Email Aliases/Accounts reddit / selfhosted ---------------------------------------------------------------------- BleepsSweepsNCreeps · 2023-10-12 17:07 I just set up my new custom domain email. I got tired of using my everyday Gmail to also manage sending out all my homelab error/maintenance/update/status/etc emails. I plan on having a new personal email as my Gmail has acquired a lot of spam being over a decade old. I want an email for my homelab services so people can get their Ombi notifications from say ombi@mydomain.com. I'm setting one up for my wife. We also want a joint one for things that pertain to both of us like statements and bills, home building process, etc. I want to make a junk/throwaway account for situations where say we want to download something but you have to provide and email first and you don't really want to give up your email for a download so you just send it to garbage@mydomain.com or something like that. My question is how do you all manage your email systems when it comes to aliases, creating a dedicated user, catch-alls, and whatever else their may be? My account and her account will definitely be dedicated accounts but what would the most efficient way of setting up all the different emails so I don't end up with like 30 separate accounts to manage? Also what all aliases and such do you guys utilize in your homelab environment? Thanks! ---------------------------------------------------------------------- lesigh · 2023-10-12 17:20 ImprovMX free catch all forward to my Gmail. Then I use filters to sort ---------------------------------------------------------------------- root-node · 2023-10-12 17:21 First, for throw away accounts where they want an email address for downloading something, use mailinator.com, or something similar. I too have my own domain for email. I have a catch-all that forwards everything to one mailbox, that way I can create addresses on the fly whenever I need one - that way you only need aliases for when you want to send emails. As an example, if I am shopping in a new store called Acme Inc, and they want my email for a service I want, I would use "acme@mydomain.com". I don't need to send emails to them, so I don't need to set up an alias, the catch-all will handle it for me. Every company/service gets their own specific address: amazon@, google@, apple@, etc. If my wife and I need a separate one (apple for example, we would add our names to the end: apple-bob@ or apple-ann@ For all my homelab services that need to email me alerts, I just use support@ as the subject line usually states the service. The advantage of all this, is that once you get spam in from somewhere, you know exactly which company it came from and you can block all emails to that address and stop doing business with them. I get very little spam, maybe one a month in all the 15+ years I have had my own email domain. ---------------------------------------------------------------------- BleepsSweepsNCreeps · 2023-10-12 17:30 That makes a lot of sense. Thanks! ---------------------------------------------------------------------- jusepal · 2023-10-12 17:35 Just setup catchall and route accordingly. Something like cloudflare free email relay would work just fine. Its just for incoming only though, can't send nor reply without exposing the real inbox. For sending and replying without exposing real inbox you'd want something like simplelogin or anonaddy. Can be selfhosted but it comes with all the pain of selfhosting mail; opening port 25, clean ip, dkim, spf, dmarc etc etc. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-12 18:21 **First** of all, use an email provider that offers wildcard aliases and the ability to block individual addresses. Wildcard aliases means you can define addresses with a star `*` in them and that part can be anything and it will still receive mail. For example you define `shop-*@mydomain` and then subscribe to Amazon with `shop- amazon@mydomain`, to eBay with `shop-ebay@` and so on. You can do this on the fly, no need to go to your email admin to create aliases. If website Foofoo sells your address or is broken into and `shop-foofoo@` starts getting spam, you will (1) know exactly who's fault it was and (2) block `shop-foofoo@` and move on. If you don't have wildcard aliases you can achieve the same with full aliases and catch-all, but in that case you'll need to preemptively block some addresses that are known to receive spam, like `admin@mydomain`. Some providers also offer subdomain addressing (eg. `*@shop.mydomain.com` but that's a bit of a niche feature. Please note that wildcard aliases are not the same as plus-addressing (adding `+alias@mydomain` to your real address) for the obvious reasons – they give up your real address, whereas wildcard aliases, like regular aliases, completely hide your real address. Which brings us to: **Second**, never use your real account address for anything. I mean the one you login with. Make it as weird as you can while still remembering it, and *only ever use it* to login to IMAP/SMTP/POP3, to your admin interface, and to webmail (from trusted devices!) For *everything else*, including emailing with anybody, use only aliases. Some providers allow you to use aliases even for webmail login, if they do, use that. Even if it's your dear old mother, make an alias called `yourname@mydomain` and give her that, not your real address. That's it. I've been using my accounts this way for a couple of decades and I get very little spam, we're talking one spam a month, and it's usually the first and only one before I block the alias that was compromised because random website I bought a knicknack from was broken into. If you and the wife are both using the same domain you'll have to arrange a system to not step on each other's aliases but that's about it. A decent email provider will allow both of you to be admins while retaining separate mailboxes and logins. Speaking of provider I wholeheartedly recommend migadu.com. Has all the tricks above and then some, and it's a Swiss company with servers hosted in France. They don't tax per mailbox or domain or alias, you can have as many as you want of those, they only tax per storage and per tier of emails actually sent/received. ---------------------------------------------------------------------- ElevenNotes · 2023-10-12 18:28 I created an Exchange Plugin so I can use the "foo+bar@domain.com" trick. Do not use catch-all, once a spammer finds your domain you get "27heibdnwlsnnyk@domain.com" and much more SPAM like that. ---------------------------------------------------------------------- BleepsSweepsNCreeps · 2023-10-12 18:28 All good info. Thanks! I actually just gave mxroute a try but migadu was one of the ones it was contending against. Mxroute doesn't offer refunds so unless I run into a security issue, I will likely wait until the first year is up before I transfer services if I find mxroute not all that I hoped it to be. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-12 18:47 Ah, gotcha. MXroute is less sophisticated than Migadu but you should be able to use aliases with catch-all. Check out /r/mxroute/ if you need help. ---------------------------------------------------------------------- GolemancerVekk · 2023-10-12 19:48 Spammers don't try random addresses. Mostly they just use huge lists of actual addresses that were already used somewhere, harvested by breaking into websites' databases or sold by someone there. Some spammers monitor domain registrations and generate some addresses that every domain used to have once upon a time (admin@, contact@, office@ etc.) but that's fallen a bit out of fashion. Unless someone is specifically targeting your and making up addresses and subscribing them to spammers you're fairly safe even using a catch-all. But yes, it would be ideal if you can use wildcard aliases like I explained in the other comment and disable catch-all. ---------------------------------------------------------------------- zekthedeadcow · 2023-10-12 20:02 I just use wildcard emails and makeup whatever on the spot and then use filtering if needed. almost all of my spam comes from accounts used for government services and compliance... mostly cointracker, police departments, and columbus ohio's parking app. I can add a date to see if things are from old leaks as well... like 20231011columbuspark@domain