Privacy › Module 5 › Lesson 1
Email Aliases & Burner Addresses
Use email aliases and forwarding to limit spam and trace data leaks
Opening
One inbox, many street addresses — none of them are disguises for crime
Your primary mailbox is the recovery key to banking, government, and work. Every shop that stores that address becomes a leak sensor you cannot isolate: when the spam starts, you cannot tell which merchant sold the row. An alias is a forwarder: a unique face for a unique relationship, all landing in the same inbox you actually read. When shop-alias@ starts getting credential-stuffing mail, you know which vendor leaked (or sold) it. You disable that alias. You do not burn the bank address. Aliases are for privacy and leak-tracing — not for opening accounts in other people's names, not for evading bans you earned, not for fraud. This lesson never teaches fake identities for crime.
1. Forwarders, plus-addressing, and why the bank still gets the real door
The mechanism is simple: the destination mailbox stays yours; the local-part (or a random token) changes per site. Provider alias services (Apple Hide My Email, Firefox Relay, SimpleLogin, and similar) mint addresses that forward to you and can be switched off one-by-one. Plus-addressing, when the provider supports it, is cheaper: [email protected] still delivers to [email protected]. Some merchants reject the plus sign or normalize it away — then you need a real alias, not a plus tag. Segmentation is the whole point. Banking, government, password-manager recovery, and work stay on the primary (or a dedicated high-value mailbox). Shopping, trials, forums, newsletters, and "10% off if you sign up" get aliases. Throwaway is for one-shot downloads you do not need to recover. If you put the bank on a disposable forwarder, a disabled alias becomes an account-recovery incident. Label each alias in your password manager so six months later you remember which door belongs to which shop.
Catch-all on a domain you own (shop@yourdomain) is power-user mode: unlimited unique addresses. The registrar and DNS then become crown jewels — 2FA on the registrar, or someone else inherits every alias. Still not a fraud kit. Unique addresses do not make unpaid invoices legal, and they do not make impersonation acceptable. If a site's terms require your real identity (KYC, government, employer), you do not alias your way around the law.
2. Wrong vs right: a new alias for every scam checkout
Worked failure mode — treating privacy mail as a mask for fraud, or dumping the bank into a throwaway. Aliases isolate leaks; they do not invent people.
Wrong
Create aliases to open stores, banks, or government portals under a fake name, to dodge a ban you caused, or to harass. Put recovery email on a forwarder you will delete next week. Hand plus-addresses to phishing kits as "tradecraft." That is crime or self-lockout, not a toolkit.
Right
Keep primary mail for bank / government / recovery. Create or note one shopping alias (plus-address if your provider supports user+shop@, else Hide My Email / Relay / similar). Log it in your password manager. If that alias later appears in a breach or spam burst, you know which merchant — disable the alias, rotate that shop's password. No fraud.
3. Practical: one shopping alias, primary reserved
You do not need a new domain today. Confirm whether your provider documents plus-addressing. Send yourself a test to you+cyberlium@ if it does. If plus is blocked at a merchant you use, turn on one official hide-my-email / relay alias instead. Write which address is primary (high-value only) and which is shopping. Never put the notes file in a public repo.
Command guide
Alias map — your inbox, privacy not fraud
Command — copy this
mkdir -p "$HOME/cyberlium-lab" NOTES="$HOME/cyberlium-lab/email-aliases.txt"
Plus-addressing (if YOUR provider supports it): [email protected] → still arrives at [email protected] If a site strips "+" or rejects it, use Hide My Email / Relay / SimpleLogin instead.
Command — copy this
{
echo "date: $(date -Iseconds 2>/dev/null || date /t)"
echo "primary_for: bank / government / password recovery / work — NOT newsletters"
echo "plus_addressing_supported: yes/no/untested"
echo "shopping_alias: (plus tag OR provider alias you created)"
echo "throwaway_policy: one-shot downloads only; never recovery"
echo "fraud_use: no — aliases are leak-tracing, not fake KYC"
} > "$NOTES"
chmod 600 "$NOTES"
cat "$NOTES"NEVER: aliases to impersonate, commit fraud, or evade lawful identity checks NEVER: put bank recovery on a disposable forwarder NEVER: publish the notes file or your real primary address in a lab screenshot for strangers
Mission: reserve primary, name one shopping alias
Write $HOME/cyberlium-lab/email-aliases.txt (mode 600): which mailbox is primary (bank/government/recovery only), whether plus-addressing works for you, and one shopping alias (plus tag or a provider hide-my-email / relay). Optionally send yourself a test to you+cyberlium@ if supported. Aliases are for privacy and leak-tracing — not fraud.
Stuck? Ask Cyberlium AI Mentor
If plus-addressing bounces or a site rejects aliases, ask Cyberlium AI Mentor for a hint — not a recipe for fake identities. Try: "Hint only: my provider delivers you+shop@ to the same inbox, but a merchant rejects the plus sign — what kind of alias still lets me trace a leak without moving bank recovery?"
You can explain one inbox with many forwarders, keep high-value recovery off throwaways, and use plus-addressing or a real alias so a shop leak names the door. Privacy, not impersonation. Next — Device Privacy Checklist — lock screen, updates, permissions, lock-screen notifications, and Find My as a recovery tool versus stalkerware as a risk you do not practice.
Knowledge Check
APPLY: Spam and reset-phish start arriving at you+shoesite@, while the bank address is quiet. What did the alias buy you?
Multiple choice
Knowledge Check
APPLY: A friend wants plus-addressing "to sign up for giveaways in other people's names." What is in-scope here?
Multiple choice
Knowledge Check
APPLY: True or False: If your provider supports it, user+shop@ still delivers to the base mailbox, but some sites block the plus sign — then you use a real forwarder, still not for bank recovery.
True or False