup for yourself or your team, get in touch.