Hacker News

I self-host my own email server (against The Greater Internet's better judgement, it feels) and one of the neat things I can do with Postfix is set any arbitrary character as a username/junk separator.

Gmail has supported this for a long time with the '+' character, but this has some major problems. Many things that accept email addresses don't recognize '+' as a valid email username character and won't let you submit the form. I hypothesize that some of this is poor awareness of what constitutes a valid email address, and some of it is intentional to force users to input their "real" email address. I have also run across a few systems that stripped off the '+' suffix off my gmail address.

My solution is to use the '.' as the separator because 'firstname.lastname' is a VERY common email username and I'm happy to not allow it in a "real" username on my tiny mail host.

So every new site or company I interact with gets [email protected] instead of my "real" email address. I can filter incoming emails based on the To header. And I even have a list of companies (a couple well-known) that have leaked or sold my email address to spammers. Some day I'll write a blog post about that.

I use canaries. I point a dozen domains to fastmail and another dozen to my self hosted email servers. Each have aliases that are mapped to vendors but do not have the vendor name as some vendors are getting upset at this practice and calling it fraud. If I start getting garbage on that alias, I notify the vendor. In most cases they will give me a boiler plate response and then I delete the alias. If they are snarky I create a reject rule with my own snark that also explains the emails for that vendor have been either sold or compromised. This is to let people buying email addresses know they bought a dirty list as some of the modern bots have some telemetry.

I run my own IT. I host my own email, authoritative DNS, web, etc. I use wireguard for a lot of stuff. I put stuff behind cloudflare. I'm sneaky when I need to be, but mostly I'm just a control freak. I also know way more than the average person about email and email authentication. Or lack thereof.

Every entity gets it's own email address. As others have pointed out, it lets me track who ends up with it. Sometimes I find it surprising, mostly I don't. Sometimes, though, people are up to some shit.

edit to say that those actually creating mailboxes for everything should just use aliases that funnel to a single mailbox. So much easier to maintain than having to have a huge keepass db.

edit 2 employ dmarc if you want to see who is trying really game

I care. I use a generated email address at my domain for every account/service/website. I store the account info in keepass, they all have generated passwords too. I can see when email comes in who abused the email, was compromised, or sold it. If an email starts getting spam, i block receiving to that address. if desired, I update the account to have another generated email, but usually if I'm getting spam to that email I don't want to do business with them again.

I do not. I have three mail boxes, for trashy, job-y and personal things. And a couple of technical (apple id, etc).

Gmail is really good at filtering spam, so I probably looked into it and found a letter that I waited for only one time in last few years. My inboxes are either empty or may get first non-spam marketing emails that I unsubscribe from immediately. Unread count zero.

Idk why people fortify their email that much and investigate who does what. Have no issues nor hesitation with leaving my work email at any local org.

I've seen quite a few people here reccomending the use of . and + from gmail, but I don't think its a good idea at all.

Most people who work in the 'email marketing' space know about this feature. So it's common to see people recommending clients to 'clear' their email list before sending unsolicited emails. And some services even offer this as a feature in the platform.

And that also goes for custom domains hosted on gmail. You only need a MX query to learn who is responsible for mail handling in a specific domain.

I used to use a catch-all with a custom e-mail for every website I used. I had amazon@mydomain, newegg@mydomain, etc.

I found that despite what people think, your e-mail address isn't being sold. At least, not by any vendors with a remotely decent reputation. I never got spam to any of those e-mail addresses.

I do, I use Fastmail and create aliases for every service. It's interesting to see how fast companies will "lose" or sell your email address.

I've seen it as fast as 24 hours my unique email address is being used by others even though their privacy policy says that they will never share your info.

Yes.

I use a catch-all. I can accept (whatever)@mydomain.tld

Anytime a new company wants my email address, I just randomly give them one.

So far I only get spam to the email addresses other people posted on a website as contacts for organizations I volunteer with.

(I get spam from web scraping, not from company hacks/sharing etc.)

The important detail is to add random nonce/salt to the generated email, like _jri68, so that it's not guessable, so it's provable that the database was compromised. Guessing [email protected] is believable, but guessing [email protected], is not.

My strategy is to use a few alias for sources with spam risk like forum, sign up on “free” offers etc., some for newsletters. When I’m suspicious but not sure, I quickly add the +. Only for very few official transactions, I would use my real addresses. In general, Gmail deals very well with spammers. For the rest, when an alias is spoiled, I simply discard it and create a new one.

I don't care. Even if I get to know for sure the culprit who sold or shared my email address, then what?

Occasional use of plus addressing but I find a lot of signup forms now actively block this. Also have a secondary crappy gmail address that I use for low value stuff that is sus. (That’s full of spam and has multiple hits on have I been pwned)

Beyond that I don’t worry about this too much.

As a side note - amazed that iPhone autocorrect corrected my “owned” to pwned in above

Fastmail offers per-service generated addresses. I think it's kind of fascinating to watch my email address that went solely to my local credit union start sending me spam somewhat related to my employer.

I also have an @ alias on my domains, and give unique addreses to companies/services which identifies them. I'm only had a couple accusations of "fraud", but they were easily dispelled by asking them to explain what "fraud" I was committing (they couldn't) and explaining why I do this.

Addresses which have been lost/stolen and start receiving spam become spam traps, and I change the email address with the company/service to a new alias so their legitimate mail is delivered normally.

In some of the few cases where the loss/theft was identified, it didn't happen at company/service directly, but with one of their suppliers, for example, a breach at the marketing email provider they used.

I've used spamgourmet.com for many years (Literally decades, my first entry was 2003-08-07) to create disposable email address. You just make up the address "[email protected]" to create an email address for tempsite that expires after 4 uses. You can always remove this limit later.

My message stats: You have 245 spamgourmet address(es). 827 emails forwarded, 28,605 eaten.

The #1 worst offender for selling my address was Yahoo, followed by the German magazine Der Spiegel, then Groupon. But my stats go back 20 years, so this may not represent current sharing activity. I also have many many examples of registering at all kinds of sketchy websites that have never used that temp address beyond the initial registration confirmation..

Sorting by created date, in the most recent 5 years, my temp addresses seem to be getting shared and re-used considerably less frequently, which probably correlates to the overall death of email, which is for old people, so I am told.

Fastmail let's you set a wildcard when you bring your own domain. Same outcome as other's mention - [email protected] is my spotify email address. I make it up during login creation and it just works. I've used this technique for every login but not once has it resulted in traceable spam. Logins are all tracked in keepass.

I self-host so that I can set the addresses to whatever I want it to be. I use the ISP's server for sending and my own server for receiving (this can be configured with Exim).

Then, if I receive some spam messages, I can delete an alias that I don't want, in order to avoid receiving any messages.

(When someone sends to an invalid alias, the SMTP server gives them a 550 error.)

(I use Heirloom-mailx for reading, managing, and sending email messages.)

I care but don't have time or the resources. What I have made a habit of tho is registering to any new website or service using example [email protected] → register using [email protected]. I then take note of which variant / which service.

I have no idea if this works the way I expect it logically could or should, but if it does I guess I have some data to go thru.

Not any more. Dark web rollups include just about everything you could ever want to know about anyone. Using a unique address per service just makes it easier to identify which services you use.

My friend Ward was doing sub-addressing back in the 1970s, with made up apartment/box numbers, and eventually the xmodem.com domain. He learned quite a few things about it.

For instance, if you look at the article he wrote about CBBS[1], you'll see he's listed at apartment #3D.

I never took up the practice, though I suppose I could having the warot.com domain to play with, and a single family residence to make up PO boxes, apartments, etc.

[1] https://vintagecomputer.net/cisc367/byte%20nov%201978%20comp...

I do not regularly track, but I do reflexively create throwaway emails at a domain I bought for that purpose, so that I can /dev/null them if/when someone sells that email address to a list.

Yes, I’ve done this for years. And to be honest, I don’t think I’ve ever “caught” a business sharing a service when they shouldn’t have. Makes me question why continue to do it.

When I learned about public git commits "leaking" my email address it was already too late. Now I'll probably use that email for this particular task. And another sad thing, is that many spammers are picking up "support" email address from Google Play Store. Still waiting for a email service which would charge each spammer several dollars for "successful delivery", or plain "waste of time".

I have addresses like [email protected] directed to my email, which I use to register myself in "someservice". This is how I know where email was leaked and needs to be disabled. I use Protonmail basic subscription to attach my domain. Before that I was using rewriting rules in Postfix.

I have a public address and a private address. Gmail does well enough with spam filtering. I check it monthly and find some false positives. Nothing important though.

I can’t imagine spending more time on this, though.

Sure do - though I have my own domain, so I don't need subaddressing. If some address gets compromised, I just set it to bounce.

I used to, but it basically showed that no one ever gave away my email address to spammers, or at least if they did, the spam filter caught it. It's not worth it.

What's especially awesome is how many unsolicited emails don't have unsubscribe links in them.

Catchall for 25 years :) (on domainfactory - df.eu) each company/service gets their own email prefix, so I can determine spam and also filter unsolicited emails.

No, I absolutely could not care less. Its baffling to me why people do. There's nothing you can do about it, anyway.

I use Proton's email aliases for throwaway accounts, and I have a catch-all on my own domain and use custom email addresses (think [email protected]) for accounts that I intend to keep until I die.

Use unique plus addresses for each service that requests email address.

I use iCloud’s Hide my Email feature. So I have dozen email addresses and I receive email in the same inbox. I don’t care how my email addresses are used. The moment I see too much spam, I remove the email address.

for general purpose website signup not directly linked to my identity, I use Simplelogin. For real life personal stuff I just have a gmail. There is another dedicated email for open source work, plus a few historical email addresses which aren't actively used but still occasionally receives stuff.

I have a catch-all domain but I don’t bother to setup unique emails for each service. It’s too much of a headache and you have to ask yourself:

If I find out someone sold/shared/leaked my email what am I going to do?

Here the possible responses as I see it:

* Stop doing business with them - This is way easier said than done

* Be mad - ok, great, now what?

* Send a strongly worded email - again, so what?

* Sue them? - Good luck

Selling or sharing my email address is a shitty thing to do, but my recourse is extremely limited and really ends up with me just being angry with nothing to do about it. Given that I’ve decided just to not care.

There are many things in life that I once cared about or once got worked up about that I don’t anymore because I’ve realized that it’s just not worth it. I’ve tried to identify more and more the things that get me mad, but don’t affect any change and then purge those things from my life. Life is too short to spend your time worrying about things like who sells your email.

Lightly and calmly, meaning I have many aliases on my addresses on personal domains and I try to always give unique aliases (keeping some spare on purpose), but not always-always because I'm not enough disciplined and the track is very informal, when (very rarely) I see spam I know it's time to rotate the alias. That's is.

Of course if [email protected] write to my [email protected] I could try to locate who have sold/leaked my address but it's still vague, since Amazon, eBay, PayPal, have a gazillion of third party. If it's to [email protected] it's likely he was cracked and so on.

Yes every service gets a custom address.

It's also interesting that some services don't allow [email protected] for registration. (Can't remember which)

I care. Maintain a collection of emails per tier of service plus some Apple obfuscation.

I use Hey.com's "catch all" inbox for this but it's a bit janky. If you set up a "custom domain" Hey account, you can actually email `[anything]@yourdomain.com` and it'll arrive in the catch all inbox. (Not unique to hey obviously) It has the benefit that it's impossible to block, but Hey obviously doesn't really want me doing that since they charge per-email-address.

Paid 33mail.com account.

been running my own email for 25 years or so. been using "plus" addressing (actually hyphen) for approximately as much. got only few cases when email got sold/shared. biggest issue was linkedin email address leak a bunch of years ago, so i got a lot of spam to -linkedin@ alias . changed email on linkedin to something different, and old emails go to spam

[dead]