Giving out your email to websites has become a necessary evil these days.
However, what usually ensues is a barrage of spam that clutters your inbox and exposes you to malicious threats.
One way to get on top of your spam is to use simple, unique email aliases when signing up for new accounts online.
These aliases can help mitigate the chances of your personal email receiving spam and can even be an extra layer of protection against cybercriminals.
What are email aliases?
An email alias is a simple-to-create additional address for an email account, with which a user can send and receive emails or set forwards through their primary mailbox.
In most cases, these aliases can be created on the fly without the need for additional settings or admin involvement, making it very simple and easy to use.
In reality, an email alias doesn’t have a mailbox of its own, and instead forwards all emails to the primary email address.
In an enterprise environment, a single user account can have multiple email aliases, with different domains or even with the same domain.
However, for webmail email servers such as Gmail, email aliases are usually available only within the same domain.
Creating an email alias
Simply put, adding a '+' character after the username portion of your email address followed by a notation specific to the site you’re signing up at lets you create an infinite number of unique email addresses tied to the same domain.
Let’s break it down. For instance, if I were signing up at example.com, I might give my email address as: ephrem.joseph+example@gmail.com.
Then, I simply go back to my inbox and create a corresponding folder called 'Example', along with a new filter that sends any email addressed to that alias to the ‘Example’ folder.
In the filters section, I have the flexibility to mark emails from any particular alias as important or to delete it immediately.
Importantly, you don’t ever use this alias anywhere else. That way, if anyone other than example.com starts sending emails to it, it is reasonable to assume that example.com either shared your address with others or that it got hacked and relieved of that information.
In the case of enterprise accounts, you can also create email aliases without the usage of the '+' characters, e.g example@enterprise.com – provided its permissible by the administrator
Protection against spam
The most obvious benefit is that using an email alias for each service helps to protect your real email address against spam.
Interestingly, if you have been giving out a different alias for each site, you can easily identify where spam is coming from by simply looking at the alias address.
If one of your aliases starts to receive spam e.g., example.com, you can identify that it was ‘Example’ who either sold your private information or was involved in a data breach.
Using email aliases can be a great way to protect your identity online. Depending on what type of alias you decide to use, it can be hard for the hackers’ scripts to link your true identity to your email aliases.
Things to note before you start
Although most popular email providers accept the usage of the ‘+’ character for creating aliases, some don’t.
Therefore, it is advised to test if the feature is working before you start implementing it
For enterprise use, some providers force you to use a username and password for each alias you create - rendering it impractical for protection against spam.
Notably, cybercriminals have caught on to this trend, Alex Holden, founder of cybersecurity consultancy Hold Security, said that many threat actors will scrub their distribution lists of any aliases because there is a perception that these users are more security and privacy-focused than normal users, and are thus more likely to report spam to their aliased addresses.
Holden goes on to say that the freshly-hacked databases also are often scrubbed of aliases before being sold underground, meaning the hackers will simply remove the aliased portion of the email address.
Regardless of these developments, the use of aliases is one of the simplest cyber-hygiene practices against spam and email protection.