Hacker News Reader

Comment by jawiggins | Hacker News Reader

> If you use iCloud+ and Hide My Email, there is still time to generate more aliases on @icloud.com as the change has not yet landed and the rate limit for creating aliases is at least 30 per hour.

Part of the reason to use Hide My Email was that it made keeping myself private hassle-free. Making a system to pre-generate values and then catalog them for later use is quite the hassle.

View on HN

If you don't mind trusting another company with forwarding your emails, it's definitely less hassle to set up an equivalent service for yourself.

If you mean "set up an equivalent service" under your own domain, that's both less private and more likely to be blocked; there are a lot of services which, unfortunately, only allow sign-ups from big, well-known domains.

Are there really? I don't think I've ever encountered such a service in all the years I've been using an email address under my own domain. And blocking every email address that's not from a big provider means blocking basically everyone who tries to sign up with their company email, which might not be great for business.

I recently tried signing up for DeepSeek using my custom-domain e-mail address and the website said the domain is “not supported”.

Yes, espacially exotic tld. I have a ".email" domain name, and I get 2 to 3 instances a year of either rejected forms, or sneakier, just confirmation email that never come until I use a .com address.

I have a 3 character .com as my primary email... it gets rejected more often than I'd like... including at my bank :) I've got a longer more normal domain that I alias, but it annoys me none the less.

Have you got this lot sorted out:

  MX->A->PTR->A->MX
  SPF
  DKIM
  DMARC
  mta-sts - DNS and webpage

Also your IPs must be squeaky bum clean, ideally for several years. DNSSEC might help too. In the UK getting as far as DKIM is usually enough (plus clean IPs, even FTTC connections will work if static).

Within the last month both Mapbox and Etsy blocked my attempts to signup using a Proton Mail alias. How many services do you sign up for in recent years, on average? The practice is becoming incredibly common and more than likely you're just grandfathered in.

are you sure they're not just blacklisting protonmail vs. whitelisting known providers? ime a lot of sites block "temporary" or "anonymous" email providers

Etsy blocks my entire ISP (I know because my IP rotates almost daily) so I cannot even view their site at all, it just gives me a "you are blocked" page.

Camel camel camel wouldn’t send notifications to my hidden email. Works fine for my regular vanity domain.

in asia it is frequent that email domain is a dropdown not a type in

Asia is huge. Please be more explicit (if you can).

I have seen sites in both Japan and China limit signups to not only mobile-only provider-specific email domains, but also IP block everything but domestic mobile traffic as well.

Most of those services (mixi was one in particular I remember doing this) stopped this practice close to 20 years ago though, but some still remain.

I think it was partly due to the "Galapagos phone" era of pre-smartphones, where each carrier used slightly different mobile web standards (think WAP and custom emoji).

Here is a current help page for Mitsubishi UFJ bank that lists approved domains for both desktop and mobile use: https://faq.cr.mufg.jp/mufgcard/detail?id=4402

Here is a user complaining (with screenshot) that the mail magazine for tabelog only supports mobile provider email domains: https://king.mineo.jp/reports/13368

Another recent one is the login page for gravity.place has a dropdown for country codes (for mobile login) with only 6 options.

China, Japan ish are where I have seen it the most.

Weibo, Sina you get "Failed registration (mail not supported)" if you enter non-major provider. In china nearly everyone is using qq, 163, 126, sina. Probably >99%

I've been running my own mailserver on a firstnamelastname.com domain for nearly 15 years.

As far as I can tell, nobody blocks it. Google sometimes rejects emails where the from address doesn't match the real sending address, which is fair.

I guess the first couple of years were rocky, I hadn't figured out DKIM and SPF and all the other blood rituals yet. Back then I got blocked by Steam and banks. But ever since I set up the correct security it's been fine. Been my primary email for a long long time. All my online accounts are tied to it.

Incidentally, I also have free and unlimited aliases. But I don't usually bother because I have a rule to route all messages to unknown addresses into a special folder. I can give out any random address at my domain and it will always make it back to me. So much more convenient than logging into the website to generate an alias.

I did that too years ago, but the management of it was kind of annoying. DKIM was just getting introduced when I stopped using it. SPF had controversy. I understand both of those are awesome now.

The biggest issue was if your ip address got listed in a RBL (Realtime Blackhole List), and then nobody would talk to you. Some were easy to get off, others were permanent blocks, and I found those to be constantly interfering with the delivery of mail. At least the rejection would usually tell you which RBL blocked you.

Most RBLs are scams. No competent mail admin uses them to block mail ever.

…lots of major mail services do?

https://www.fastmail.help/hc/en-us/articles/360060591413-Spa...

https://senders.yahooinc.com/smtp-error-codes/

https://www.xfinity.com/support/articles/email-errors

Honestly those are used as weights now in some kind of obscure calculation (or maybe not so obscure calculation but I still don't understand it).

What I really learned during that time is that mail servers have well known IP addresses and reputations. And you can say all you want SPF/DKIM fixes that, but the reality is when google sends your email (even with your custom domain) it gets received.

https://sys.4chan.org/signin has a short list of approved email domains:

> Allowed domains are: gmail.com, hotmail.com, yahoo.com, proton.me, protonmail.com, outlook.com, live.com, icloud.com, yandex.com, tutanota.com, tutamail.com, tuta.io

I know a few. Heck, I’ve worked at such a place, we strictly checked MX records to make sure the email would be reachable, and catch-alls usually wouldn’t pass validation.

(I’m not saying we should have been doing that, but the company was in insurance and wanted to be extra extra sure.)

Nah. I have hosted my domain for 17 years on google and then fastmail. The hosting is harder than private relay, although not too hard.

But I have only had maybe 3 services ever reject my domain, and those were because the domain contains a number.

I've had some reject my e-mail address because it contains their company name. REI was one (ie it wouldn't allow rei@domain.com but would accept reicoop@domain.com)

I was just able to create an account using `rei@<mydomain>` on rei.com w/o any issues. Now, figuring out how to delete the account is another matter entirely...

Cool, they probably changed it, this was years ago. I've had similar issues with other companies, REI is just the only one I can I really recall right now.

I haven't had an outright rejection, but definitely a few odd moments with call center agents. "theircompanyname@myname.com" is definitely not the default expectation :)

Should have registered as rei-are-incompetent-idiots@ instead…

I had my account marked as suspicious and closed in a financial institution for this a few years ago. They were concerned I was a bad actor attempting to impersonate an employee. It was very annoying, because no one from customer support could talk to me directly, it had to flow through legal. Very stupid.

I have since stopped doing this out of fear that it will actually cause me more headaches with people/systems that don't understand how email works.

Within the space of 2 weeks I had both Etsy and Mapbox block signups with Proton Mail aliases. The practice is rapidly becoming more common.

Blocking signups from proton.me is not the same thing as only allowing signups from the big mail providers.

Great, so all I need to do is to authoritatively check each plausible combination of domains that _might_ work and rule each of them out before I can make my claim, according to you?

What a load of pedantry.

I mean none of this is accurate, but sure.

>there are a lot of services which, unfortunately, only allow sign-ups from big, well-known domains.

I have never encountered one.

Ars Technica is one you can test I believe. I think I had to register with Gmail and put in a support ticket to ask them to change it to my real email. I use Fastmail, not a selfhosted setup or anything, some services absolutely have a domain allowlist for email signup.

Popular gaming forums NeoGaf and Resetera only allow signups from paid email accounts. All free and temporary email providers are banned to discourage trolls / forum raids / alt accounts.

I've had my own domain for email for twenty years or so now, and I've encountered maybe one signup form that didn't accept it. What you're saying is definitely not true, and I would highly recommend using your own domain for email (preferably with Fastmail, it's fantastic).

Less private, but the most common case is actually anti-harassment.

Plenty of providers, but perhaps Apple needs to be forced to open up hide-my-email-providers for others.

Only the EU is capable of doing such thing

I have had my own domain for mail for 10 years. I have yet to ever see a service which didn't let me sign up with it. I'm willing to believe that such services exist, but I dispute the claim that there are a lot of them.

Are you sure you don’t have this backwards? Some B2B websites only accept sign-ups from domains not associated with Gmail, Yahoo, and similar providers.

You can sort of do this today with iCloud. Add a custom domain and enable the catch-all forwarding, and you can receive anything@domain.tld and it’s forwarded to you.

What you’d lose is the reply-to forwarding feature.

Yep, but I still generated some for myself just in case and fellow hackers can do the same if they want to.

iCloud+ was the best $1 / month custom domain email and email alias service with 100GB of E2EE cloud drive.

Obviously it will be sad to see it enshittified for seemingly no reason.

It's E2EE (only if you turn it on, which you can't do in the UK) but it saves (non-encrypted) the hashes of the plaintext of the files to Apple (presumably for dedup).

This allows Apple to see which sets of users share unique Winnie the Pooh memes. They know who had them first, who they sent them to, and when.

The E2EE is useless with such unencrypted metadata leaks.

https://www.youtube.com/watch?v=tL8_caB35Pg

> only if you turn it on, which you can't do in the UK

Fortunately changing Apple account country is as easy as buying US gift card on Amazon and unlike Google they dont mess with account location.

As about encryption I totally agree its pretty meh, but again it's not why I paid my $1.

It’s not based on Apple account country, and even if it were, it’s not nearly that simple to switch it.

Did you checked it? I did.

I do have Apple devices in UK that have E2EE enabled and it works just fine.

Switching account country is super straightforward: cancel subscriptiona, change address to US, top up with apple gift card from amazon us.

No US payment details needed.

I pay for the bundle, but HME was never hassle-free. I would say that it works on ~40% of form fields. Most of the time I never get the prompt from HME.

It’s also might obnoxious if you ever need to remove an email from that list (or, gods forbid, mass clean the list).

But okay, this update is even worse. I might just stop paying for the iCloud+ whatchamacallit and backup to my Mac like I used to.

Yeah, I have several dozen already—I suppose I can reuse those forever… I guess it's kind of cool having one-per-site though so you can tell who the "rat" is when one of your hide-my's gets spammed.

I have over 300 so far. In addition to knowing where spam is coming from, and being able to block it, it also helps prevent correlation across accounts and websites as data leaks occur.

we need s script to make date aliases for the next 10 years so one has a email for each day

is it possible to automate this

Reply on news.ycombinator.com