Email aliases and relays: keep your real address private
An email alias is an extra address that delivers into your existing inbox. A relay service hands you a new alias for every website you sign up to, so each site knows a different address and none of them knows your real one. If a site leaks its customer list or starts sending spam, you switch that one alias off and nothing else changes. Firefox Relay, Mozilla's free relay service, is the easiest way to start.
Why one address everywhere is a risk
Most people give the same email address to every shop, newsletter and app. That address then does three jobs at once: it is how people reach you, it is your username on dozens of websites, and it is where password reset links arrive.
Each job carries a risk:
- Spam. Once the address is on one marketing list, it tends to spread to others, and you cannot take it back.
- Reused logins. Attackers take email and password pairs leaked from one site and try them on others. The Open Worldwide Application Security Project (OWASP) explains that this works because people reuse the same email and password. Many sites use the email address as the username, which makes those pairs effective.
- Account resets. The UK National Cyber Security Centre (NCSC) points out that a criminal who gets into your email can reset the passwords of your other accounts.
An alias for each site breaks the chain. A leaked alias is a username nobody else recognises, and the spam stops when you switch it off.
Four ways to get aliases
| Option | What it is | Best for |
|---|---|---|
| Firefox Relay | A free Mozilla service that creates masked addresses on its own domain and forwards them to you | Sign-ups, newsletters, shops |
| addy.io or SimpleLogin | Open-source relay services, both also available to run on your own server | People who want more control, or to self-host |
| Plus addressing | Adding a tag to your address, such as [email protected] | Sorting mail with filters |
| Aliases on your own domain | Extra addresses on a domain you own, set up in your mail control panel | A business with its own domain |
Firefox Relay, addy.io and SimpleLogin are all open source: Relay under the Mozilla Public Licence and the other two under the GNU Affero General Public Licence. SimpleLogin has been part of Proton since 2022.
How to set up Firefox Relay
Relay needs a Mozilla account, which is free.
- Go to relay.firefox.com and choose to sign up. Create or sign in to your Mozilla account and verify your email address. This is the real address your masks will forward to.
- Open the Relay dashboard and select Generate new mask. Relay creates a random address on the mozmail.com domain.
- Give the mask a label, such as the name of the shop, so you can see later where you used it.
- Use the mask instead of your real address when you sign up to the website.
- To create masks without leaving the page, install the Firefox Relay add-on from Mozilla. It puts a Relay icon in email fields on websites, where you can generate a new mask or pick one you already have.
- In Firefox itself, you can also let the browser suggest a Relay mask on sign-up forms. Look for Suggest Firefox Relay email masks in Firefox's settings, under the passwords section of Privacy & Security.
When a mask starts receiving spam, open the dashboard and block or delete it. Mail to that mask stops, and your other masks keep working.
What the free plan includes
- A handful of masks. Mozilla's Relay page says the free plan includes five.
- Tracker removal. Relay can strip common tracking pixels from forwarded mail. Mozilla warns that some messages may then look broken, because trackers sit inside images and links.
- A size limit. Messages larger than 10 MB are not forwarded.
Relay Premium adds unlimited masks, replies from a mask, your own Relay subdomain and blocking of promotional mail. As at October 2026, Premium is not offered in South Africa, and phone number masking is limited to the United States and Canada. The free plan works from South Africa.
What Mozilla sees
A relay hides your address from the website, not from the relay. Mozilla says it does not read or store the content of the messages it forwards, and that it holds mail it cannot deliver for no more than three days. It does keep the link between your masks and your real address, and by default the websites where you used each mask. You can switch that site record off in the Relay settings.
Mozilla itself advises keeping your real address for your bank, your doctor, your lawyer and identity checks. Those are the places you most need every message to arrive.
Plus addressing, and its limits
Many mail services, Gmail among them, deliver mail sent to name+anything@ to the address before the plus sign. Writing [email protected] when you sign up to a shop costs nothing and lets you filter that shop's mail into a folder.
It is not privacy. Anyone who has [email protected] can delete the tag and write to your real address. Some websites also reject addresses with a plus sign. Treat plus addressing as a filing tool and a relay as the protection.
Aliases on your own domain
A business with its own domain can create aliases in its mail control panel. On Noiz shared hosting, Plesk adds an alias under Mail, on the mailbox's Email Aliases tab: type the new address and save. Mail to the alias arrives in the same mailbox.
Mailcow, the open-source mail server behind Noiz Private Email, goes further. Mailbox users can create temporary aliases themselves, set to expire after an hour, a day, a year or never, which is useful for a one-off form or competition entry.
A few habits that make aliases work
- Label every alias with the site you gave it to.
- Keep unique passwords and two-factor sign-in. Aliases reduce what a leak exposes; they do not replace a password manager.
- Be wary of mail that arrives at the wrong alias. A message claiming to be from your bank that arrives at the address you gave a shoe shop deserves suspicion.
- Do not add CC or BCC when replying from a relay. Mozilla notes this reveals your real address.
Where Noiz fits
Noiz does not run a public relay service today. Firefox Relay covers most people's needs for free, and addy.io or SimpleLogin suit anyone who wants to run their own. For a business, aliases on your own domain, on Noiz shared hosting or on Private Email, keep every address under your own name.
If you want aliases and temporary addresses on a mail server that serves only your organisation, ask us about Private Email.
Sources
- Firefox Relay FAQ: https://relay.firefox.com/faq/
- Firefox Relay plans: https://relay.firefox.com/premium/
- Mozilla Subscription Services privacy notice (effective 17 December 2025): https://www.mozilla.org/en-GB/privacy/subscription-services/
- Mozilla Subscription Services terms (effective 16 September 2026): https://www.mozilla.org/en-US/about/legal/terms/subscription-services/
- Firefox Relay source code and licence: https://github.com/mozilla/fx-private-relay
- Firefox Relay add-on: https://addons.mozilla.org/firefox/addon/private-relay/
- addy.io: https://addy.io/ and source https://github.com/anonaddy/anonaddy
- SimpleLogin: https://simplelogin.io/ and source https://github.com/simple-login/app
- Proton, Proton and SimpleLogin are joining forces (8 April 2022): https://proton.me/blog/proton-and-simplelogin-join-forces
- Gmail Help, use Gmail aliases: https://support.google.com/mail/answer/22370
- Fastmail, plus addressing and subdomain addressing: https://www.fastmail.help/hc/en-us/articles/360060591053
- Plesk Obsidian, creating mail aliases: https://docs.plesk.com/en-US/obsidian/customer-guide/mail-settings/creating-mail-aliases.65701/
- Mailcow, temporary email aliases: https://docs.mailcow.email/manual-guides/mailcow-UI/u_e-mailcow_ui-spamalias/
- OWASP, credential stuffing: https://owasp.org/www-community/attacks/Credential_stuffing
- OWASP Credential Stuffing Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html
- NCSC, use a strong and separate password for your email: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/use-a-strong-and-separate-password-for-email
Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.
