Hacker News Reader

Comment by Ringz | Hacker News Reader

It's been like this for years. However, with one of my own domains and a catch all rule in the e-mail server. Why? From time to time, some services require that you send emails with exactly this e-mail address as the sender. And that doesn't just work with most services. Because in such a case, you have to turn exactly this e-mail address into a real account with a mailbox.

View on HN

For me, the value of using aliases on my own domain isn't anonymity, it's provenance; I can tell where my email was obtained from based on the the prefix used. If I get an email sent to git@<domain>, I know that someone (or something) was looking at git logs to get it, if it's sent to resume@<domain>, I know someone got it from my resume, etc.

Pretty much my exact same reason, plus the separation of concerns concept. If a service got breached and that email leaked, I don’t have to worry about using that email to brute force other services.

In most cases you can have the same level of provenance with a plus addressed email, without needing to support a custom domain.

I'm not sure if the comment I replied directly to got deleted or if I accidentally replied to the wrong thread or something, but for some reason I thought I had replied about provenance specifically in response to a comment saying that separate prefixes didn't provide anonymity. Using a custom domain is mostly a fun novelty for me, and if separate prefixes didn't provide any value, I'd still just use use a single prefix on my custom domain because I like it.

I bet no spammer or salesperson would ever think of replacing such a generic localpart to get to your eyeballs.

Why would they want to spend effort trying to brute-force addresses to show me emails that they already have the ability to sent to me and I didn't generate them any revenue from?

No idea, just pointing out it is such an obvious alg it doesn't really show provenance.

I used similar (well, plus addressing with localpart=name+<service>) a long time ago and once got emails to name+paypal@example.com even though that was a suffix I'd never used. Some enterprising person out there had obviously obtained one or more of my service-specific addresses and was trying to game my attention by changing the identifier to something 'important'. That's when I personally ditched the approach.

"Provenance" might be have been a bit too strong; maybe I should have said "strong signal". It's an additional piece of info that will almost always identify the source, but in the rare exceptions it's not any worse than if I just used a single address for anything.

I've used <site/company>@domain.com for many many years and never had someone do that.

Spammers simply obtain lists of emails through hacking or purchasing them and then spam them, they don't pick a particular address and modify it.

Spammers who just blast stuff out won't do it, I'm sure.

But as a counterpoint it literally happened to me to me years ago when I used to use name+<service>@exmaple.com. I got cold emails to 'name+paypal' despite never, ever having used that localpart. I've no doubt it was absolutely targetted and not a hit-and-hope spamblast but it was enough of a wake-up call for me to realise it couldn't really be relied on.

I’ve been doing this for years and have never had any problems with it. It is more likely that generic emails will be generated if you have a domain that is also present as a public website on the internet.

In principle, someone seeing heido15wkj6@yourraredomain.com, yua16ooaaj2@yourraredomain.com, and kqoq91inhi4@yourraredomain.com in a dump might be able to infer that all of these belong to the same user with a catchall address (especially if they can verify that the domain is unpopular via dns caching or other tricks). Using a common service adds another partial layer of anonymity between the email addresses, making one harder to track.

Especially necessary when your domain is your full name. It's painfully obvious that all addresses under the domain belong to a single person. I've been using Fastmail's masked email service for a while to hide my personal domain. And before that I had a handful of gmail addresses that I set to forward to my main address.

Theoretical yes. But never had that. It is more likely that generic, non existant emails like info@domain.com, admin@domain.com, etc. will be generated if you have a domain with a public website.

AFAIK Fastmail is the only service that allows you to respond from an arbitrary email address (of course, provided that you prove that you own the domain).

You can do it in Office 365 but it's tedious, you have to add the alias and then you can email from it.

I’ve been doing this with SimpleLogin for years. I’d expect anonaddy to be able to do the same.

You can get a complete web server with a domain for less than SimpleLogin charges for that service.

I can do a lot myself. Or pay somebody less than a meal costs to do it for me and not have to worry about my emails.

Gmail for domains allowed the same, you had to add the alias and then you could email from it.

Startmail.com and Protonmail.com allow responding from alias email addresses.

If you do that with a good web host [1], its cheaper than Fastmail or any other mailservice.

[1]:https://www.hetzner.com/webhosting/

I am not affiliated with Hetzner.

Firefox Relay Premium lets you do it

https://relay.firefox.com/faq/#:~:text=can%20i%20reply%20to%...

Not necessarily. You can for example configure both Thunderbird and mailcow to allow you to reply from any address (of the domains you manage, of course), without having to create the mailbox.

Creating a mailbox is effortless. At least at my web host.

addy.io allows you to send email from any of your aliases. It’s a little clunky, but it’s the sort of thing I do so infrequently I don’t really mind.

https://addy.io/faq/#how-do-i-send-email-from-an-alias

But only for 30 aliases for 4$/month.

Reply on news.ycombinator.com