How to protect your e-mail address from spam

A new mailbox is wonderfully quiet. A few years later, dozens of messages arrive every day from shops you never visited, alleged prizes and dubious loan offers. Spam is not a law of nature. With a few habits your main address stays clean for years, and if something does slip through, you know exactly where it came from.

How spammers get your address

Before you protect yourself, it helps to know the sources. The most important ones are:

• Data breaches: a shop or forum gets hacked and its customer database ends up online. This is the biggest source today.
• Sharing and selling: giveaways and free downloads often collect addresses for exactly this purpose.
• Published addresses: programs automatically scan websites, forums and public documents for anything that looks like an e-mail address.
• Guessing: common combinations such as info@, contact@ or firstname.lastname@ are simply tried out.

Check whether your address is already in a breach

Services like Have I Been Pwned show you which known data breaches your address appears in. If you find a match, change the password of the affected service and everywhere else you used the same password. A password manager takes the work out of using a separate password for every service.

The layer model: one address per purpose

The most effective protection is not to hand out your main address everywhere. A split into three layers works well:

Layer	Used for	Example
Main address	people, your bank, authorities, important accounts	[email protected]
Alias or plus address	shops, newsletters, accounts you keep	[email protected]
Disposable address	one-off confirmations, downloads, Wi-Fi	an address from TossPost

That way only a small circle learns your main address. Everything else goes through addresses you can switch off or let expire at any time.

Plus addresses and aliases

Many providers, including Gmail and Outlook, automatically deliver mail for name+anything@ to name@. So you can use a different suffix for every shop, for example [email protected]. If spam later arrives at exactly that address, you know who passed your data on and can filter it out.

There are two limitations: some forms reject the plus sign, and spammers can simply strip the suffix. Real aliases give you more control. With your own domain you can create as many addresses as you like that forward to your mailbox. Alias services and some mail providers offer this without your own domain, too. If an alias turns into a spam magnet, you simply delete it.

Disposable addresses for everything one-off

You do not need a permanent mailbox to download a white paper, use hotel Wi-Fi or try out a service. A disposable address receives the one confirmation and is gone afterwards, together with all messages. If the provider is hacked later, its database contains an address that no longer exists.

For accounts you want to keep, an alias is the better choice. Otherwise you will not be able to reach the password reset link later.

Do not publish your address in plain text

If you need a contact address on your website, use a contact form or a separate address just for that purpose. If you post your address in a public forum or in comments, it will be harvested sooner or later.

Do not react to spam

Every reaction confirms to the senders that your address is active and read:

• Do not reply, not even with "please remove me".
• Do not click unsubscribe links in obvious spam. For legitimate newsletters you signed up for yourself, unsubscribing is the right way, though.
• Mark it as spam instead of just deleting it. That way your filter learns along.

Do not load images automatically

Many e-mails contain invisible images, so-called tracking pixels. When your mail app loads them, the sender learns that and when you opened the message, and that your address works. Set your mail app to load external images only after asking. In TossPost, external images are blocked by default until you load them yourself.

If it is already too late

If your address is already on many lists, filter rules and consistently marking messages as spam help. If the flood still does not stop, a fresh start can make sense: set up a new main address, share it only with your contacts and important services, and keep the old one running for a while until only spam arrives there. With the layer model, the new address stays clean this time.

Get a disposable address for your next sign-up – no account, ready right away.