How email aliases stop spam at the source

Spam filters are triage. They look at each message after it arrives, guess whether you wanted it, and shuffle it into a folder you've agreed not to look at. The mail still arrives. The sender still has your address. Next month they sell it to someone with a slightly different template, and the guessing starts over.

Aliases work on the other end of the pipe. Instead of one address that everyone has, you give every sender their own address that only they have. When one of those addresses starts misbehaving, you don't filter it — you turn it off.

The mechanic

Say you're signing up for a hardware store's loyalty program. Instead of your real address, you create an alias — something like hardwarestore@emailforward.xyz. Takes a few seconds, no account needed. Mail sent to the alias forwards to your real inbox; the store never sees your actual address.

Now that alias has exactly one legitimate correspondent. That's the whole trick. Everything that follows falls out of it:

• If spam arrives on hardwarestore@, you know the store leaked or sold your address. No forensics required.
• If the store gets annoying but you still want order confirmations, you add a per-alias rule — block specific senders, or drop anything whose subject matches a regex like (?i)sale|% off.
• If you're done with them entirely, pause the alias. Mail to it stops forwarding. Unpause whenever you want it back.
• If you're really done, delete it. The address stops existing.

Compare that to the filter approach, where "done with them" means an ever-growing rule list and a spam folder you audit out of guilt.

Why filters can't do this

Filters have a structurally harder job. They have to classify mail from an address you can't retire, which means every decision is probabilistic: is this newsletter spam, or the receipt you actually need? Get it wrong one way and you miss a password reset; get it wrong the other way and the pharmacy ads keep coming.

An alias decision is binary and yours. This address exists or it doesn't; it forwards or it doesn't; this sender is blocked or isn't. There's nothing to misclassify because you're not classifying content — you're controlling the address itself.

The two aren't rivals, to be clear. Keep your spam filter; it's still useful for cold spam sent to addresses you do want open. Aliases just shrink the surface it has to defend.

The compounding part

The first alias saves you nothing. The fiftieth is where it pays off.

After a year of one-alias-per-sender, your real address is known to approximately nobody commercial. Every marketing database, every "partner offers" list, every breached customer table contains an alias instead. And each alias is individually revocable, so a leak anywhere costs you one deletion, not a new email address and six months of migration.

This is the part filters can never give you: your real address stops being in the datasets at all. You can't be spammed at an address the spammer doesn't have.

What this looks like in practice

A workable routine, if you want one (there's a longer guide on this):

1. New signup → new alias, named after the site. Tags and notes if you're organised; the site name in the address is usually enough.
2. First spam on an alias → check the message history for that alias, confirm the pattern, add a sender block or pause it.
3. Alias for something you no longer use → set an expiry date or delete it.

Each alias forwards to up to 6 destinations — regular inboxes, Telegram chats, or webhooks — and forwarded mail has tracking pixels and tracker parameters stripped on the way through. You can reply from the alias too, so even a back-and-forth with a merchant never exposes your real address.

The honest limits

Aliases stop spam that targets an address you gave out. They don't stop:

• Spam to your real address if it already circulates from years of normal use. Aliases stop the bleeding; they don't undo old leaks.
• Dictionary-attack spam sent to guessed addresses. Rare in practice against random-looking aliases, but not impossible.
• SMS spam, robocalls, or anything outside email. Different problem, different tools.

And there's a small ongoing cost: ten seconds of alias creation per signup, and the occasional "which alias did I use for this?" moment (searchable, but still a moment).

Where to start

You don't need to migrate anything. Start with the next signup: create an alias instead of typing your real address, and see how it feels. The getting started guide covers pause, rules, and the rest.

The realistic promise isn't "zero spam forever". It's that every future piece of spam arrives with a return label showing who caused it — and a switch that makes it stop.