Email Masking and Relay Services

In short. Masking puts a middleman address in front of your real one. The address changes, the mailbox does not, and that difference decides everything about when masking helps and when it quietly fails you.

What masking actually does

You give a site an address that belongs to a relay service. Mail sent to it is forwarded into the mailbox you actually read. The site never learns your real address, and you never have to check anywhere new.

The important consequence is in that last sentence. The mail keeps coming. A masked address is not a shield against a newsletter, it is a switch you can throw later. Until you throw it, everything the sender sends still lands in your inbox, tracking pixels and all.

The four kinds you will run into

Built into the platform. Apple's Hide My Email, and the equivalents shipped with browsers. Convenient to the point of invisibility, because the address is generated in the signup form itself. The catch is that they belong to the platform, and leaving the platform means dealing with every address you created inside it.

Built into a password manager. Several managers generate a masked address at the same moment they generate the password. Excellent ergonomics: the two things that identify an account get created together and stored together. Usually implemented by partnering with a relay provider, so you are trusting two companies instead of one.

A standalone relay service. Products whose entire business is forwarding. They tend to have the most features: replying through the alias, per-alias statistics, catch-all subdomains, PGP. You are trusting a single small company with the routing of your mail.

Self-hosted, on your own domain. Open source relays, or simply a catch-all mailbox. Nobody to trust but yourself, and nobody to fix it at two in the morning either. Also the only option where the addresses survive the failure of any company.

What forwarding does to authentication

This is the mechanical part most explanations skip, and it explains a symptom everyone using a relay eventually notices: masked mail lands in the spam folder more often than the same mail sent directly.

Sender authentication has two pillars, and forwarding treats them differently. The first checks whether the machine delivering the message is one the sending domain authorised, and a forwarder is by definition not that machine, so this check fails on the second hop every time. Relays work around it by replacing the envelope sender with an address on their own domain, which makes the check pass again but also makes the relay the party your provider holds responsible for the message.

The second pillar is a cryptographic signature over the message itself, and it survives forwarding only while the message is untouched. A relay that appends a footer, rewrites links for click tracking, or reformats anything invalidates the signature, and the message arrives with one pillar broken and the other pointing at the relay rather than the original sender.

Three practical consequences follow. Your provider is judging the relay's reputation, not the sender's. Other people's mail through the same relay affects what happens to yours. And a message that goes missing is difficult to chase, because the sender's logs say delivered and your provider's decision was made about somebody else's domain.

The alias is written down in the message

Every hop a message takes adds a line to its headers recording who handed it to whom. A forwarded message therefore arrives in your real mailbox carrying the relay's name, the alias it was originally addressed to, and the times of both hops.

That has an upside, and it is the reason serious alias users bother. Because the alias survives in the headers, a message reaching you through an alias that only one company ever received is proof of what that company did with it. One alias per relationship turns your own inbox into an audit log of who sold you on.

It has a downside too. The relay's domain is right there, so anyone paying attention on the sending side knows you used one before any list is consulted. If you have never looked at these lines, reading email headers walks through what each one means and where to find them.

The tracking pixel fires from your house

Here is a difference between masking and a disposable inbox that runs opposite to the usual assumption, and it deserves precision here because we have an obvious interest in it.

A masked message is delivered into your normal mail application, which renders it the way it renders everything else. Remote images load. The invisible one pixel image at the bottom loads with them, reporting the moment you opened the message, roughly where you were when you did it, and often which client you use. Masking hid your address from the sender. It hid none of that.

Mail read here behaves differently, not out of virtue but because of how it has to be built. Bodies are cleaned on arrival, with scripts, stylesheets and embedded frames removed along with their contents and inline styling dropped entirely, and what remains is displayed inside an isolated frame that does not fetch remote content by default. What the sender finds out is that delivery succeeded. Whether anyone looked at it is not something they can observe.

So the two tools protect different things. Masking hides who you are from the sender while leaving your reading behaviour fully visible. A disposable inbox hides the reading while leaving you with an address that will not exist next week. Neither one covers both, and choosing well means knowing which of the two you actually mind.

Where masking breaks

Replying. The site emails you at the alias, you hit reply, and without special handling your real address goes out in the From header. Good relays solve this by routing replies back through the alias. Simple forwarding setups do not, and one careless reply undoes the whole arrangement.

Ecosystem lock-in. Platform masking is the most comfortable and the hardest to leave. Addresses generated inside one company's system generally cannot be moved to another, so switching phones or browsers can mean changing the address on every account you protected.

Losing the middleman. If the relay service shuts down, is bought, or simply locks you out, every address stops forwarding at once. This is the failure mode people underestimate, because it takes out dozens of accounts simultaneously and you find out through silence rather than an error message. It is also the reason the hardware in your house is better bound to a mailbox you hold directly than to any relay, since a thermostat can outlive the company forwarding its password resets.

Forms that refuse relay domains. Masking domains are widely known, and a growing number of signup forms treat them exactly like throwaway domains. The detection machinery does not care that you paid for the address.

What masking does not do

It does not make you unlinkable. If forty aliases all forward into one mailbox, anyone with visibility into that mailbox sees one person. Masking protects against the sender learning your address, not against correlation by someone with a wider view.

It does not stop the sender from profiling you. Your reading behaviour, your IP when you open the message, and everything you typed into their form are unaffected by which address received it.

And it does not delete anything. Storage keeps growing, because forwarded mail is real mail in your real mailbox.

When masking beats a disposable address

We run a disposable service and will still say this plainly: for anything you expect to keep, masking is the better tool.

Subscriptions you will renew. Shops you buy from more than once. Any account with a password you might reset. Services tied to money, delivery or identity. A job search, where the reply you actually wanted arrives three weeks after you stopped checking. In all of these the address has to keep working, and an address designed to expire is the wrong instrument.

Masking also wins for the long game of finding out who leaked you: one alias per company, kept for years, and the day spam arrives at one of them you know exactly which company sold it.

When masking is overkill

One signup, one code, no relationship. Reading a forum thread. Downloading a file behind a form. Claiming a discount at a shop you will never visit again.

Creating a permanent alias for these adds an entry to a list you now maintain forever. Multiply by a few hundred over a decade and the list becomes its own small chore. A throwaway address leaves nothing to maintain, which is the actual argument for it: not privacy, tidiness.

There is a maintenance cost people discover late, too. Aliases accumulate faster than anyone disables them, and after a few years the list contains entries whose purpose nobody remembers. Deleting one is a small risk, because you cannot be sure nothing important still uses it, so most people leave them running. The tidy system quietly becomes a second inbox you administer.

What you are really trading

Both approaches move trust around rather than eliminating it.

With masking, you trust the relay operator. They see every message before you do, they know the map between aliases and your real address, and their outage is your outage across every account at once.

With a disposable address, you trust the operator too, but only briefly and only with mail you were about to forget. The exposure is smaller because the relationship is shorter, and because there is no map connecting the address to anything else about you.

Neither is a form of privacy that survives you handing over your name, your card and your phone number on the next screen. What both do well is stop the address itself from becoming the thread that ties one company's database to another's, and that is worth doing even when nothing dramatic is at stake.