Email Masking and Relay Services

In short. Masking puts a middleman address in front of your real one. The address changes, the mailbox does not, and that difference decides everything about when masking helps and when it quietly fails you.

What masking actually does

You give a site an address that belongs to a relay service. Mail sent to it is forwarded into the mailbox you actually read. The site never learns your real address, and you never have to check anywhere new.

The important consequence is in that last sentence. The mail keeps coming. A masked address is not a shield against a newsletter, it is a switch you can throw later. Until you throw it, everything the sender sends still lands in your inbox, tracking pixels and all.

The four kinds you will run into

Built into the platform. Apple's Hide My Email, and the equivalents shipped with browsers. Convenient to the point of invisibility, because the address is generated in the signup form itself. The catch is that they belong to the platform, and leaving the platform means dealing with every address you created inside it.

Built into a password manager. Several managers generate a masked address at the same moment they generate the password. Excellent ergonomics: the two things that identify an account get created together and stored together. Usually implemented by partnering with a relay provider, so you are trusting two companies instead of one.

A standalone relay service. Products whose entire business is forwarding. They tend to have the most features: replying through the alias, per-alias statistics, catch-all subdomains, PGP. You are trusting a single small company with the routing of your mail.

Self-hosted, on your own domain. Open source relays, or simply a catch-all mailbox. Nobody to trust but yourself, and nobody to fix it at two in the morning either. Also the only option where the addresses survive the failure of any company.

Where masking breaks

Replying. The site emails you at the alias, you hit reply, and without special handling your real address goes out in the From header. Good relays solve this by routing replies back through the alias. Simple forwarding setups do not, and one careless reply undoes the whole arrangement.

Ecosystem lock-in. Platform masking is the most comfortable and the hardest to leave. Addresses generated inside one company's system generally cannot be moved to another, so switching phones or browsers can mean changing the address on every account you protected.

Losing the middleman. If the relay service shuts down, is bought, or simply locks you out, every address stops forwarding at once. This is the failure mode people underestimate, because it takes out dozens of accounts simultaneously and you find out through silence rather than an error message. It is also the reason the hardware in your house is better bound to a mailbox you hold directly than to any relay, since a thermostat can outlive the company forwarding its password resets.

Forms that refuse relay domains. Masking domains are widely known, and a growing number of signup forms treat them exactly like throwaway domains. The detection machinery does not care that you paid for the address.

What masking does not do

It does not make you unlinkable. If forty aliases all forward into one mailbox, anyone with visibility into that mailbox sees one person. Masking protects against the sender learning your address, not against correlation by someone with a wider view.

It does not stop the sender from profiling you. Your reading behaviour, your IP when you open the message, and everything you typed into their form are unaffected by which address received it.

And it does not delete anything. Storage keeps growing, because forwarded mail is real mail in your real mailbox.

When masking beats a disposable address

We run a disposable service and will still say this plainly: for anything you expect to keep, masking is the better tool.

Subscriptions you will renew. Shops you buy from more than once. Any account with a password you might reset. Services tied to money, delivery or identity. A job search, where the reply you actually wanted arrives three weeks after you stopped checking. In all of these the address has to keep working, and an address designed to expire is the wrong instrument.

Masking also wins for the long game of finding out who leaked you: one alias per company, kept for years, and the day spam arrives at one of them you know exactly which company sold it.

When masking is overkill

One signup, one code, no relationship. Reading a forum thread. Downloading a file behind a form. Claiming a discount at a shop you will never visit again.

Creating a permanent alias for these adds an entry to a list you now maintain forever. Multiply by a few hundred over a decade and the list becomes its own small chore. A throwaway address leaves nothing to maintain, which is the actual argument for it: not privacy, tidiness.

What you are really trading

Both approaches move trust around rather than eliminating it.

With masking, you trust the relay operator. They see every message before you do, they know the map between aliases and your real address, and their outage is your outage across every account at once.

With a disposable address, you trust the operator too, but only briefly and only with mail you were about to forget. The exposure is smaller because the relationship is shorter, and because there is no map connecting the address to anything else about you.

Neither is a form of privacy that survives you handing over your name, your card and your phone number on the next screen. What both do well is stop the address itself from becoming the thread that ties one company's database to another's, and that is worth doing even when nothing dramatic is at stake.