Comment by MrWiffles | Hacker News Reader

Comment by MrWiffles | Hacker News Reader

Parent Full thread

I already was doing something similar and have been for what…5 years I think? Anyway, I have an account with Fastmail and my own domain configured with their “catch all addressing” feature, such that anything before the @ doesn’t matter, it ALL goes to me and only me (I’m the sole user of said domain). So I can do things like apple@mydomain, microsoft@mydomain, playstation@mydomain and so on to both keep each address separate from the others and so if there’s a breach or other shady shit going down, I know at a glance who’s responsible and this have some idea of my exposure risk. Ideally though I’d like to be using UUIDs before the @ so specific targeting by guessing something like “I’ll bet his Venmo account is venmo@“ won’t be possible, I just haven’t started doing that yet.

Lately I’ve been combining this with cards via privacy.com to further limit my risk in the event of another data breach, and so far it’s working quite well, though I do have a long way to go to fully convert everything.

As for longevity, Fastmail has been around since 1999 in some form or another, and even made themselves independent again after being acquired by another company through an employee buy-out. https://en.m.wikipedia.org/wiki/Fastmail

In addition, wildcard forwarding isn’t a perfect substitute because email spambots love sending to addresses like webmaster@mydomain.com or john.doe@mydomain.com. The number of permutations they try is varied enough that an explicit allowlist is a must.

Just use something like 'servicerelay-<randomdigits>@yourdomain.com' and setup spam filtering rules that lets pass everything received at 'servicerelay-*' and delete or reject everything else.

Adding my disagreement to the chorus— the number of permutations they try on my personal domain is not high enough to warrant an explicit allowlist. I actually don't even have a blocklist; I simply don't receive that much spam.

Most of it comes to two addresses which are public via git (one from commit logs, the other explicitly stored in a repo).

I do what the GP said and I haven’t any problem with “guessed” addresses like that. I do have a problem with obvious spam from a GMail account (which is setup to forward to my domain), so, go figure.

Not an issue for me, so far. And I have been using that domain for over 5 years now.

you can block a specific alias or address from receiving mail in the mail rules, even if you have wildcard rules setup

Have you encountered issues with signing up with certain services? I know a few run checks to see if the domain is a catch-all (eg. sending to `pwgen`@domain.example and checking for a bounce) and will block signup when that happens.

I've been doing the catch-all signup for over a decade myself and haven't had any issues. What service checks stuff like that?

I can't find it now, but there was a mildly populae HN thread about a service that does "email validation" and part of it did catch-all detection, and there do seem to be other services that market this[0].

0: https://www.email-validator.net/blog/validating-catch-all-em... (warning: annoying marketing page)

But do you have a chrome/FF extension that makes it easier to use? Or do you just own your own domain name?

Reply on news.ycombinator.com