An email alias is an extra address that delivers into a mailbox you already have. With your own domain and a catch-all, every address on the domain works without any setup: amazon@example.com, dentist@example.com, newsletter-x@example.com. You hand out a different one to every company.
What you get:
- You see who leaked or sold your address. Spam to
shop-xyz@example.comcame from shop-xyz or one of its partners. - You block 1 address, not your whole identity. Turn off a burned alias and the rest keeps working.
- Filters become trivial. Sort by the address the sender wrote to, not by guessing the sender.
- Your real mailbox address stays private. Nobody outside needs it.
Receiving is the easy half. Replying is where most setups break: the reply goes out from the main mailbox, and the alias is gone. This note covers both halves.
How it works
Receiving
- The domain's MX records point to your mail provider.
- A catch-all rule delivers every address that has no mailbox of its own into 1 mailbox.
- The client shows which alias was used. Look at the
To,Delivered-ToorX-Original-Toheader.
Sending as an alias
An email carries 2 sender addresses:
| Address | Where it lives | Who sees it |
|---|---|---|
| Header From | The From: line |
Everyone. It's the address shown in the inbox |
Envelope sender (MAIL FROM) |
The SMTP conversation | The receiving server. It becomes Return-Path: |
Your client logs in to the provider's SMTP server with the mailbox credentials, then sends with the alias as the From. 2 conditions:
- The provider must allow it. Most providers refuse a From that isn't the mailbox or a registered identity. Some can be told to accept any address of the domain.
- The client must let you pick or type the alias. Ideally it also picks it by itself when you reply.
The envelope sender matters for privacy. If the client puts the mailbox address there, the recipient sees Return-Path: mailbox@example.com in the raw headers. Bounces go to the envelope sender, so an alias there is fine: the catch-all delivers them back to you.
Deliverability
A reply from an alias passes every check, as long as the alias is on the same domain as the mailbox:
- SPF checks the envelope sender's domain against the servers allowed to send for it (
v=spf1 include:spf.migadu.com -all). - DKIM: the provider signs every email for your domain (
d=example.com), whatever the address before the @. - DMARC compares domains only.
xyz@example.comandmailbox@example.comcount as the same sender.
An alias on another domain is different. The provider must accept it, and that domain needs its own SPF and DKIM, or DMARC fails. Migadu refuses it outright with 550 5.7.1 sender address rejected: not allowed when the mailbox belongs to another domain.
Step 1: the provider
Pick a provider that does both a catch-all and sending as any address of the domain.
| Provider | Catch-all | Send as any address of the domain |
|---|---|---|
| Migadu | Yes, per domain | Yes: the Wildcard sender permission on 1 mailbox |
| Fastmail | Yes: an alias *@example.com |
Yes: type any From on the domain when you write |
| Google Workspace | Yes: a routing rule | No. Each address is an alias of the user or a Send mail as entry |
| iCloud+ custom domain | Yes | No. Only the addresses you added to the domain |
Migadu
- In the Migadu admin, open the domain, then Mailboxes, then the mailbox that receives everything.
- Turn on Wildcard sender. The mailbox may now send as any address of this domain, with its own login. Identities don't inherit the right.
- Open the domain settings and set the catch-all ("improperly addressed messages") to deliver to that mailbox.
- Use
smtp.migadu.com, port 465 (SSL), with the mailbox address and password, in every client.
To stop a burned alias, put it on the mailbox's recipient denylist. Migadu then refuses mail to it during delivery, so the sender gets a bounce and usually drops the address. More in Migadu.
Fastmail
- Go to Settings > My email addresses, click Add address, then Create an alias.
- Type
*, choose your domain, and click Create alias. Then click Save. - When you write from that domain, type any address in the From field.
Google Workspace
The catch-all is a routing rule: see How to setup a catch-all email with Google Mail (GSuite). Sending needs 1 entry per alias (see Gmail below), so it works for 5 aliases, not for 500.
Step 2: DNS
Check 4 records before you send anything. Replace example.com and use the values of your provider.
dig +short MX example.com # the provider's MX hosts
dig +short TXT example.com | grep spf # v=spf1 include:<provider> -all
dig +short CNAME key1._domainkey.example.com # DKIM key (Migadu: key1, key2, key3)
dig +short TXT _dmarc.example.com # v=DMARC1; p=quarantine; (or p=none to start)
Step 3: the mail client
Each client handles 3 things differently:
- Reply: does a reply go out from the alias the email was sent to?
- New alias: can you type a new alias while you write?
- Return-Path: does the alias also become the envelope sender?
| Client | Reply from the alias | Type a new alias | Notes |
|---|---|---|---|
| Thunderbird | Yes, automatic with a wildcard | Yes | The best free option on Mac and Windows |
| Fastmail (web, app) | Check it on each reply | Yes | Needs Fastmail as the provider |
| Apple Mail (Mac) | Yes, for listed aliases only | No, add it first | Fine for a few fixed aliases |
| iPhone and iPad Mail | Yes, for listed aliases only | No, add it first | Same logic as Apple Mail |
| Gmail (web) | Yes, for listed aliases only | No, add and verify it | 1 setup per alias |
| Outlook (classic) | No | Yes, by hand | Weak for this |
Thunderbird
Thunderbird is the only common client that does all 3 by itself.
- Add the mailbox as an IMAP account with the provider's IMAP and SMTP settings.
- Open Account Settings and select the account (the top level, where the email address is).
- Tick Reply from this identity when delivery headers match, and type
*@example.comin the field. - Click OK.
Replies now go out from the address the email was sent to. To use a new alias in a new email:
- Click the From field in the compose window.
- Choose Customize From Address... and type the alias.
Thunderbird sends the From address as the envelope sender, so Return-Path shows the alias too.
Apple Mail on Mac
Apple Mail chooses the alias by itself, but only from a list you keep.
- Open Mail > Settings (
⌘,), then Accounts, and select the account. - Click Account Information.
- Open the Email Address pop-up menu and choose Edit Email Addresses.
- Click +, type the alias, and repeat for every alias you want to send from.
- Close the window.
A reply to an email sent to a listed alias goes out from that alias. In a new email, pick the alias in the From menu. An alias that isn't on the list can't be used, so a catch-all with 100s of aliases needs a different client for replies.
iPhone and iPad Mail
- Open Settings > Apps > Mail > Mail Accounts, then tap the account.
- Tap Account, then Email.
- Tap Add Another Email, type the alias, and repeat.
- Some IMAP accounts show a plain Email field instead: type all the addresses there, separated by commas, with no spaces (
mailbox@example.com,shop@example.com). - Tap Done.
In a new email, tap the From line to choose. Replies follow the same rule as on the Mac.
Gmail
Gmail sends as another address only after it checks you own it, and it needs your provider's SMTP server.
- Open Gmail, click the gear, then See all settings, then Accounts (or Accounts and Import).
- Under Send mail as, click Add another email address.
- Type a name and the alias. Click Next Step.
- Enter the provider's SMTP server (
smtp.migadu.com, port 465, SSL) with the mailbox login and password. Click Add Account. - Open the confirmation email (the catch-all delivers it) and click the link or type the code.
- Back in Accounts, under When replying to a message, choose Reply from the same address the message was sent to.
Repeat steps 2 to 5 for each alias. Gmail has no wildcard.
Fastmail
After the catch-all alias in Step 1, the Fastmail web app and apps let you type any address of the domain in From. Look at the From line before you send a reply: with a wildcard, Fastmail can fall back to your main address.
Outlook
- Classic Outlook on Windows: in a new email, click Options, then From to show the field. Click From > Other email address and type the alias. Outlook sends it through the account's SMTP server. Replies don't pick the alias.
- New Outlook and Outlook for Mac offer aliases for Outlook.com and Microsoft 365 accounts. For an IMAP mailbox on your own domain, use Thunderbird or Apple Mail instead.
Step 4: test it
- Send an email from an alias to a Gmail address you own.
- Open it in Gmail, click the 3 dots, then Show original.
- Check that SPF, DKIM and DMARC all say
PASS. - Check the
From:line, and check thatReturn-Path:shows the alias, not the mailbox. - Reply to it, and check that your reply came back to the alias.
Pitfalls
- Catch-alls attract guessed addresses. Spammers try
info@,admin@andsales@. Block those that only get spam. - An alias on another domain fails. The mailbox can send only on its own domain. A family member's domain needs its own mailbox with its own sending right.
- Don't reuse a burned alias. Once it's on a spam list, block it and move on.
- Write the alias down when you give it out.
shop-name@is easier to trace thanx7@. Add the date (shop-2610@) if you sign up often. - Keep 1 real address for people. Aliases are for companies. Friends and colleagues get your normal address.
My setup
1 Migadu mailbox receives the catch-all of my domain and has the Wildcard sender right. My own mail app, Emailee (!NicAI/emailee), reads the alias every email was sent to and replies from it by itself, with the alias as envelope sender too. A button next to From types a new alias when I write. Emailee lists only the addresses each SMTP server accepts, so a reply never goes out from an alias the server would refuse.
Further reading
